5 ms·

Wow great find! This is uncannily familiar, and recalls for me the early, more trusting days of the web where people just downloaded and ran executables from an

by lebean 3y ago

Wow great find! This is uncannily familiar, and recalls for me the early, more trusting days of the web where people just downloaded and ran executables from anywhere (people don't do that anymore right?)

fsflover 3y ago
> (people don't do that anymore right?) I do (on Qubes OS).
- nullc 3y ago
  Escapes still exist!
  - fsflover 3y ago
    Not from hardware virtualization. Prove me wrong.
    - RustyRussell 3y ago
      I'm sorry, I think you misunderstand the technology. Hardware virtualization covers much of the CPU cases, but there are still three attack surfaces: handling the guest instruction traps on the host side which can actually get quite hairy in corner cases, the devices the guest drives, implemented in software on the host side, and shared hardware information leakage. These are all improving: hardware support is generally getting better and guests modified to behave nicer so weird cases can just fail, and devices are often now specifically designed for virtualization (plug for my old project VirtIO here!). But it's still software, and asserting there are no bugs left seems incautious. The information leakage problems are an ongoing whack-a-mole which depends on your setup: they may or may not result in escapes, depending on the nature of the secrets. Of course, higher level bugs are still there: convincing people or software to change settings, install software or pass too much information through existing channels which are perfectly secure!
      - fsflover 3y ago
        I am aware of the side channel attacks (https://www.qubes-os.org/doc/data-leaks/#types-of-data-leaks https://www.qubes-os.org/doc/data-leaks/#types-of-data-leaks) and of serious vulnerabilities in handling PCI devices. I don't see how it would affect disposable VMs running untrusted code. See also my answer to the sibling. > and asserting there are no bugs left seems incautious I don't exactly assert there are no bugs. I do assert that escalation to the host is very unlikely, since I've never seen one after Blue Pill: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software) > handling the guest instruction traps on the host side which can actually get quite hairy in corner cases Any examples, where a Disposable VM can make some harm to the host?
    - nullc 3y ago
      Google: qubes escape -- they're rarely discovered. But they have existed, more likely currently exist or will exist. Certainly way better than not having that protection, but running sketchy binaries is still not the best idea!
      - fsflover 3y ago
        No need to search on Google to get vague answers, here is the list of known vulnerabilities: https://www.qubes-os.org/security/qsb/ https://www.qubes-os.org/security/qsb/ There were no escapes since Qubes switched to VT-d (release 4.0) in 2018.

by lebean 3y ago

fsflover 3y ago

> (people don't do that anymore right?) I do (on Qubes OS).

nullc 3y ago
Escapes still exist!
- fsflover 3y ago
  Not from hardware virtualization. Prove me wrong.
  - RustyRussell 3y ago
    I'm sorry, I think you misunderstand the technology. Hardware virtualization covers much of the CPU cases, but there are still three attack surfaces: handling the guest instruction traps on the host side which can actually get quite hairy in corner cases, the devices the guest drives, implemented in software on the host side, and shared hardware information leakage. These are all improving: hardware support is generally getting better and guests modified to behave nicer so weird cases can just fail, and devices are often now specifically designed for virtualization (plug for my old project VirtIO here!). But it's still software, and asserting there are no bugs left seems incautious. The information leakage problems are an ongoing whack-a-mole which depends on your setup: they may or may not result in escapes, depending on the nature of the secrets. Of course, higher level bugs are still there: convincing people or software to change settings, install software or pass too much information through existing channels which are perfectly secure!
    - fsflover 3y ago
      I am aware of the side channel attacks (https://www.qubes-os.org/doc/data-leaks/#types-of-data-leaks https://www.qubes-os.org/doc/data-leaks/#types-of-data-leaks) and of serious vulnerabilities in handling PCI devices. I don't see how it would affect disposable VMs running untrusted code. See also my answer to the sibling. > and asserting there are no bugs left seems incautious I don't exactly assert there are no bugs. I do assert that escalation to the host is very unlikely, since I've never seen one after Blue Pill: https://en.wikipedia.org/wiki/Blue_Pill_(software) https://en.wikipedia.org/wiki/Blue_Pill_(software) > handling the guest instruction traps on the host side which can actually get quite hairy in corner cases Any examples, where a Disposable VM can make some harm to the host?
  - nullc 3y ago
    Google: qubes escape -- they're rarely discovered. But they have existed, more likely currently exist or will exist. Certainly way better than not having that protection, but running sketchy binaries is still not the best idea!
    - fsflover 3y ago
      No need to search on Google to get vague answers, here is the list of known vulnerabilities: https://www.qubes-os.org/security/qsb/ https://www.qubes-os.org/security/qsb/ There were no escapes since Qubes switched to VT-d (release 4.0) in 2018.