Subversor

Automated Privacy Enforcement for Linux & OS X


Brief

Subversor is an application to perform automated system privacy and lock-down tasks on Linux & OS X systems based on receiving various local or remote "triggers". This application is inspired by projects such as the Guardian Project's Panic application, Lockwatcher, and USBKill. We have taken the concept of these applications a few steps further by supporting multiple host operating systems, allowing for local and remote triggers, providing many secure trigger options, supporting over a dozen configurable actions, and finally adding the capability to setup Subversor in a distribute manner where a trigger on one system will send a trigger to one or more remote hosts to perform their respective actions.

The core process runs in the background on one or more host systems that you wish to secure from tampering. After configuring your triggers and actions, anytime one of the triggers are detected the system will perform your configured actions.

Project In Progress 70%

Currently, Subversor supports the following Trigger methods:

  • - HTTP server canary checks
  • - Email message checks: Matching on subjects, attachment names or hashes, and header or body text
  • - Keyboard shortcuts
  • - Network interfaces being enabled or disabled
  • - USB devices being attached or removed
  • - Bluetooth being enabled or disabled, and whitelisted devices being disconnected or connected
  • - SMS Messages received via Twilio
  • - Encrypted HTTP or TCP server communication

Along with the standard action set, some anti-forensic actions are available as well. Any anti-forensic option marked with an asterik uses a randomly generated strong password.

  • - Clearing RAM and/or SWAP
  • - Clearing free disk space
  • - Securely deleting files, directories, or attached volumes
  • - Unmounted specified volumes
  • - Send trigger to remote system registed as Subversor "agents"
  • - Securely removing log, cache, and history files
  • - Create fake KeePass archives *
  • - Create random number of encrypted archives filled with GPG encrypted "garbage" files *
  • - Creating circular symlink loops for critical system files and binaries
  • - Modifying timestamps of arbitrary files
  • - Insertion of non-ascii characters into log and history files
  • - Create directories with random files of varying types and sizes, encrypting the files, then deleting them *

Network Communication for Triggers
When remote triggers are chosen, the user has a variety of options to secure the client to server communication. The Subversor process can run as an HTTP or TCP server and respond to the following triggers:

  • - Both the HTTP and TCP servers support encryption via SSL, RC4, AES, and the ability to wrap one type within another
  • - Users define where the Trigger is placed in an HTTP request and what type of request it should be
  • - TCP servers allow for Triggers on immediate packet receipt, port-knocking, or a passphrase provided at a specific offset of an inbound packet
  • - Server traffic can be whitelisted or blacklisted to only accept packets from allowed hosts

Distributed Triggers
Subversor can be setup in a distributed manner where one system runs as the "master" and other systems are registered as "agents". Once an agent is registered, if the master receives a trigger for it's own system then it will automatically send the appropriate trigger to any registered agents as well.

Key Features

  • Automated System Lockdown
  • Linux & OS X Support
  • Local and Remote Triggers
  • Dozens of Privacy Actions
  • Distributed System Support