2 ms·

macOS and ios are heavily compartmentalized - but attackers are still able to get through. Extreme compartmentalization through virtualisation is also insuffic

by olliej 5y ago

macOS and ios are heavily compartmentalized - but attackers are still able to get through. Extreme compartmentalization through virtualisation is also insufficient, as it just becomes a matter of “is there a bug in the hyper visor”, to which the answer is yes: every major VM system has had multiple escapes, as another commenter pointed out even your example of qubes os has had them. I know how hard security is. I know how hard writing bug free code is. Brushing that aside and saying “just do X and bugs don’t matter”, assumes that somehow the people implementing support for X are immune to the same problems faced by other developers.

fsflover 5y ago
> macOS and ios are heavily compartmentalized iOS isn't. The vulnerability in iMessage led to the whole system compromize. > every major VM system has had multiple escapes Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).
- olliej 5y ago
  We’re working on a security definition which means “control of system”. That means escaping the compartment: for iMessage that means escaping the sandbox. The most recent one on the PZ blog is a multiparty series and I don’t believe they’ve described how NSO gets from code execution to actually escaping the sandbox. If being able to escape the sandboxing means “not compartmentalized” then if anyone escapes the VM in qubes then qubes is also not compartmentalized. The difference is how extreme the compartmentalization is. macOS and iOS use sandboxing which is much lighter weight than a full VM, but is not as strong a boundary as a full VM. However saying that they’re not a form of compartmentalization is plainly false. Every other virtualisation system also uses hardware virtualisation. They’ve been popped. I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware.
  - fsflover 5y ago
    > They’ve been popped. I would be grateful if you could provide some links. > I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware. Qubes relies on Xen. The latter definitely had a lot of offensive interest. I am not aware of any recent escapes of hardware virtualization though.

by olliej 5y ago

fsflover 5y ago

> macOS and ios are heavily compartmentalized iOS isn't. The vulnerability in iMessage led to the whole system compromize. > every major VM system has had multiple escapes Qubes uses hardware (VT-d) virtualization, which AFAIK was last time broken by the Qubes founder in 2003: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software).

olliej 5y ago
We’re working on a security definition which means “control of system”. That means escaping the compartment: for iMessage that means escaping the sandbox. The most recent one on the PZ blog is a multiparty series and I don’t believe they’ve described how NSO gets from code execution to actually escaping the sandbox. If being able to escape the sandboxing means “not compartmentalized” then if anyone escapes the VM in qubes then qubes is also not compartmentalized. The difference is how extreme the compartmentalization is. macOS and iOS use sandboxing which is much lighter weight than a full VM, but is not as strong a boundary as a full VM. However saying that they’re not a form of compartmentalization is plainly false. Every other virtualisation system also uses hardware virtualisation. They’ve been popped. I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware.
- fsflover 5y ago
  > They’ve been popped. I would be grateful if you could provide some links. > I don’t think it’s unreasonable to suspect that qubes has not had the same degree of offensive interest as, say, VMware. Qubes relies on Xen. The latter definitely had a lot of offensive interest. I am not aware of any recent escapes of hardware virtualization though.