6 ms·

> the networking can be disabled in the hypervisor The hypervisor is software. Software has bugs. I'm sure the NSA has some hypervisor escape zero-days...

fsflover 3y ago
Qubes relies on hardware-assisted virtualization, which is virtually impossible to break.
- tucnak 3y ago
  >virtually impossible >NSA I have a bridge to sell.
  - fsflover 3y ago
    I'm not aware of any escape since Blue Pill in 2006, found by the Qubes founder herself.
    - tucnak 3y ago
      Which is indicative of... squat. They could introduce an RSA-authenticated backdoor at any time, not unlike the one we had seen in xz, & no researcher would ever find out. In fact, chances are it's already there but even if it's not, Qubes is locking you into Xen platform regardless. The only viable means of gaining security against the NSA is full-source bootstrap from commodity FPGAs. Yes, you'll be stuck at 50 MHz for the time being but at least you know a backdoor-in-synthesis is so much more intractable. The physical surface area to protect is much smaller, too.
      - greggsy 3y ago
        The complexity involved in targeting distributed, temporal backend systems like the ones being discussed here is sufficiently unreliable and risky that it’s easier and cheaper to just go straight for the people, or simply find another avenue.
    - Veserv 3y ago
      Really? I typed “Xen VM Escape” into Google and this is the first hit mentioning at least 4 critical escapes between 2015 and 2017. https://www.csoonline.com/article/561467/xen-hypervisor-faces-third-highly-critical-vm-escape-bug-in-10-months.html https://www.csoonline.com/article/561467/xen-hypervisor-face... You did not even try to confirm if what you said is true.
      - fsflover 3y ago
        Since release 4.0, Qubes is not just Xen. It relies on VT-d, which is hardware-assisted virtualization. The escapes you mentioned were the main reason to do it. More info: https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-030-2017.txt https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qs...
        Veserv 3y ago
        Did you know about this previously? Then why did you lie previously claiming there have been no escapes? If you did not know about this previously, then why should I believe someone who boldly asserted that a system was "virtually impossible to break", despite the fact that your average developer would laugh at the idea such a thing exists, and was then trivially proven to have no idea what they were talking about, but has now backpedaled to a different stance after some hasty research? For that matter, even if I take your statements at face value, why would a design goal have any impact on the security of a system. Those are called goals, you can fail to reach them. You need to present verification and audits that the goals were achieved. Given that you literally can not name a single other piece of software that has achieved the goal of "virtually impossible to break" (except by absence of evidence), you can not just assume such a goal is achieved. Given that we are talking about press organizations that are regularly attacked by state actors, "virtually impossible" in this context means it needs to be proof against state actors. So please present literally anybody who claims that state actors such as the NSA can not breach a Qubes system, then you can present their evidence. I am certain not even Joanna would make such a ridiculous claim and would shoot down anybody on the development team who tried to make such a claim. There is a reason their tagline is "A Reasonably Secure Operating System", not a "Virtually Impossible to Break Operating System". They know it is not proof against state actors and they have the honesty to say that unlike the snake oil peddlers commonly seen in cybersecurity.
- 1oooqooq 3y ago
  "virtually impossible" there's a reason security test of malicious code is done on fully software emulated qemu without kvm anywhere.
  - fsflover 3y ago
    Qubes doesn't rely on kvm. See also: https://news.ycombinator.com/item?id=39951519 https://news.ycombinator.com/item?id=39951519
- 112233 3y ago
  Where can I read how Qubes protects itself from any possible interference from Intel ME, which would be a low bar for a level of security users of Qubes aim for?
  - fsflover 3y ago
    It can't protect from IME. But you can install Qubes on a machine with disabled and neutralized IME, e.g. Librem 15. Also I don't see how it's a low bar. AFAIK there were no known remote exploits of IME.
    - 112233 3y ago
      Well, sorry, I mean, reading comments here and reading advice on QubesOS — they speak about airgapped systems, evil maid attacks, government vans that remotely snoop any computer etc. You don't need QubesOS to protect from known exploits, it was my understanding that people use QubesOS to protect from (real or imagined) state-level adversary.
      - fsflover 3y ago
        You can use Qubes OS for various kinds of threat model. Depending on the latter, your configuration will be wildly different. > You don't need QubesOS to protect from known exploits Qubes would protect you sensitive files from, e.g., XZ attack. Nothing else would AFAIK.
        112233 3y ago
        Currently my "sensitive files" setup is a Pixel 8 with graphene, plugged into dock. A bit clunky (waiting for the desktop mode improvements), but not a bad security compromise.
        fsflover 3y ago
        Only if you trust Google's hardware. I wouldn't.
croes 3y ago
I'm sure NSA has tools to attack air gap computers too.
- tucnak 3y ago
  That's why you want to invest in chassis security, hire ex-EMINT peeps from rival intelligence agencies to work on it. I reckon a startup could do it.
- darkclouds 3y ago
  Someone who worked for the British Military told me back in the early 00's the US military (but could be any part of the US govt) had the ability to bowl up outside a building and "tune" into any of the pc they could detect. It didnt matter what floor of an office block they were on, how far away from a window they were, they had a special suitcase for remote accessing any and all pc's they wanted. Dont know how true it was or is, but I've seen some of these devices now advertised online. I'd provide a link if only Google & Bing would deliver the results, and were also psychologically engaged in warfare on the population.
  - didntcheck 3y ago
    See https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) Though for a second I thought you were going to talk about the mythical TV licensing detector vans :)

fsflover 3y ago

Qubes relies on hardware-assisted virtualization, which is virtually impossible to break.

tucnak 3y ago
>virtually impossible >NSA I have a bridge to sell.
- fsflover 3y ago
  I'm not aware of any escape since Blue Pill in 2006, found by the Qubes founder herself.
  - tucnak 3y ago
    Which is indicative of... squat. They could introduce an RSA-authenticated backdoor at any time, not unlike the one we had seen in xz, & no researcher would ever find out. In fact, chances are it's already there but even if it's not, Qubes is locking you into Xen platform regardless. The only viable means of gaining security against the NSA is full-source bootstrap from commodity FPGAs. Yes, you'll be stuck at 50 MHz for the time being but at least you know a backdoor-in-synthesis is so much more intractable. The physical surface area to protect is much smaller, too.
    - greggsy 3y ago
      The complexity involved in targeting distributed, temporal backend systems like the ones being discussed here is sufficiently unreliable and risky that it’s easier and cheaper to just go straight for the people, or simply find another avenue.
  - Veserv 3y ago
    Really? I typed “Xen VM Escape” into Google and this is the first hit mentioning at least 4 critical escapes between 2015 and 2017. https://www.csoonline.com/article/561467/xen-hypervisor-faces-third-highly-critical-vm-escape-bug-in-10-months.html https://www.csoonline.com/article/561467/xen-hypervisor-face... You did not even try to confirm if what you said is true.
    - fsflover 3y ago
      Since release 4.0, Qubes is not just Xen. It relies on VT-d, which is hardware-assisted virtualization. The escapes you mentioned were the main reason to do it. More info: https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-030-2017.txt https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qs...
      - Veserv 3y ago
        Did you know about this previously? Then why did you lie previously claiming there have been no escapes? If you did not know about this previously, then why should I believe someone who boldly asserted that a system was "virtually impossible to break", despite the fact that your average developer would laugh at the idea such a thing exists, and was then trivially proven to have no idea what they were talking about, but has now backpedaled to a different stance after some hasty research? For that matter, even if I take your statements at face value, why would a design goal have any impact on the security of a system. Those are called goals, you can fail to reach them. You need to present verification and audits that the goals were achieved. Given that you literally can not name a single other piece of software that has achieved the goal of "virtually impossible to break" (except by absence of evidence), you can not just assume such a goal is achieved. Given that we are talking about press organizations that are regularly attacked by state actors, "virtually impossible" in this context means it needs to be proof against state actors. So please present literally anybody who claims that state actors such as the NSA can not breach a Qubes system, then you can present their evidence. I am certain not even Joanna would make such a ridiculous claim and would shoot down anybody on the development team who tried to make such a claim. There is a reason their tagline is "A Reasonably Secure Operating System", not a "Virtually Impossible to Break Operating System". They know it is not proof against state actors and they have the honesty to say that unlike the snake oil peddlers commonly seen in cybersecurity.
1oooqooq 3y ago
"virtually impossible" there's a reason security test of malicious code is done on fully software emulated qemu without kvm anywhere.
- fsflover 3y ago
  Qubes doesn't rely on kvm. See also: https://news.ycombinator.com/item?id=39951519 https://news.ycombinator.com/item?id=39951519
112233 3y ago
Where can I read how Qubes protects itself from any possible interference from Intel ME, which would be a low bar for a level of security users of Qubes aim for?
- fsflover 3y ago
  It can't protect from IME. But you can install Qubes on a machine with disabled and neutralized IME, e.g. Librem 15. Also I don't see how it's a low bar. AFAIK there were no known remote exploits of IME.
  - 112233 3y ago
    Well, sorry, I mean, reading comments here and reading advice on QubesOS — they speak about airgapped systems, evil maid attacks, government vans that remotely snoop any computer etc. You don't need QubesOS to protect from known exploits, it was my understanding that people use QubesOS to protect from (real or imagined) state-level adversary.
    - fsflover 3y ago
      You can use Qubes OS for various kinds of threat model. Depending on the latter, your configuration will be wildly different. > You don't need QubesOS to protect from known exploits Qubes would protect you sensitive files from, e.g., XZ attack. Nothing else would AFAIK.
      - 112233 3y ago
        Currently my "sensitive files" setup is a Pixel 8 with graphene, plugged into dock. A bit clunky (waiting for the desktop mode improvements), but not a bad security compromise.
        fsflover 3y ago
        Only if you trust Google's hardware. I wouldn't.

croes 3y ago

I'm sure NSA has tools to attack air gap computers too.

tucnak 3y ago
That's why you want to invest in chassis security, hire ex-EMINT peeps from rival intelligence agencies to work on it. I reckon a startup could do it.
darkclouds 3y ago
Someone who worked for the British Military told me back in the early 00's the US military (but could be any part of the US govt) had the ability to bowl up outside a building and "tune" into any of the pc they could detect. It didnt matter what floor of an office block they were on, how far away from a window they were, they had a special suitcase for remote accessing any and all pc's they wanted. Dont know how true it was or is, but I've seen some of these devices now advertised online. I'd provide a link if only Google & Bing would deliver the results, and were also psychologically engaged in warfare on the population.
- didntcheck 3y ago
  See https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Van_Eck_phreaking https://en.wikipedia.org/wiki/Tempest_(codename) https://en.wikipedia.org/wiki/Tempest_(codename) Though for a second I thought you were going to talk about the mythical TV licensing detector vans :)