Полное руководство по операционной безопасности (OpSec) 2025

# Конфигурация многоуровневого проксирования
Internet → VPN #1 (Швеция) → Tor → VPN #2 (Швейцария) → Цель

# Реализация на Python
import socks
import requests
from stem import Signal
from stem.control import Controller

class AnonymityLayer:
    def __init__(self):
        self.proxy_chain = [
            'socks5://vpn1:1080',
            'socks5://tor:9050', 
            'socks5://vpn2:1080'
        ]
    
    def make_request(self, url):
        session = requests.Session()
        for proxy in self.proxy_chain:
            session.proxies.update({'http': proxy, 'https': proxy})
        return session.get(url)

# torrc конфигурация
UseBridges 1
Bridge obfs4 192.0.2.1:443 cert=... iat-mode=0
Bridge obfs4 192.0.2.2:443 cert=... iat-mode=0

StrictNodes 1
ExitNodes {us},{ca}
ExcludeNodes {ru},{cn},{kp}

CircuitBuildTimeout 10
MaxCircuitDirtiness 600

# Сборка ядра с усиленной безопасностью
make menuconfig
# Отключаем:
# - Bluetooth
# - WiFi
# - USB storage
# - Debug features

# Включаем:
# - Grsecurity
# - SELinux
# - Kernel stack protection
# - Memory wipe on shutdown

# Дополнительные меры:
echo 1 > /proc/sys/kernel/kptr_restrict
echo 1 > /proc/sys/kernel/dmesg_restrict
mount -o remount,noexec /dev/shm

import cryptography
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import x25519
from cryptography.hazmat.primitives.kdf.hkdf import HKDF

class SecureProtocol:
    def __init__(self):
        self.private_key = x25519.X25519PrivateKey.generate()
    
    def key_exchange(self, peer_public_key):
        shared_key = self.private_key.exchange(peer_public_key)
        
        # Derive encryption keys
        derived_key = HKDF(
            algorithm=hashes.SHA256(),
            length=32,
            salt=None,
            info=b'secure-protocol'
        ).derive(shared_key)
        
        return derived_key
    
    def encrypt_message(self, message, key):
        # Реализация AES-GCM
        iv = os.urandom(12)
        cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
        ciphertext, tag = cipher.encrypt_and_digest(message)
        return iv + ciphertext + tag

from PIL import Image
import numpy as np

class Steganography:
    def hide_data(self, image_path, data):
        img = Image.open(image_path)
        pixels = np.array(img)
        
        # LSB-метод
        data_bits = ''.join(format(ord(c), '08b') for c in data)
        data_index = 0
        
        for i in range(pixels.shape[0]):
            for j in range(pixels.shape[1]):
                for k in range(3):  # RGB
                    if data_index < len(data_bits):
                        pixels[i][j][k] = (pixels[i][j][k] & 0xFE) | int(data_bits[data_index])
                        data_index += 1
        
        Image.fromarray(pixels).save('hidden.png')

# Современные методы передачи данных
class DeadDrop:
    def create_digital_drop(self, data):
        # Шифруем данные
        encrypted_data = self.encrypt(data)
        
        # Разбиваем на части
        chunks = [encrypted_data[i:i+32] for i in range(0, len(encrypted_data), 32)]
        
        # Загружаем в различные сервисы
        locations = [
            self.upload_to_pastebin(chunks[0]),
            self.hide_in_image(chunks[1]),
            self.store_in_blockchain(chunks[2])
        ]
        
        return locations
    
    def retrieve_data(self, locations):
        chunks = []
        for location in locations:
            chunk = self.download_from_location(location)
            chunks.append(chunk)
        
        return self.decrypt(b''.join(chunks))

class ThreatModel:
    def analyze_threats(self, scenario):
        threats = {
            'communications': self.check_comms_security(),
            'devices': self.check_device_cleanliness(),
            'physical': self.check_physical_security(),
            'digital': self.check_digital_footprint()
        }
        
        return {k: v for k, v in threats.items() if not v['secure']}
    
    def implement_countermeasures(self, threats):
        for threat in threats:
            if threat['level'] == 'high':
                self.immediate_countermeasures(threat)
            elif threat['level'] == 'medium':
                self.planned_countermeasures(threat)
            else:
                self.monitor_threat(threat)

# Secure wipe по стандарту DoD 5220.22-M
def secure_delete(filepath, passes=3):
    with open(filepath, "ba+") as f:
        length = f.tell()
        for pass_num in range(passes):
            f.seek(0)
            # Pass 1: Write zeros
            f.write(b'\x00' * length)
            f.flush()
            # Pass 2: Write ones  
            f.seek(0)
            f.write(b'\xFF' * length)
            f.flush()
            # Pass 3: Random data
            f.seek(0)
            f.write(os.urandom(length))
            f.flush()
    os.unlink(filepath)
    
    # Дополнительно: перезапись свободного места
    os.system(f"sudo dd if=/dev/zero of={filepath} bs=1M count=10")

import os
from hachoir.metadata import extractMetadata
from hachoir.parser import createParser

class MetadataCleaner:
    def clean_file(self, filepath):
        # Удаление EXIF из изображений
        if filepath.lower().endswith(('.jpg', '.jpeg', '.tiff')):
            os.system(f"exiftool -all= {filepath}")
        
        # Очистка метаданных документов
        elif filepath.lower().endswith(('.pdf', '.docx', '.odt')):
            os.system(f"mat2 {filepath}")
        
        # Очистка для видео/аудио
        else:
            parser = createParser(filepath)
            metadata = extractMetadata(parser)
            self.remove_metadata(metadata)

# OpenWRT с усиленной безопасностью
# Конфигурация фаервола
config zone
    option name 'lan'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'

config rule
    option name 'BlockSuspicious'
    option src 'wan'
    option dest 'lan'
    option proto 'all'
    option target 'DROP'

class ThreatMonitoring:
    def __init__(self):
        self.sensors = [
            NetworkTrafficSensor(),
            PhysicalBreachSensor(),
            CommunicationSensor(),
            DeviceTamperSensor()
        ]
    
    def start_monitoring(self):
        while True:
            for sensor in self.sensors:
                if sensor.detect_anomaly():
                    self.trigger_response(sensor.anomaly_type)
            time.sleep(1)
    
    def trigger_response(self, anomaly_type):
        responses = {
            'network_scan': self.change_ip_address(),
            'physical_breach': self.destroy_sensitive_data(),
            'comm_intercept': self.switch_communication_channel(),
            'device_tamper': self.activate_countermeasures()
        }
        responses.get(anomaly_type, self.default_response)()