2

I am on a project which is illegal in my nation but is not illegal anywhere in the world. In order not to get a 100yr sentence I should be prepared for seizures and forensics.

I am running a server with ESXi 6.7 hypervisor and has three CentOS 7.5 VMs FDE'd with LUKS.

  • I have placed a thick resin to JTAG ports, PCIe ports and RAMs, in case of a cold boot attack.
  • ESXi shuts down automatically when chasis intrusion is detected.
  • I have a CCTV installed in the server room and if it detects too much movement, it will cut power to the server.

What more can I do to be more safe?

2
  • There was a great talk last DEF CON on physical security for servers... – forest Sep 4 '18 at 10:10
  • It may also be helpful if you gave us some hints on what kinds of things you need to do on those servers. Will they be hosting files that may be malicious? Will they be a social medium for a covert organization? Will they be used to download classified material from some gov't box you popped? Etc. I mean you don't need to go into specifics, just enough to make it easier to understand your threat model and what kinds of threats your servers will be exposed to / what kind of information they will be containing. – forest Sep 4 '18 at 10:28
5

The most important factor here is that seizure of the server does not result in your identity as the server's owner being revealed. This must be accomplished by both purchasing the server anonymously, and by not keeping anything on the server which may be linked to you. This is important enough that, without knowing your specific threat model at least, I would consider buying a dedicated server from a company like Ecatel anonymously and forgoing the extensive physical security you have put in place. The reason is that, with enough effort, any physical deterrence measures can be bypassed. A few notes on your current setup, though:

I have placed a thick resin to JTAG ports, PCIe ports and RAMs, in case of a cold boot attack.

Be aware that you would need to use tamper-resistant epoxy (and non-conductive and non-insulating at that), not just any thick resin, otherwise it may be possible to destroy it with various solvents. In addition, cold boot attacks do not always require physically removing memory. There have been instances where a server's BIOS was modified on the fly to trigger a low-memory footprint cold boot attack. Just because your RAM is epoxied down doesn't mean your RAM is safe.

ESXi shuts down automatically when chasis intrusion is detected.

Chassis intrusion is often very easy to defeat.

I have a CCTV installed in the server room and if it detects too much movement, it will cut power to the server.

There are many ways to defeat this. For example, gradually dimming (or increasing) the lights so no sudden change is detected. Eventually the lights will go beyond the camera's specifications and it will be effectively blind to any further motion. You can prevent this by using motion sensitive software which takes into account the risk of gradually changing ambient light levels to hide motion.

What more can I do to be more safe?

There are other things you need to take into account. Before you decide to host something highly illegal, you need to really understand in detail both your adversary, and various ways your anonymity can be defeated. For example, when you SSH into a server, your public key is uploaded to it. Unless you explicitly disable this in the configuration, every server you SSH in to will be able to know you are the same person, even if you use a different IP. Additional things to keep in mind are keystroke biometrics, where your unique typing pattern (monitored either over the wire or on a compromised system) can be used to identify you. Anonymity is hard if you are going high-profile.

You must use remote attestation if you are going to be managing this server remotely. Setting up remote attestation can be complicated, but it is absolutely vital in this scenario. It will protect from firmware tampering as well as intercepting your LUKS password as you send it over the wire. Remote attestation is a technique using a device's TPM (yes, they are safe) to prove to a remote party that the software and firmware exists in a specific, known-good state. It will be able to send back to you a quote which cryptographically ensures that the server is in a good state.

But the most important thing of all... maintain your OPSEC!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.