Disposible Qubes DoS Incident

Answer by AI module.

Step-by-step (all in dom0, as root where noted)

1. Freeze and cut connectivity.

qvm-pause <dispvm>

Since the qube is paused and can’t react anyway, the safest way to cut the network is to deal with the parents, not the paused child — e.g. pause or stop sys-firewall (and optionally sys-net), or drop the netvm property if the tooling allows it on a paused qube.

2. Dump the RAM.

Xen’s xl tool (available in dom0) writes guest RAM to an ELF core file:

xl list # note the domid/name of the disposable
xl dump-core <domid-or-name> /home/user/disp-incident.core

Check first that dom0 has enough free space (df -h /home/user) — the file is roughly the qube’s allocated memory in size. This writes to dom0 storage, which is why it should be treated as a last-resort forensic move, not routine cleanup.

3. Dump the disk volumes.

Each qube’s volumes are logical volumes named like vm-<name>-root and vm-<name>-private. Locate and copy them read-only:

sudo lvs | grep <name> # find the volume paths
sudo dd if=/dev/<vg>/vm-<name>-root of=/home/user/disp-root.img bs=4M status=progress
sudo dd if=/dev/<vg>/vm-<name>-private of=/home/user/disp-private.img bs=4M status=progress

Copying (rather than moving) leaves the original evidence intact — important for a disposable, since its volumes are destroyed the moment the qube shuts down or is removed.

4. Transfer for analysis.

Copy the files out of dom0 to an analysis machine (via qvm-copy into a dedicated air-gapped vault qube and then external media, or via encrypted removable storage).

End of AI content

Anyone can double check AI suggestion?