5 ms·

While I am all for virtualizing, it doesn't help security. It just moves the exploit from your OS into your hypervisor. Even worse, you add a whole new level of

While I am all for virtualizing, it doesn't help security. It just moves the exploit from your OS into your hypervisor. Even worse, you add a whole new level of exploitable code.

spindritf 12y ago
Of course it improves security. On Qubes, someone who can exploit your browser (pdf reader, word processor) doesn't automatically get free rein on your machine. They still need to escape Xen.
- csirac2 12y ago
  Not just apps, it even routes physical USB devices to specific VMs, which potentially mitigates BadUSB type attacks against the dom0. And I really appreciate that they've tried to solve XDMCP weaknesses.
- mrottenkolber 12y ago
  Nope. If somebody exploits your PDF reader, they still have to circumvent the OS. Sound familiar? Now instead of one layer with hardware contact, you have two (assuming you want performance too). Twice the attack surface.
  - amalcon 12y ago
    This would be sound logic if existing desktop operating systems had actual good security models. In the real world, if someone exploits your PDF reader, they don't have to circumvent your OS: your OS hands over everything you can access, by design. One could argue that a better security model baked into the OS would make more sense than a virtualization hack, but the latter has the advantage of actually existing.
    - Touche 12y ago
      What would be the better security model?
      - SamReidHughes 12y ago
        Somebody exploiting your PDF reader can't upload all your email.
        Touche 12y ago
        That's not a model. What's the model that prevents this? User performs a 2-step auth every time code executes?
        SamReidHughes 12y ago
        Just pick one that gives the feature I described without being a pain to the user.
        Touche 12y ago
        I know of no such models. Perhaps someone smarter than me has thought of them, that's why I asked the question initially.
        SamReidHughes 12y ago
        Sandboxing. It's present on OS X.
        Touche 12y ago
        I'm confused. The original person I responded to said that no desktop OSes had good security models. On OSX I can write a script that, when run as a user, has access to everything the user has access to. So what exactly are you talking about?
        deleted 12y ago
  - wyager 12y ago
    > If somebody exploits your PDF reader, they still have to circumvent the OS. That is correct. This is probably why privesc exploits are much more expensive than adobe reader exploits. You are kind of arguing against yourself here.
  - walterbell 12y ago
    > Now instead of one layer with hardware contact, you have two (assuming you want performance too). Could you expand on that statement? By definition, only one layer can own each hardware component.
na85 12y ago
I take it you've not heard of the phrase "defensive depth".
- geraldcombs 12y ago
  Shouldn't that be "defense in depth"?
  - anth1y 12y ago
    for those unaware: http://en.wikipedia.org/wiki/Defense_in_depth_%28computing%29 http://en.wikipedia.org/wiki/Defense_in_depth_%28computing%2...
- mrottenkolber 12y ago
  The difference here is, you might feel safer but you are still in the exact same position as before, a bug in your hypervisor/Meta-OS screws you. I'd argue that is a harmful comfort.
  - Elhana 12y ago
    The idea is that hypervisor is significantly smaller than the OS/kernel, so there will be less bugs. Not that they never happen, Xen had one recently.
vidarh 12y ago
That's nonsense. It doesn't automatically help security. But compartmentalization does mean that barring a hypervisor exploit, each exploit can potentially be prevented from affecting more than a small part of the system. I care a whole lot less if Chrome is exploited if it can't access my ssh keys, for example (not that I wouldn't still care, but the potential damage would be limited).
- mrottenkolber 12y ago
  Why don't you just use different user accounts and permissions? That way you don't have to trust extra code and can achieve the same goal. Edit: But the way you talk to me, obviously I must be stupid.
  - csirac2 12y ago
    I'd say the reasoning is that you then have to trust there are no privesc/bypass opportunities in your environment. Trusting that all your dbus/pulseaudio/network-manager/cups/fuse/display manager & friends aren't going to give your rogue chrome process on one account some kind of access to another (thanks to X11/XDMCP, they'll at least have keylogging) - that's a big surface area, aas in: space is big. Really big. You just won't believe how vastly, hugely, mind-bogglingly big it is. Compared to the few hundred lines in the hypervisor providing VM-level isolation you'd be a bit mad to say that these are equivalent means of isolation.
timmclean 12y ago
This document[1] talks about that risk and what they've done to mitigate it at the bottom of page 10. [1] http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co...

While I am all for virtualizing, it doesn't help security. It just moves the exploit from your OS into your hypervisor. Even worse, you add a whole new level of exploitable code.

spindritf 12y ago

Of course it improves security. On Qubes, someone who can exploit your browser (pdf reader, word processor) doesn't automatically get free rein on your machine. They still need to escape Xen.

csirac2 12y ago
Not just apps, it even routes physical USB devices to specific VMs, which potentially mitigates BadUSB type attacks against the dom0. And I really appreciate that they've tried to solve XDMCP weaknesses.
mrottenkolber 12y ago
Nope. If somebody exploits your PDF reader, they still have to circumvent the OS. Sound familiar? Now instead of one layer with hardware contact, you have two (assuming you want performance too). Twice the attack surface.
- amalcon 12y ago
  This would be sound logic if existing desktop operating systems had actual good security models. In the real world, if someone exploits your PDF reader, they don't have to circumvent your OS: your OS hands over everything you can access, by design. One could argue that a better security model baked into the OS would make more sense than a virtualization hack, but the latter has the advantage of actually existing.
  - Touche 12y ago
    What would be the better security model?
    - SamReidHughes 12y ago
      Somebody exploiting your PDF reader can't upload all your email.
      - Touche 12y ago
        That's not a model. What's the model that prevents this? User performs a 2-step auth every time code executes?
        SamReidHughes 12y ago
        Just pick one that gives the feature I described without being a pain to the user.
        Touche 12y ago
        I know of no such models. Perhaps someone smarter than me has thought of them, that's why I asked the question initially.
        SamReidHughes 12y ago
        Sandboxing. It's present on OS X.
        Touche 12y ago
        I'm confused. The original person I responded to said that no desktop OSes had good security models. On OSX I can write a script that, when run as a user, has access to everything the user has access to. So what exactly are you talking about?
        deleted 12y ago
- wyager 12y ago
  > If somebody exploits your PDF reader, they still have to circumvent the OS. That is correct. This is probably why privesc exploits are much more expensive than adobe reader exploits. You are kind of arguing against yourself here.
- walterbell 12y ago
  > Now instead of one layer with hardware contact, you have two (assuming you want performance too). Could you expand on that statement? By definition, only one layer can own each hardware component.

na85 12y ago

I take it you've not heard of the phrase "defensive depth".

geraldcombs 12y ago
Shouldn't that be "defense in depth"?
- anth1y 12y ago
  for those unaware: http://en.wikipedia.org/wiki/Defense_in_depth_%28computing%29 http://en.wikipedia.org/wiki/Defense_in_depth_%28computing%2...
mrottenkolber 12y ago
The difference here is, you might feel safer but you are still in the exact same position as before, a bug in your hypervisor/Meta-OS screws you. I'd argue that is a harmful comfort.
- Elhana 12y ago
  The idea is that hypervisor is significantly smaller than the OS/kernel, so there will be less bugs. Not that they never happen, Xen had one recently.

vidarh 12y ago

That's nonsense. It doesn't automatically help security. But compartmentalization does mean that barring a hypervisor exploit, each exploit can potentially be prevented from affecting more than a small part of the system. I care a whole lot less if Chrome is exploited if it can't access my ssh keys, for example (not that I wouldn't still care, but the potential damage would be limited).

mrottenkolber 12y ago
Why don't you just use different user accounts and permissions? That way you don't have to trust extra code and can achieve the same goal. Edit: But the way you talk to me, obviously I must be stupid.
- csirac2 12y ago
  I'd say the reasoning is that you then have to trust there are no privesc/bypass opportunities in your environment. Trusting that all your dbus/pulseaudio/network-manager/cups/fuse/display manager & friends aren't going to give your rogue chrome process on one account some kind of access to another (thanks to X11/XDMCP, they'll at least have keylogging) - that's a big surface area, aas in: space is big. Really big. You just won't believe how vastly, hugely, mind-bogglingly big it is. Compared to the few hundred lines in the hypervisor providing VM-level isolation you'd be a bit mad to say that these are equivalent means of isolation.

timmclean 12y ago

This document[1] talks about that risk and what they've done to mitigate it at the bottom of page 10. [1] http://www.invisiblethingslab.com/resources/2014/Software_compartmentalization_vs_physical_separation.pdf http://www.invisiblethingslab.com/resources/2014/Software_co...