Can Qubes protect me from targeted attacks?

General Discussion
1

I was an activist a while back and was not careful. I posted in groups using my real email. Accessed and created websites from my home IP. Used my real name to participate in groups, etc.

As a result of all this all my devices have been hacked. My laptop was hacked and even after reinstalling the OS it seemed to still be compromised.

I am considering purchasing a NitroPadX230. It is a laptop which has CoreBoot, Heads and comes with Qubes OS. It also comes with a NitroKey to verify whether there tampering has occured to either the OS or hardware in my abscence.

Is this and good OPSEC enough to protect me against targeted attacks? If not, any suggestions on what to look into?

Thanks in advance!

2

No one can answer this question in the abstract. It depends on too many different factors. For example, what kinds of targeted attacks are they? Spearphishing is a very common one, and Qubes is great at protecting against it. What are the skills and resources of your adversary? There’s a big difference between script kiddies and nation states. Some would argue that nothing and no one is safe from a nation state attacker, and they’d probably be right.

There’s no such thing as perfect security, but security can be better or worse. With Qubes, you stand a better chance against targeted attacks than with a conventional OS, but it depends on how you’re targeted. As to whether there’s something better, that depends on your needs.

3

Thank you for your response. I have reason to believe it is nation-states that are targeting me, though I am not technically savvy enough to determine what kinds of attacks they have used against me and will use in the future.

If, as you say, no one is safe from nation-state attackers, how do high profile people who would are likely to be victims of nation-state attacks, like say for example, the president of a country or the head of the CIA protect themselves?

Would you recommend something other than Qubes?

4

I hope I’m not bringing down the level of discussion to point out that your hypothetical targets are themselves nation-states.

5

If, as you say, no one is safe from nation-state attackers, how do
high profile people who would are likely to be victims of
nation-state attacks, like say for example, the president of a
country or the head of the CIA protect themselves?

They don’t use technology and have special rooms and cars and an army of
armed guards and security specialist that never ever leave them alone.

Would you recommend something other than Qubes?

If your situation is really that dire you should probably not use any
technology at all. If you must use it, you probably want to use
something like Tails with strongly encrypted files that you can carry on
a little SD card or USB stick on your person at all times. Do the towel
over the head thing when typing in passwords. Get a random laptop from a
random store. After that never ever leave it out of sight. Avoid cell
phones like they carry a deadly disease. Trust no one and look and act
as normal as possible.

And ask people who survived stuff like that… contact EFF, Freedom of
the Press Foundation, Wikileaks.

Good luck!

2 Likes
6

Thank you so much for your helpful and informative response!

I am no longer involved in activism (at least not to the extent I was). Which BTW hasn’t made them stop their attacks. Since I am a web developer looking to get into smart contract development it is hard for me to not use any technology, Changing fields is not really an option as there isn’t much I am good at.

I will contact Wikileaks and others and ask for their advice. Thanks for the advice!

7

I find your question very interesting. Stopping someone from spying on me to throw advertising at me is one level of Privacy. Security to discourage others is something else.

I have read that Encryption is usually broken in practice, not in theory. Meaning people can find their best efforts to use encryption is broken because of something they do, or did.

Likewise real Security can be compromised not just because we did not use the best available software/hardware but because of some way they used the software.

One of the humorous examples being that the Drug King, “Dread Pirate Roberts,” had his location identified by a Captcha. He had been very good about not being identified for years. I do not support the idea that the Drug Trade should be able to flourish. Just this is a good example about how someone who knew to be afraid of his being identified, and knew seemed to know the best tools was caught. Perhaps earlier than his being identified Captcha had not been used to find the IP address of users.

I have read websites which talk about how to be secure. Always a moving target. I find myself looking for a page which suggests not just tools, but assuming the the digital opponent is dangerous to us. A list of “Never do this.” or things like “Never do this while – attempting that.”

Tails may seem like a resource to ultimate security. I wonder about the trustworthiness of Tor.

Yes sending emails by “End to End” Encryption seems like the most probable of can’t be broken or stopped.

My example of a person who needs to have perfect security being like an individual in a nation state where just stating an opinion, a real observation of government action, can cause a long jail sentence, and even worse. Being in the US, I think Red China, or Iran.

I read of a posting where someone was speaking conversationally with the trained Network Engineer who managed Servers. Who said, no matter what IP address you request, I can change it to any place I choose. With enough effort and Preparation.

I take that to mean, If I am logging in, while in a country who worries about what I might be up to. They have a lot of warning I am up to something. Such as, I am reading security websites. I am attempting to download software they might have trouble with. Perhaps even substituting their version. More likely, they can just intercept my efforts to send information out of the country which the country does not allow.

My thought being, first of all. If the person is not a computer expert, on nearly the level of a University trained Masters in CS. Trained in not just managing Servers, but has access to the internet the average Activist does not have. Then they are headed for a jail cell, at best.

My, not very knowledgeable opinion is most activists, journalists do not have minds grooved to being high security computer conscious.

What such an activist/journalist needs is a single time download of software, that they use, and not make mistakes in their use of such software. They never spent hours trying to read websites of additional things to download, like Firefox Addons. As that alone marks them to their countries digital security.

Security advice changes fast.

So yeah, your question goes to basic hope of using Qubes.

1 Like