Erevos Documentation

Getting Started

EREVOS is a specialized intelligence gathering framework designed for operational security professionals, threat researchers, and intelligence analysts requiring access to restricted information sources and deep web reconnaissance capabilities.

OPERATIONAL SECURITY NOTICE

This system is intended for research and educational purposes only. Do not use this system for any illegal activities.

System Requirements

Linux-based OS (Ubuntu 20.04+ or CentOS 8+)
Docker Engine 20.10+ with rootless configuration
Tor daemon with custom exit node configuration
VPN tunnel with kill-switch capability
Hardware security module (HSM) for key management
Minimum 32GB RAM, 1TB encrypted storage

Clearance Verification

Before proceeding, verify your security clearance level meets operational requirements:

CONFIDENTIAL: Basic OSINT and surface web reconnaissance
SECRET: Dark web monitoring and threat intelligence
TOP SECRET: Advanced persistent threat research
SCI/SAP: Nation-state attribution and counter-intelligence

Installation

Secure Bootstrap

# Establish secure channel
export EREVOS_GPG_KEY="0xA1B2C3D4E5F6789A"
curl -fsSL https://secure.erevos.io/install.sh | gpg --verify

# Initialize encrypted workspace
sudo mkdir -p /opt/erevos/{data,logs,keys}
sudo chown -R $(whoami):erevos /opt/erevos
chmod 700 /opt/erevos

# Deploy containerized environment
docker-compose -f docker-compose.prod.yml up -d

# Verify cryptographic integrity
./scripts/verify-deployment.sh

Network Isolation

EREVOS requires network-level isolation for operational security. Configure dedicated VLAN or air-gapped network:

# Configure isolated network interface
sudo ip link add erevos0 type bridge
sudo ip addr add 10.0.99.1/24 dev erevos0
sudo ip link set erevos0 up

# Route traffic through Tor
echo "VirtualAddrNetworkIPv4 10.192.0.0/10" >> /etc/tor/torrc
echo "AutomapHostsOnResolve 1" >> /etc/tor/torrc
echo "TransPort 10.0.99.1:9040" >> /etc/tor/torrc
echo "DNSPort 10.0.99.1:5353" >> /etc/tor/torrc

sudo systemctl restart tor

Hardware Security Module

Initialize HSM for cryptographic operations and key escrow:

# Initialize HSM partition
pkcs11-tool --module /usr/lib/libsofthsm2.so --init-token \
  --slot 0 --label "EREVOS-PROD" --so-pin 123456

# Generate operational keys
pkcs11-tool --module /usr/lib/libsofthsm2.so --login \
  --keypairgen --key-type RSA:4096 --label "erevos-master-key"

# Configure key rotation policy
echo "*/30 * * * * /opt/erevos/scripts/rotate-keys.sh" | crontab -

Configuration

Operational Parameters

Configure EREVOS through encrypted configuration files. All sensitive parameters are stored in HSM-backed key-value store:

# /opt/erevos/config/operational.conf (encrypted)
OPERATION_CODE="NIGHTSHADE"
CLEARANCE_LEVEL="TS-SCI"
GEOFENCE_ENABLED=true
GEOFENCE_REGIONS="US,UK,AU,CA,NZ"  # Five Eyes

# Network configuration
TOR_CONTROL_PORT=9051
TOR_SOCKS_PORT=9050
TOR_CIRCUIT_TIMEOUT=30
TOR_NEW_CIRCUIT_PERIOD=600

# Intelligence sources
DARKWEB_CRAWL_DEPTH=5
OSINT_REFRESH_INTERVAL=3600
THREAT_INTEL_FEEDS="misp,taxii,stix"
IOC_RETENTION_DAYS=90

# Operational security
LOG_RETENTION_HOURS=72
SESSION_TIMEOUT_MINUTES=15
FAIL2BAN_MAX_ATTEMPTS=3
INTRUSION_DETECTION=true

Cryptographic Configuration

CRYPTO POLICY

All communications use AES-256-GCM encryption with ECDHE-P384 key exchange. RSA keys minimum 4096-bit. SHA-3 for integrity verification. Perfect Forward Secrecy mandatory for all external communications.

# Cryptographic policy enforcement
echo "Ciphers aes256-gcm@openssh.com,aes256-ctr" >> /etc/ssh/sshd_config
echo "MACs hmac-sha2-512,hmac-sha2-256" >> /etc/ssh/sshd_config
echo "KexAlgorithms ecdh-sha2-nistp384,ecdh-sha2-nistp256" >> /etc/ssh/sshd_config

# TLS configuration
openssl dhparam -out /opt/erevos/ssl/dhparam.pem 4096
echo "ssl_protocols TLSv1.3;" >> /etc/nginx/nginx.conf
echo "ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;" >> /etc/nginx/nginx.conf

Intelligence Sources

Collection Capabilities

Tier 1: Surface Web

Automated scraping of public forums, news sites, social media platforms, and government databases using rotating proxy networks

Tier 2: Deep Web

Credential-based access to password-protected databases, academic repositories, and subscription-based intelligence services

Tier 3: Dark Web

Tor hidden services, I2P networks, encrypted marketplaces, and underground communication channels

Tier 4: Classified

Restricted access intelligence feeds, government databases, and inter-agency information sharing protocols

Source Validation Matrix

Intelligence reliability is assessed using the NATO standardized evaluation criteria:

A-F Scale (Source Reliability): A=Completely reliable, F=Cannot be judged
1-6 Scale (Information Credibility): 1=Confirmed, 6=Cannot be judged
Corroboration Requirements: Minimum 3 independent sources for actionable intelligence
Temporal Decay: Intelligence confidence decreases by 10% every 72 hours without corroboration

Collection Protocols

# Automated collection scheduling
# Surface web sweep: Every 4 hours
0 */4 * * * /opt/erevos/collectors/surface-sweep.py

# Deep web targeted collection: Daily
0 2 * * * /opt/erevos/collectors/deep-targeted.py

# Dark web monitoring: Continuous with 30min intervals
*/30 * * * * /opt/erevos/collectors/darkweb-monitor.py

# Threat intelligence feed ingestion: Every 15 minutes
*/15 * * * * /opt/erevos/collectors/threat-feeds.py

Security & OPSEC

Operational Security Framework

Identity Compartmentalization

Multi-layered persona management with burner identities, synthetic biometrics, and behavioral pattern obfuscation

Network Obfuscation

Tor over VPN over proxy chains with traffic pattern randomization and timing correlation resistance

Data Compartmentalization

Zero-knowledge encryption with distributed key sharding across multiple HSM-protected enclaves

Attribution Resistance

Automated operational pattern disruption with ML-based behavioral camouflage and digital exhaust sanitization

Threat Model Assessment

# Automated threat assessment
./scripts/threat-model.sh --assessment-level=comprehensive

# Output: Threat vectors identified
[CRITICAL] State-level traffic analysis capability detected
[HIGH] ISP-level deep packet inspection active
[MEDIUM] Geofencing restrictions in current jurisdiction
[LOW] Commercial tracking and fingerprinting

# Recommended countermeasures deployed:
- Multi-hop Tor circuits with guard node pinning
- Traffic padding and timing obfuscation
- DNS over HTTPS with recursive resolver rotation
- Browser fingerprint randomization active

OPERATIONAL SECURITY PROTOCOLS

Compartmentation: Never use personal devices or networks for operations
Attribution: Maintain strict separation between operational and personal digital identities
Communication: All external communications via encrypted, ephemeral channels only
Data Handling: Sensitive intelligence destroyed after 72 hours unless archived under classification protocols
Physical Security: Air-gapped systems for Tier 4 intelligence processing

Counter-Surveillance Measures

EREVOS implements active counter-surveillance to detect and evade monitoring attempts:

# Deploy canary tokens for surveillance detection
echo "Setting up surveillance detection grid..."
for i in {1..50}; do
    ./deploy-canary.sh --type=dns --domain="canary-${i}.erevos.local"
    ./deploy-canary.sh --type=http --endpoint="/api/canary/${i}"
done

# Monitor for compromise indicators
tail -f /var/log/erevos/surveillance.log | grep "CANARY_TRIGGERED"

API Reference

Authentication

All API access requires mutual TLS authentication with client certificates signed by the EREVOS Certificate Authority. Additional HMAC-SHA512 request signing required for write operations.

# Generate client certificate
openssl req -new -newkey rsa:4096 -keyout client.key -out client.csr
curl -X POST https://ca.erevos.local/api/sign \
  --cert operator.crt --key operator.key \
  --data-binary @client.csr > client.crt

# API request with client auth
curl -X POST https://api.erevos.local/v2/intel/query \
  --cert client.crt --key client.key \
  --header "X-EREVOS-Signature: $(generate_hmac_signature)" \
  --data '{"query": "APT29 infrastructure", "classification": "TS"}'

POST /v2/intel/query

Execute intelligence collection query with specified parameters and source tier access

{
  "query": "APT29 C2 infrastructure 2024",
  "classification": "TS-SCI",
  "sources": {
    "surface": true,
    "deep": true,
    "dark": true,
    "classified": false
  },
  "collection_params": {
    "max_depth": 5,
    "timeout_seconds": 300,
    "correlation_threshold": 0.75,
    "geofence": ["RU", "CN", "IR", "KP"]
  },
  "output_format": "stix2.1",
  "retention_hours": 72
}

GET /v2/intel/threats/active

Retrieve active threat intelligence with confidence scoring and source attribution

{
  "threats": [
    {
      "id": "TI-2024-001337",
      "classification": "SECRET//NOFORN",
      "confidence": 0.89,
      "threat_actor": "APT29",
      "campaign": "NOBELIUM-2024",
      "indicators": {
        "domains": ["secure-update[.]org", "ms-teams-update[.]com"],
        "ips": ["185.220.101.42", "194.147.85.16"],
        "hashes": ["a1b2c3d4e5f6789012345678901234567890abcd"]
      },
      "source_reliability": "A",
      "information_credibility": "2",
      "collection_timestamp": "2024-12-15T14:23:17Z",
      "expiry_timestamp": "2024-12-18T14:23:17Z"
    }
  ],
  "total_count": 1,
  "classification_level": "SECRET",
  "caveat_controls": ["NOFORN", "ORCON"]
}

POST /v2/ops/tasking

Submit operational tasking for automated intelligence collection

{
  "operation_code": "NIGHTSHADE",
  "priority": "FLASH",
  "targets": [
    {
      "type": "persona",
      "identifier": "darkweb_vendor_xyz",
      "platforms": ["alphabay", "whitehouse", "archetyp"]
    }
  ],
  "collection_requirements": {
    "communications": true,
    "financial_transactions": true,
    "network_infrastructure": true,
    "associates": true
  },
  "duration_hours": 168,
  "reporting_interval_hours": 24,
  "classification": "TS-SCI//SAP-BLACKBIRD"
}

Troubleshooting

Operational Issues

Circuit Establishment Failures

Tor circuit failures often indicate network-level blocking or compromised exit nodes. Implement circuit diversity and guard node pinning:

# Force new Tor circuit
echo "SIGNAL NEWNYM" | nc 127.0.0.1 9051

# Check circuit status
echo "GETINFO circuit-status" | nc 127.0.0.1 9051

# Verify exit node geolocation
curl --socks5 127.0.0.1:9050 -s https://ipinfo.io/json | jq '.country'

# Blacklist compromised exit nodes
echo "ExcludeExitNodes {ru},{cn},{ir},{kp}" >> /etc/tor/torrc

HSM Communication Errors

Hardware Security Module connectivity issues require immediate attention as they compromise operational security:

# Test HSM connectivity
pkcs11-tool --module /usr/lib/libsofthsm2.so --list-slots

# Verify key availability
pkcs11-tool --module /usr/lib/libsofthsm2.so --list-objects

# Restart HSM service if needed
sudo systemctl restart softhsm2
sudo systemctl status softhsm2

Classification Boundary Violations

Unauthorized access attempts to higher classification tiers trigger automatic lockdown. Recovery requires manual intervention:

# Check security violations log
sudo tail -f /var/log/erevos/security-violations.log

# Reset classification boundary after incident review
sudo /opt/erevos/scripts/reset-classification-boundary.sh \
  --incident-id=INC-2024-001 \
  --clearance-verified \
  --supervisor-approval

# Verify system integrity post-incident
./scripts/integrity-check.sh --full-scan

Counter-Surveillance Alerts

Canary token triggers indicate potential surveillance. Immediate operational security review required:

# Review surveillance alerts
grep "CANARY_TRIGGERED" /var/log/erevos/surveillance.log | tail -20

# Activate emergency protocols
./scripts/emergency-protocols.sh --level=AMBER --reason=surveillance

# Burn current operational identity
./scripts/burn-identity.sh --persona=current --secure-wipe

Emergency Procedures

COMPROMISE RESPONSE

In case of suspected operational compromise, execute emergency protocols immediately:

Isolation: Disconnect from all networks immediately
Evidence Preservation: Create forensic image of system state
Secure Communication: Contact operations center via out-of-band channel
Data Protection: Initiate secure deletion of sensitive materials
Identity Burn: Destroy all operational personas and credentials

Support Channels

Technical support available through classified channels only. Use secure communication protocols for all support requests.

Emergency: Signal +1-703-555-EREV (secure voice)
Technical Issues: ops@erevos.local (PGP required)
Security Incidents: incident@erevos.local (immediate response)
Classification Questions: classification@erevos.local (SSO required)