Qubes Dom0 Folders That Leave Forensic Footprints?

Emily · December 16, 2021, 10:09am

I’m looking to bind all the folders that leave forensic footprints to redirect to a Veracrypt container.

What folders should I bind?

adw · December 16, 2021, 9:38pm

Perhaps I’m missing something, but this sounds like one of those things that no one should want to do, since the entire Qubes OS installation is already LUKS-encrypted.

Emily · December 16, 2021, 9:49pm

…and if you’re compelled to decrypt by state sponsored criminals in costumes… better not rely on that level of defense in a world gone full dystopian tyranical.

Qubes could have pd built right in…but state sponsored criminals would know that. If you hack a solution together using 3rd party tools, your chances of avoiding detection are much better in my opinion.

fsflover · December 16, 2021, 10:51pm

Have a look at these articles for a threat model: VeraCrypt - Free Open source disk encryption with strong security for the Paranoid and https://veracrypt.eu/en/docs/hidden-operating-system/.

enmus · December 17, 2021, 9:07pm

If you are doing things that would make you target of adversaries for sure, they either will:

Wait to steal your laptop/PC from you while working in your hidden OS/volume (and they will study you thoroughly before they act), or
They will torture you so you would confess even whatnots.

No one will let you go if you answer - no I don’t have any hidden whatnot, if you come to a situation to be asked that…

Everything else is overkill beside what Qubes already offers.

arkenoi · December 17, 2021, 9:37pm

I would say it could make sense to make a deniable encryption a default enabled option.
Like, Qubes OS always “reserves” some allocated data pool for deniable encryption. If you do not use it, there are just some random data. If you create a key, you can use it for VMs.

Also, our log management is a mess

fsflover · December 17, 2021, 10:27pm

This is not the threat model under consideration. The threat model is more like random checks of random people. “Oh, look, you have something encrypted! You must be hiding something. Show us immediately all your secrets! Ok, I see that you are using Windows to watch Youtube. Next one.”

necker · December 18, 2021, 12:24am

Sorry but this is nonsense. The rules of the game are different everywhere. Sure, there are countries where the possibility of such things are more likely, But life generally plays out within a spectrum between extremes, not in black and white scenarios. There are plenty of reasons to reduce our footprint in the world and plenty of situations where it would be more advantageous to reveal less information about previous activities.

necker · December 18, 2021, 12:25am

@Emily I was searching for something unrelated and ran across this. It doesn’t address what you are asking but it’s related.

github.com

unman/notes/blob/master/Really_Disposable_Qubes.md

## Disposable qubes
In normal use qubes are created on, and changes written to, the disk. There is also extensive logging and signs of the qube are scattered in a number of places.
Sometimes, you want to create a qube which does not leave these traces.  
You can do this relatively simply, by creating a RAM based storage area and using it for a new storage pool.
The qube will persist until the RAM disk is deleted, or the machine is shut down.

A script like this in dom0, will create tmpfs RAM disk, create a new storage pool, and create a new qube using that pool.  
tmp_qubes.sh:  
```
#!/bin/bash
mkdir /home/user/tmp
sudo mount -t tmpfs -o size=2G new /home/user/tmp/
qvm-pool --add newer file -o revisions_to_keep=1,dir_path=/home/user/tmp/
qvm-create new -P newer -t template-debian-10-vanilla  -l purple --property netvm=tor
qvm-run new firefox-esr 
```

You can remove the qube, and some of the associated artifacts by script in dom0.  
rmtmp_qube.sh:  
```

This file has been truncated. show original

enmus · December 18, 2021, 1:57am

@necker I absolutely agree. I just referred to @Emily’s threat model - “world gone full dystopian tyrannical”. In such a world, I can’t agree there are shades of gray. Just black. I also emphasized that if anyone is targeted by an adversary, no Qubes, or VeraCrypt will help him/her.
So, maybe this is nonsense, but that doesn’t change the fact.

enmus · December 18, 2021, 2:10am

To be clear: “polishing” Qubes by reducing footprint of our activities in it is absolutely necessary.
But using VeraCrypt on one hand and shared folders across VMs on the other hand is overkill as I see it, and actually those are extremes for me.
Maybe I am wrong, but not that stubborn not to accept threat models in which using this is justified. On the contrary.

necker · December 18, 2021, 2:26am

I understand your assumption but I would at least argue that “a world gone full dystopian tyrannical” describes a global context, not necessarily local conditions. While there are certainly implications to living in such a world, I wouldn’t say that the same inferences should be made for all individuals.

It’s possible that there is still enough freedom and choice for certain individuals to make calculated attempts to preserve their integrity and well-being.

necker · December 18, 2021, 2:33am

Wrong? Only you could know such a thing. A threat model is very unique and personal. It deals with perceived threats, so it’s not a matter of “right or wrong”. It’s empirical. It can’t be “proved”, only validated. It’s useful or it’s not.

Emily · December 18, 2021, 5:31am

Exactly. All the mindless shit your average CNN watching, social media addicted statist zombie would have on their laptop.

Emily · December 18, 2021, 5:33am

…I do not agree.
Nor am I a defeatist.
Monolithic criminal enterprises (governments), have always been a few steps behind the cypherpunks.

adw · December 18, 2021, 7:52am

I understand the rationale behind hidden volumes, but that’s not what the OP described, or at least not how I interpreted it. It sounded like the goal was just to encrypt all files that “leave forensic footprints,” which they already are. This is the basic rationale for FDE rather than mere file-level encryption.

Emily · December 18, 2021, 8:04am

The hedge is against state sponsored criminals in monkey suits coercing system decryption.

What the criminals should see is a system typical of your average mindless social media user. Logs only map to the hidden layer when the hidden layer is mounted. When it’s not mounted the logs should log as usual, leaving plenty a trial for forensics to follow to mindless state approved social media, but never seeing the hidden layer.

adw · December 18, 2021, 8:24am

Thanks for clarifying what you had in mind. There have been several discussions about this over the years. Here are some relevant issues:

github.com/QubesOS/qubes-issues

Deniable encryption

opened 05:57PM - 27 Oct 16 UTC

andrewdavidwong

T: enhancement help wanted C: core crypto security

[On 2016-10-26 16:19, tonyinfinity@tutanota.com wrote:](https://groups.google.co…m/d/msgid/qubes-devel/KV2ClaW--3-0%40tutanota.com) > Usecase: If you are unexpectedly legally or extra-legally coerced to decrypt your laptop. > > In order of most desired to least: > > 1) Deniable FDE > e.g. TrueCrypt/VeraCrypt-style hidden OS. I'm also not sure if these deniable encryption tools currently work with Qubes as is? > > 2) Deniable encrypted partitions > > 3) Deniable encrypted VMs

github.com/QubesOS/qubes-issues

Per-VM encryption

opened 08:22PM - 07 Oct 15 UTC

qubesuser

T: enhancement help wanted C: core P: major crypto bounty C: storage

Currently volatile.img is stored unencrypted and includes swap, which means that… anyone compromising dom0 or getting past full disk encryption can potentially read things that were in application memory of any VM at any point in past time, if it happened to be swapped out and the sectors were not overwritten. This can be avoided by mounting volatile.img using DM crypt and a randomly generated key on each bootup that is then naturally destroyed on shutdown. Likewise, not encrypting private.img means that it is not possible to securely delete a VM in a way that is fully resistant to future compromises since the data may be preserved in unused or reallocated sectors. In this case there is the additional problem of having to encrypt the keys with a master key stored in a way that can be securely deleted/changed (options could be on paper or in the TPM). There is a performance downside due to having to encrypt the data twice (once for the volatile.img/private.img encryption, once for full disk encryption); this could theoretically be avoided, but it seems that would require major changes.

You can probably also find some relevant threads by searching the mailing list archives.

Emily · December 18, 2021, 8:47am

Looking over the links, it looks like the community sees the writing on the wall, and is looking for solutions. But none implemented yet.

A little foresight goes along way. I want something viable now. I don’t think we have too much time before the rest the world looks like China and its outposts of Canada, Australia.

This dystopian steamroller isn’t going to stop anytime soon. We need something now.

it seems if every log folder was bound to a pd vault layer then we have working plausible deniability for coerced decryption.

Most cases the criminals won’t go much deeper if there’s plenty of red-herring data left in the overt layer logs.

If they do go for second level forensics, then the swap partition needs to be dealt with.

A) How/where can I get a complete list of folders where footprints end up?

B) What is the best way to prevent ghost layer data from ending up in swap? Or clearing the swap completely when exiting the ghost layer or shutting down the system?

enmus · December 18, 2021, 12:18pm

Also, 12 years ago, Joanna discussed another aspect of encrypted disks/hidden volumes, then with the TrueCrypt developers, too…

Sorry, but I see this as a misconception of Qubes. For me, it would be the same as someone would want to additionally harden safes (VMs) in a bank vault (dom0), even with hiding them behind that picture on the wall in the vault, or even behind the wall itself in the vault.

Some will look for regular safes, but depending on the content, for sure there will be some looking for hidden safes. And they will find it.

And the misconception is: whoever is able to break into the vault, isn’t capable to break the safes and find the safe behind the picture/wall in the vault.