Imagine that your system was compromised thru a qube via the network connection. Somehow, that compromise affected all booted qubes connected to the same IP. Dom0 boot hashes are also throwing compromise warnings. Somehow dom0 was compromised thru a network attached qube, or thru an update, or a…

[image] bored: The qubes running Tor/VPN or the qubes using a Tor/VPN VM for network access? Root network is sys-net. That then chains with sys-vpn1. That chains to sys-vpn2. That chains to sys-whonix. Edit: sys-net → sys-firewall (but you knew that.) Re: dom0: Well, boot loader hashes…

[image] cayce: To begin analyzing your traffic, installing OpenSnitch on the hosts you imagine to be compromised would be a good start for you as, it has a friendly GUI and, will ask you to manually create an allow rule for any packets looking to leave your node. “Globally” (traffic from all qu…

And you couldn’t use something like sudo netstat -tupa to see which process was connected to that IP address?

[image] Emily: Root network is sys-net. That then chains with sys-vpn1. That chains to sys-vpn2. That chains to sys-whonix. Yeah. But did those 3 crash (at the same time) or did a VM (or more) crash which was connected to one of those? [image] Emily: Other then an update, or an update at…

[image] Emily: Root network is sys-net. That then chains with sys-vpn1. That chains to sys-vpn2. That chains to sys-whonix. IMO, this is a bit insane for a “typical” (non-honeypot) computing scenario; at a minimum how is sys-firewall not in there? Something like: sys-net → sys-firewall → sy…

[image] bored: You could also break out of the VM by Xen/Qubes/RAM/CPU bugs. No need for an update attack. But of course it still could be an update attack. It’s not very likely that an update attack would allow you to break out of the VM. It can be used as the initial attack vector, but you …

If it is an update related to VMs, but not in case you update dom0. It is technically not breaking out of a VM, but you would have the same problem.

▶ off-topic banter Re: dom0 update. I cannot rule it out. But whenever I update I’m fastidious about noting it down, rebooting, and checking the hashes when the updates are done. It was a long computing session thru the night. I can’t rule out that I just missed something in a tired state. That…

You guess wrong. It was assumed all qubes connect with sys-net as a starting point and then go thru the firewall. Who wouldn’t? That would have been redundancy to restate that. ▶ comments about style of discourse

Qubes OS Forum

Resetting hardware state after nation state level attack

User Support

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled