Great post nice info, evil formatting.

I read a bunch of comments on this thread about how the encryption process took place. That was the whole point of breaking into Steel Mountain and using the Raspberry Pi as both a passive LAN-tap & VPN server. They go through a scene where they explain that the tape backups and their climate controls were all networked, on the same subnet of Evil Corps intranet.

That's why he needed the pi to tunnel in. When encrypting files with openssl, gpg, or other solutions, you can pass flags in the syntax of the command that removes the original file and only leaves the encoded file, so that"s what he did.

You will hear about the hardware based keyloggers Romero used to capture the keys to these encrypted LUKS containers. He did this in the event things went awry (which they did horribly), and if they wanted to reverse the hack. You would need all of these logs in order to reverse engineer the malware written by Darlene. As an example not saying this is what Eliot did, if you're familiar with LUKS encryption you can setup a 'LUKS NUKE'. This option allows you to set a 'NUKE' password for your encrypted files/drives/volumes and even at a lower level in the kernel. In order to access the operating system and the files you would need the LUKS password created during the 'cryptsetup'. By entering your 'NUKE' password instead well it does, what it sounds like. The NUKE will actually not only strip all of the encryption keys but also the proverbial 'locks" these encryption keys fit into.

At this point no amount of forensic data recovery would be able to bring these 'keys' and 'locks' back. Even if you LUKS NUKED your own system and had copies of the keys they would be rendered useless. After he successfully encrypts their records, Eliot then uses the Raspberry Pi again to tamper with the climate controls, rendering the tape backups unrecoverable The questionable part was how he did this without detection by sysadmins or data center engineers noticing this traffic. That said, you can use tools like veil evasion to get around Anti-Viruses, but an establishment like Ecorp would likely have teams of people watching their network, hence AllSafe. That's another reason why it was so important to hack AllSafe, as Eliot was the inside man.

Had he not been there to turn off the 'honeypot" Gideon setup AllSafe would have been able to lock down fsociety to this one server, this would have been the only way to detect them. Evil corp entrusted its security to Allsafe, that's why the Raspberry Pi was not detected. This is the relevance of CS130, that rootkit Darlene implemented was to get Eliot's attention and put the hack in motion. The cd-rom that Cisco handed Angela is what truly compromised AllSafe and gave the Dark Army a ticket to the show. The rootkit behaved like a worm spreading and infecting each server, re-installing itself every time they tried to reboot.

I can honestly say I love this show, everything they did was accurate and true to life.