If an adversary were to attack Firefox, which vm would he land in?

General Discussion
1

If an adversary were to attack Firefox, which vm would he land in ? It is firewall vm or the app vm ?

1 Like
2

The VM in which firefox runs in

7 Likes
3

Depends on the attack. But the attack would hit FF. If it’s an execution attack, you can have it set to run in a basic disposable that domain-0 logs them and their activity, while the disposable is pretending to be a weird little pc running things. (a good honeypot) , or if it’s a screen based watching attack, then they might see what you are doing. If it’s a file access directly through the FF reading of files function, then it would just read and all would be seen.

So ti all really depends how you set things up… you could make everything unseen by FF unless you give the process access to read the file. Or set it to only allow reads always on certain files then on other files set for requesting permissions to read them…

That is also possible… And it could redirect the attack to another dpisposable even.

So the choice is up to you where you decide to have them end up when the attack you and even hit your FF.

4

To quote you: depends how you setup Firefox.
Let me tell you that most of us, have a setup FF like is out of the box !

Can i ask you to describe how to setup for “limited” reading files,reading permissions or directing to other VMApps as you quoted above,please ?

My understanding of FF is that a browser has certain access to areas in the dom0 (part of the qube) and in the qube it runs. Im not running FF always in disposable VMapps as that will make my memory go short and hair growing white faster… :slight_smile:

Thanks,appreciated.

5

Custom applications.
Back when I used Mozilla Spyware I had my own application that watched specific applications and processes. When they tried to do things, it limited it if I had the configuration set to do so.

When it tried to read something or write to the drive, even execute local programs, then it would pop up a dialogue when set to do so.

So it essentially watched processes and files as a basic process.

I also wrote my own SUDO application and SU for use in Qubes on guests I define as not trustworthy, that way any attempted execution of it would tell me what was going on BEFORE they took place incase of any infiltration.