4 ms·
We need a CubesOS like system for phones.
by zby 10y ago
We need a CubesOS like system for phones.
- carlesfe 10y agoForgive me if I'm wrong, but isn't that what iOS does, where every app is sandboxed and can't access anything from others? Of course, there may be exploits derived from kernel/"supervisor" bugs, but all apps are sandboxed by default, for better or worse.
- walterbell 10y agoQubes also isolates some devices (e.g. NIC, WiFi, USB) and their drivers/firmware, using the hardware IOMMU to protect against DMA attacks by a compromised device. There is a separate threat from the Intel ME, but the threat from non-Intel devices is reduced.
- pjmlp 10y agoYou can still exploit memory corruption, even if the app is sandboxed.
- nickpsecurity 10y agoOK Labs had one way stronger than QubesOS that's based on L4 kernels with user-mode virtualization of OS's since 2006. Same research group and company that did seL4 kernel. It was acquired by General Dynamics. OKL4 3.0 was open-source, though. So are L4Linux, OCL4, and Genode that could all be modified to recreate the OKL4 platform. Summary of OK Labs: https://en.wikipedia.org/wiki/Open_Kernel_Labs https://en.wikipedia.org/wiki/Open_Kernel_Labs Current company: https://gdmissionsystems.com/cyber/products/trusted-computing-cross-domain/microvisor-products/#4 https://gdmissionsystems.com/cyber/products/trusted-computin... Others include INTEGRITY, LynxSecure, VxWorks MILS, PikeOS... many lightweight kernels have done this. Also had real-time properties in most which helps with rooting out covert, timing channels.