Disposible Qubes DoS Incident

User Support Help, I think I've been hacked
1

I was about to open a thread regarding a DoS incident within a disposable qube. I’m confident that the DoS is the result of targeted, sophisticated actions.

However, I have no logs or journal entries, and most likely nothing to provide for team review.

Could anyone suggest a basic to-do list before closing a disposable qube in a suspicious situation. how to capture essential indicators and logs so they’re preserved for future investigation?

As for the incident itself:

I had a Microsoft Teams meeting scheduled with an officer from a federal law enforcement agency. Before the meeting, I verified that everything was working properly. microphone, camera, and audio input/output, with no lag or glitches.

The moment the invited officer joined the meeting, the sound in the qube dedicated to Teams conversations stopped functioning entirely.

2

I would first qvm-pause <the-disposable> and disconnect from the Internet.

Then consider dumping the whole disposable (ideally with its RAM too) to an image file and providing that whole file for investigation by an expert. Unfortunately, I don’t know how to do this, so hopefully someone can tell us.

3

Answer by AI module.

Step-by-step (all in dom0, as root where noted)

1. Freeze and cut connectivity.

qvm-pause <dispvm>

Since the qube is paused and can’t react anyway, the safest way to cut the network is to deal with the parents, not the paused child — e.g. pause or stop sys-firewall (and optionally sys-net), or drop the netvm property if the tooling allows it on a paused qube.

2. Dump the RAM.

Xen’s xl tool (available in dom0) writes guest RAM to an ELF core file:

xl list # note the domid/name of the disposable
xl dump-core <domid-or-name> /home/user/disp-incident.core

Check first that dom0 has enough free space (df -h /home/user) — the file is roughly the qube’s allocated memory in size. This writes to dom0 storage, which is why it should be treated as a last-resort forensic move, not routine cleanup.

3. Dump the disk volumes.

Each qube’s volumes are logical volumes named like vm-<name>-root and vm-<name>-private. Locate and copy them read-only:

sudo lvs | grep <name> # find the volume paths
sudo dd if=/dev/<vg>/vm-<name>-root of=/home/user/disp-root.img bs=4M status=progress
sudo dd if=/dev/<vg>/vm-<name>-private of=/home/user/disp-private.img bs=4M status=progress

Copying (rather than moving) leaves the original evidence intact — important for a disposable, since its volumes are destroyed the moment the qube shuts down or is removed.

4. Transfer for analysis.

Copy the files out of dom0 to an analysis machine (via qvm-copy into a dedicated air-gapped vault qube and then external media, or via encrypted removable storage).

End of AI content

Anyone can double check AI suggestion?

4

I don’t like usage of /home/user within dom0 as storage. but another part have sense.

5

Another thread about same question.