Changing Qubes wallpaper

[b4xqrm7nti]

You know any good site out there? And how do i add them in Qubes? Thank you

[deeplow]

Hi @b4xqrm7nti. Websites to find wallpapers are outside of scope of this forum (there are plenty of answers on that already on the internet).

@b4xqrm7nti

And how do i add them in Qubes?

you should keep in mind that background colors may affect your ability to disabiguate qube’s border colors. I don’t know if this is well studied, but I would encourage using either light or dark wallpapers.

A) Using the default wallpapers (easy and safe)

A lot of amazing qubes artwork already exists in dom0 in the folder (/usr/share/backgrounds/).

Just open the Settings Manager application in dom0 » Desktop

And then set the Folder: to /usr/share/backgrounds/.

B) Downloading from the internet

1. Moving image to dom0

Option a) - safest

The safest way is to open it in full screen from within a qube and then use the dom0 screenshot application to take a pic of the wallpaper. It will be saved on your pictures folder (/home/user/Pictures).

Option b) - discouraged but is “prettier”

You download the files from a qube and then move it to dom0. It’s not technically easy but you can consult it here. The security downside is that you are copying an untrusted image from the internet onto the most trusted component of Qubes (dom0)…

2. Setting background

See path A) but set the Folder to wherever in dom0 you downloaded it.

[b4xqrm7nti]

Thanks. Yeah, but it’s a picture… Are there many exploits today in pictures or what? I’m not that paranoid, but it’s good to know. Thanks for your reply! I need some more wallpapers in this cool OS.
I found this now randomly… Some people in here might like cubes.

273 Cube HD Wallpapers | Background Images

[fsflover]

Do i install in dom0 or in templates?

To add more desktop wallpapers search the web for picture in same the resolution as your screen, right click the picture > view image, press alt+f11 press print screen (keyboard button) save picture right click desktop > open terminal here enter ‘sudo mv ~/Pictures/* /usr/share/backgrounds/’ done To select desktop wallpaper right click on desktop > desktop settings your picture should be there

[JTeller3]

Yes, there are:

Picture perfect: How JPG EXIF data hides malware

Hiding Code Inside Images: How Malware Uses Steganography

https://www.pcworld.com/article/2105408/watch-out-for-photos-containing-malware.html

https://www.opswat.com/blog/image-borne-malware-how-viewing-image-can-infect-device

https://www.bleepingcomputer.com/news/security/hackers-hide-credit-card-data-from-compromised-stores-in-jpg-file/

How This One ‘Malicious’ Photo Could Hack Your Instagram Account

There are many more I can post, and this is just from the top results of searches such as “hiding malware in jpegs” and “malicious image attack”, but the point is that this is old hat for even moderately sophisticated everyday attackers, the sort that go after your Instagram account or credit card information—not truly sophisticated APTs with nearly unlimited budgets. When considered in the context of NSA capabilities, which includes exploiting network race conditions in-transit and injecting malware into packets after they leave the server but before they arrive to you or by intercepting the request altogether¹, image-based exploits that take over dom0 through a wallpaper you downloaded off the Internet is entirely within the realm of possibility.

If your threat model includes such expensive and targeted attacks from nation-state adversaries, even if only because your use of Qubes OS already sets you up as potential “collateral damage” of any nation-state attack on Qubes users generally, then not even your wallpaper is safe.

Remember: images and even text are not just images and text, but code that must be rendered by your computer and so can be exploited during that process. Simply loading an image or running unsafe text containing malicious code, even without further user interaction, can be sufficient to trigger an exploit chain that infects your computer. While they are rare and sophisticated, they can and do occur.

Regards,
John

---

¹ One example is QUANTUM, which was used in conjunction with FOXACID to successfully attack Tor users. From Schneier’s blog:

Expand to see full quote

@Bruce Schneier

The Quantum system

To trick targets into visiting a FoxAcid server, the NSA relies on its secret partnerships with US telecoms companies. As part of the Turmoil system, the NSA places secret servers, codenamed Quantum, at key places on the Internet backbone. This placement ensures that they can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target’s browser to visit a Foxacid server.

In the academic literature, these are called “man-in-the-middle” attacks, and have been known to the commercial and academic security communities. More specifically, they are examples of “man-on-the-side” attacks.

They are hard for any organization other than the NSA to reliably execute, because they require the attacker to have a privileged position on the Internet backbone, and exploit a “race condition” between the NSA server and the legitimate website. This top-secret NSA diagram, made public last month, shows a Quantum server impersonating Google in this type of attack.

The NSA uses these fast Quantum servers to execute a packet injection attack, which surreptitiously redirects the target to the FoxAcid server. An article in the German magazine Spiegel, based on additional top secret Snowden documents, mentions an NSA developed attack technology with the name of QuantumInsert that performs redirection attacks. Another top-secret Tor presentation provided by Snowden mentions QuantumCookie to force cookies onto target browsers, and another Quantum program to “degrade/deny/disrupt Tor access”.

This same technique is used by the Chinese government to block its citizens from reading censored Internet content, and has been hypothesized as a probable NSA attack technique.

[deeplow]

Highly related:

@quququbebebe

[deeplow]

Just found out about dom0 terminal command qvm-get-image. Apparently it converts an image to trusted.

[enmus]

This link doesn’t work for me

[adw]

@deeplow

Option b) - discouraged but is “prettier”

Out of curiosity, would would it be “prettier”? If the image is fullscreen and not resized or compressed when the screenshot is taken, it should be pixel perfect.

[Riverbend]

If you can get it in those conditions, it does work perfect. However, wallpapers in a non-standard size will have a scrollbar on one or both of the edges in the screenshot, and since you’re working in dom0 I don’t think there’s a way to crop them out.

[deeplow]

@adw

Out of curiosity, would would it be “prettier”? If the image is fullscreen and not resized or compressed when the screenshot is taken, it should be pixel perfect.

No idea why my 2-years-ago self thought that