This made me think. What safeguards Qubes has? Example of the the attack scenario: A regular tor exit nodes turns malicious. Either by being hacked or by threat actor deliberately introducing it into the system. Then it looks for requests towards Debian/Fedora/Qubes specific repositories. Once such requests happens it serves the victim’s machine to use fake copy of repositories with maliciously modified binaries. After the upgrade is finished there is no easy way to know whether or not the upgrade was malicious. Depending on what was upgraded the infection might be limited to certain templates or to dom0
I can see at least 2 scenarios in which such attack can be useful. Qubes users are notoriously paranoid compared to regular linux users. And the OS requires way more ram compared to average linux distro. It’s safe to assume any Qubes user is either somewhat richer then average person or has a lot to hide. Financial incentive is quite strong. The second scenario is intelligence agencies trying to find one particular person. Snowden recommends Qubes as a daily driver. If he configured his system to use sys-whonix as update proxy it’s reasonable to assume the agencies could try to perform such attack. With a lot of people getting hacked as a side effect. In fact any state actor might be interested in performing such attack if one valuable target is daily driving Qubes
This is simply not possible, at least without access to the pgp/gpg repository signing keys. And if your opponent has those keys, why bother intercepting your traffic? they can just put the malicious binaries in the repo.
All in all… NO.
One extra thing: repo metadata/packages are checked locally, not just “trusted because HTTPS”. For dom0 that means rpm signatures; for Debian/Fedora templates it is the apt/dnf repo signing chain. A Tor exit can break or stale-cache traffic, but swapping in a malicious package should fail unless the signing keys or client config are also compromised. If this was only an accidental update-proxy setting, I’d change it back for reliability/leak expectations and run normal updates, not assume the template is compromised from that alone.
The normal safeguards protecting updates secure against this. The most
an adversary could do would be to serve an outdated repository with
signed but flawed software. But this can happen in any case with the
system of repository mirrors.
[quote]
Qubes users are notoriously paranoid compared to regular linux users. And the OS requires way more ram compared to average linux distro. It’s safe to assume any Qubes user is either somewhat richer then average person or has a lot to hide.
[/quote]?
This is simply bizarre - “safe to assume”?
verum nanquam sequitur ex falsis
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
In simple words, it’s not dangerous to use tor for updates.
Using tor for updates increases security because theoretically, qubes devs could target specific users by signing a malicious package which is delivered only to that user, not all users.
But when you use tor, it’s very difficult for such an attack, because all connections for updates is just “tor” in simple words.
I’m not saying qubes devs would do such an attack, just saying it’s theoretically possible.
And it’s actually very unlikely qubes devs would do such an attack because if they would want to have that option, they wouldn’t have created the tor update proxy feature.
