Malware escaping an AppVM sandbox: Risk vectors for dom0 from a compromised qube?

[Emily]

If a nation state actor compromises a qube via the network, how might they use that compromise to get access to dom0 and/or other qubes?

[oijawyuh]

This might (or might not) be a (partial) answer:

Edge of windows disappears every few months (XFCE)

Thank you @deeplow @adw @Plexus and @unman for your responses. If I am the only one known to have faced such a recurrent problem (while using a standard recent Lenovo Thinkpad), I admit that this is worrying. Also, I didn’t move to Qubes OS without a reason. Should an attacker be exploiting a zero-day in Qubes, I think he would have been able to steal from the vault gpg key, keepass database, as well as log-in credentials in the internet-connected VMs, while at the same time rendering my OS unus…

In this case, what hypothetically happens is that the nation state actor is unable to remotely hack Dom0, but inserts code through a compromised VM which crashes Dom0 and the whole the system. Then, this actor posts instructions on stack exchange or somewhere else for “fixing” the system in dracut, which modifies Dom0 (using search engine keywords that the victim would look for).

You can see that after “attempting to fix” using instructions found “somewhere” online before this forum was created, dom0:dm_43 - qubes_dom0-pool00_meta0 appears. I don’t know what that means and I’ve not seen it since. This could just be one scenario, or maybe just the paranoia of a Qubes user

[i2p]

Why would someone try to take your computer down when they can get your credit cards, bank account, property etc…

I get temporary hacks in VM’s 2-3 times daily and Dom 0 pawn once a month. Take care of fundamentals like accurate time, RNG etc… and you will be hacked A LOT LESS… See how a GPS can provide both (accurate time, and RNG)

[bored]

If they got in through the network then, depending on the exploit they might have access to each networked VM.

For non-networked Qubes VMs or Dom0 Xen/Qubes exploits, CPU + RAM related attacks. Or indirectly maybe through updates.

[Emily]

How would an update attack be executed?

[Emily]

Nation states don’t like former slaves who escaped the plantation, and help others escape.

[bored]

You get malicious packages or outdated packages.
Vulnerabilities in the package management software.

[Emily]

If I’m updating thru the Qubes update module, who/what would have to be compromised for an update attack? Could it be possible that a single IP was targeted for that update attack, while not compromising the Qubes’ user-base?

[renehoj]

@Emily

Could it be possible that a single IP was targeted for that update attack, while not compromising the Qubes’ user-base?

I don’t know if that is possible, but you can use Tor if you are worried about this happening.

[Emily]

@renehoj

I don’t know if that is possible, but you can use Tor if you are worried about this happening.

The IP would be the exit node of tor. If bad actor knew the update was coming thru that IP, would a man in the middle attack be possible thru the Qubes update module?

[unman]

The IP would be the exit node of tor. If bad actor knew the update was coming thru that IP, would a man in the middle attack be possible thru the Qubes update module?

This would not target a single user, naturally.
In most cases, TLS will prevent MITM, and most repo definitions use
https.

Update attacks can take place through compromised packages, even when
they are signed and delivered via TLS.
The signature validations attest only that the packages you install are
those that were signed on the repository, and there are attacks on the
validation process. In any case the signatures say nothing about the
qualities of the package.

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.

[Emily]

@unman

The signature validations attest only that the packages you install are
those that were signed on the repository, and there are attacks on the
validation process. In any case the signatures say nothing about the
qualities of the package.

Historically have we seen this attack on Qubes? And if so, how long before it was discovered? And how was it discovered?

What would be the “canary in the coalmine” that would signal a compromised machine as early as possible?