Telegram desktop identifying Qubes in StandaloneVM

User Support General
1

Hi guys,

I have a (maybe stupid) question about what I noticed earlier.

I decided to create a dedicated qube to handle my communication. It’s not the best on segregation purposes but it allows me to split IM, calls and mail accounts from the rest of my activities (The best way would probably to have distinguished qubes per service provider bu I’m not there yet. I like the convenience of starting one qube that will get all the notifications or silence it in one qube shutdown).

I decided to run a standalone debian VM because I do not wish to install SnapStore on a template level. At this point I only need it to install the IM clients (Basically whatsapp for linux, Telegram, etc).

However, after setting up Telegram, I received a message from them noticing a new connection (whichi is normal) stating the following device :

Device : Telegram Desktop, 4.6.5 Snap, Desktop, Linux Qubes X11 glibc 2.35

So in some way, it managed to detect my OS despite being a Debian Standalone qube.
Any idea how ?

Thanks a lot for your help in understanding this :wink:

Cheers,
John

2

How did you create that standalone?
What settings did you use?

I never presume to speak for the Qubes team. When I comment in the Forum or in the mailing lists I speak for myself.
3

There are a zillion ways to detect Qubes OS if its tooling is installed inside the VM. A StandaloneVM is not necessarily any different to an AppVM in this regard.

Telegram Desktop uses this library to collect system information. Among other things it looks at how the window manager identifies itself, which in case of an integrated VM’s VM-side window manager is simply “Qubes”. You can do the same thing manually (in the VM) like:

$ sudo apt install x11-utils
$ xprop -root _NET_SUPPORTING_WM_CHECK
_NET_SUPPORTING_WM_CHECK(WINDOW): window id # 0x400002
$ xprop -id 0x400002 _NET_WM_NAME
_NET_WM_NAME(UTF8_STRING) = "Qubes"
2 Likes
4

Is there also an easy way to cheat?

5

I created using the UI, choosing fully persistent.
I just tried again from a new debian based standalone VM and got the same result.

6

If you mean changing this particular X11 property:

$ xprop -id 0x400002 -format _NET_WM_NAME 8u -set _NET_WM_NAME 'dwm'
2 Likes
7

Relevant FAQ entry:

https://www.qubes-os.org/faq/#what-about-privacy-in-non-whonix-qubes

1 Like
8

Could have also used:

qubesdb-read /name /type

Keep in mind there are other juicy details it can extract. The ones I recall now are keyboard layout and CPU model.

1 Like
9

I just read the FAQ and I understood that Whonix is for privacy.
Is it possible to use Whonix with Tor Browser or Brave or Firefox without going through the Tor network/gateway? Would instructions be available to achieve this?
The purpose is to benefit from Whonix VM privacy settings, while accessing the Internet via a VPN (which is faster than Tor and avoids denial of access due to Tor).

10

Which VM privacy setting do you mean?
Maybe try https://www.kicksecure.com/

Or do it manually. Instead of gateway use another VM to access the internet.

1 Like
11

I’m not sure. That would probably be a question for the folks on the Whonix forum. I do know that Whonix qubes check to makes sure they’re connected to sys-whonix and will warn you if not.

12

To do this automatically on VM boot run these in the VM:

Create the service file:

mkdir -p /home/user/.config/systemd/user
cat > /home/user/.config/systemd/user/wmname.service <<EOF
[Unit]
Description=Change WM name
After=default.target

[Service]
Type=oneshot
Environment=XDG_RUNTIME_DIR=/run/user/$(id -u user)
ExecStart=/usr/bin/xprop -id 0x400002 -format _NET_WM_NAME 8u -set _NET_WM_NAME 'dwm'

[Install]
WantedBy=default.target
EOF

Reload and test:

systemctl --user daemon-reload
systemctl --user enable wmname.service
systemctl --user start wmname.service
xprop -id 0x400002 _NET_WM_NAME
13

I’ve updated instructions to this:

To do this automatically on VM boot run these in the VM:

Create the service file:

mkdir -p /home/user/.config/systemd/user
cat > /home/user/.config/systemd/user/wmname.service <<EOF
[Unit]
Description=Change WM name
After=default.target

[Service]
Type=oneshot
Environment=XDG_RUNTIME_DIR=/run/user/$(id -u user)
ExecStart=/usr/bin/xprop -id 0x400002 -format _NET_WM_NAME 8u -set _NET_WM_NAME 'dwm'

[Install]
WantedBy=default.target
EOF

Reload and test:

systemctl --user daemon-reload
systemctl --user enable wmname.service
systemctl --user start wmname.service
xprop -id 0x400002 _NET_WM_NAME