Encrypting VirtualBox VM (From the Outside)
I love trying to force things thru TrueCrypt and the tor network that usually would not work.
Possible reasons that someone would want to do this
1. You have your school software in a vm and your grades are so bad you don’t want the world to see.
2. You have developer projects and source codes that you want to secure.
3. You are a anonymous blogger and you want to keep your posts, anonymity software, web browser secure.
Anyway for this to work just follow these 4(thousand) steps
1. Download Software (if your reading this you should all ready have these tools)
Download TrueCrypt > http://www.truecrypt.com
Download VirtualBox > https://www.virtualbox.org/
2. Setup Encrypted Space
Start TrueCrypt > Create Volume > Create an encrypted File Container > Standerd OR Hidden TrueCrypt volume > Select File… (pick a location) > Encryption Options, pick a algorithm > Set Volume Size (8, 16, 32 GBs should work) > Set Password > In Filesystem Options FAT will not work correctly with a virtual machine > Cross-Platform Support, pick OSX only or other platforms (im on a mac) > FORMAT > wait…
Mount TrueCrypt Container
3. Setup Virtual Machine (.vdi file MUST be in container)
As usual, Start VirtualBox > New > Continue > Pick your choice OS > Put how much RAM will be allocated to this VM > Create New hard disk > Pick Dynamic or Fixed size \/
IMPORTANT: The location of the .vdi file MUST be in the TrueCrypt container. click the little folder in “Location” and find the mounted TrueCrypt container> Pick a size at least 1GB LESS than the size of the TrueCrypt container > Create.
Fixed size might be better (e.g. 32 GB TrueCrypt Container with a 31GB .vdi file in it)
(more info about Hidden Volumes http://www.truecrypt.org/docs/?s=hidden-volume)
4. Install and Configure an Operating System
As usual, Start the virtual machine > locate ISO file OR disk drive > install operating system as usual.
When complete, you can un-mount the TrueCrypt container and the .vdi file inside will be safe.
SSL Secure? maybe? Probably Not
A lot of websites have SSL/HTTPS but sometimes parts of a website are not encrypted at all, This is usually caused by a website storing content on other domains/servers that do not have SSL/HTTPS.
Ways to enforce Secure Connections
Encrypt As Much As Possible = HTTPS Everywhere
Encrypt As Much As Possible, Drop HTTPS = HTTPS Everywhere , Block Port:80 Outbound
Encrypt All without sensitive information and high Anonymity = Tor (snooping exit routers happen)
Encrypt All without sensitive information and low Anonymity = VPN, HTTPS Proxy? (some VPN Providers log)
