I have found signs of compromise (multiple Heap Overflow, day after day), in the Untrusted Qube. Is there any way to insvestigate how deep the rabbit hole goes, and are other qubes with sensitive communication compromised as well?
Here is a part of the log (the entire log is huge)
A fatal error has been detected by the Java Runtime Environment:
SIGBUS (0x7) at pc=0x0000794acaca9610, pid=2936, tid=20920
JRE version: OpenJDK Runtime Environment Corretto-17.0.13.11.1 (17.0.13+11) (build 17.0.13+11-LTS)
Java VM: OpenJDK 64-Bit Server VM Corretto-17.0.13.11.1 (17.0.13+11-LTS, mixed mode, tiered, compressed oops, compressed class ptrs, serial gc, linux-amd64)
Problematic frame:
C [libcrypto.so.1.1+0x1777b1] OPENSSL_cleanup+0x141
Core dump will be written. Default location: Core dumps may be processed with “/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h” (or dumping to /home/user/Downloads/core.2936)
If you would like to submit a bug report, please visit:
GitHub · Where software is built
The crash happened outside the Java Virtual Machine in native code.
See problematic frame for where to report the bug.
--------------- S U M M A R Y ------------
Command Line: -Djpackage.app-version=6.2.4 -Dcompose.application.resources.dir=/tmp/.mount_simpleklJFNc/usr/lib/app/resources -Dcompose.application.configure.swing.globals=true -Dskiko.library.path=/tmp/.mount_simpleklJFNc/usr/lib/app -Djpackage.app-path=/tmp/.mount_simpleklJFNc/usr/bin/simplex chat.simplex.desktop.MainKt
Host: Intel(R) Core™ i7-10510U CPU @ 1.80GHz, 2 cores, 1G, Fedora release 40 (Forty)
Time: Sat Mar 1 11:01:13 2025 EST elapsed time: 18890.439350 seconds (0d 5h 14m 50s)
--------------- T H R E A D ---------------
Current thread (0x0000794afc379f70): JavaThread “XToolkt-Shutdown-Thread” [_thread_in_native, id=20920, stack(0x0000794acb500000,0x0000794acb600000)]
Stack: [0x0000794acb500000,0x0000794acb600000], sp=0x0000794acb5fdd00, free space=1015k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [libcrypto.so.1.1+0x1777b1] OPENSSL_cleanup+0x141
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.awt.X11.XlibWrapper.InternAtom(JLjava/lang/String;I)J+0 java.desktop@17.0.13
j sun.awt.X11.XAtom.(JLjava/lang/String;Z)V+31 java.desktop@17.0.13
j sun.awt.X11.XAtom.(JLjava/lang/String;)V+4 java.desktop@17.0.13
j sun.awt.X11.XAtom.get(Ljava/lang/String;)Lsun/awt/X11/XAtom;+17 java.desktop@17.0.13
j sun.awt.X11.XSystemTrayPeer.()V+12 java.desktop@17.0.13
v ~StubRoutines::call_stub
j sun.awt.X11.XToolkit.lambda$init$1()V+0 java.desktop@17.0.13
j sun.awt.X11.XToolkit$$Lambda$71+0x00000001001e2138.run()V+4 java.desktop@17.0.13
j java.lang.Thread.run()V+11 java.base@17.0.13
v ~StubRoutines::call_stub
siginfo: si_signo: 7 (SIGBUS), si_code: 2 (BUS_ADRERR), si_addr: 0x0000794acaca9610
Registers:
RAX=0x0000000000000000, RBX=0x0000000000000000, RCX=0x0000000000000000, RDX=0x0000000000000004
RSP=0x0000794acb5fdcf8, RBP=0x0000000000000000, RSI=0x0000794b1c7b6050, RDI=0x0000794b1c000050
R8 =0x0000000794b1c7b6, R9 =0x0000000000000007, R10=0x0000794b1c7b6060, R11=0x62e74e8a2f671523
R12=0x00000000000009a3, R13=0x0000000000000001, R14=0x0000794b23c96680, R15=0x0000794abc2486e0
RIP=0x0000794acaca9610, EFLAGS=0x0000000000010206, CSGSFS=0x002b000000000033, ERR=0x0000000000000014
TRAPNO=0x000000000000000e
Register to memory mapping:
RAX=0x0 is NULL
RBX=0x0 is NULL
RCX=0x0 is NULL
RDX=0x0000000000000004 is an unknown value
RSP=0x0000794acb5fdcf8 is pointing into the stack for thread: 0x0000794afc379f70
RBP=0x0 is NULL
RSI=0x0000794b1c7b6050 points into unknown readable memory: 0x0000000000000060 | 60 00 00 00 00 00 00 00
RDI=0x0000794b1c000050 points into unknown readable memory: 0x0000794b1c7b6050 | 50 60 7b 1c 4b 79 00 00
R8 =0x0000000794b1c7b6 is an unknown value
R9 =0x0000000000000007 is an unknown value
R10=0x0000794b1c7b6060 points into unknown readable memory: 0x0000000794b1c7b6 | b6 c7 b1 94 07 00 00 00
R11=0x62e74e8a2f671523 is an unknown value
R12=0x00000000000009a3 is an unknown value
R13=0x0000000000000001 is an unknown value
R14=0x0000794b23c96680: <offset 0x00000000001e8680> in /lib64/libc.so.6 at 0x0000794b23aae000
R15=0x0000794abc2486e0 points into unknown readable memory: 0x0000794ad04fc010 | 10 c0 4f d0 4a 79 00 00
just to be sure: you know that there is the category Help, I think I've been hacked - Qubes OS Forum? Good luck on your issue!