Using a script to infiltrate within a ‘tiny’ vulnerablilty inside Qubes

[Sven]

@rangmanalpha

I’m not 100% certain, but it seems cyberattackers who were attacking me were using a script to infiltrate within a ‘tiny’ vulnerablilty inside Qubes, but I felt that qubes-usb-minimal or qubes-network-minimal service worked really well, and I subjectively felt that they would work harder to compromise my WhonixVM. I also set some restrictions on VMs, such as adding custom rules for restricting file transfer from more vulnerable system qubes VMs such as sys-net and sys-usb, and edited the name of the AppVMs and TemplateVMs with some random alphabetical strings (pofhpoqweifjmpo) making their intervention on VM via Xen vulnerability slightly more difficult… or it is just a snake oil? Anyways, I felt that the newly added security measures are very useful, I think.

Moved here from a post in the HCL category.

[rangmanalpha]

i’m not sure… but what i know is that they usually use python scripts, along with some file manipulation on /home/user/ director, for example, ~/.config , ~/gnupg, or etc.

by the way, i’m trying to download 4.3 alpha testing for trying further security measures implemented on qubes 4.3. however, i saw the ‘Qubes OS Weekly Builds Signing Key’ has been self-signatured, not signed by master signing key. is this legit?

[rangmanalpha]

Qubes OS 4.2 Signed Weekly Builds

By the QMSK? No. They are images built outwith the build infrastructure AFAIK. fepitre has been clear about the build infrastructure and risks. They are , however, signed by fepitre-bot. It does use HTTPS

i found that this is due to the build process of the Qubes 4.3 alpha ISO! sorry for the initial question. but i’m not sure why last time i had failed to verify with .DIGEST file…

[rangmanalpha]

i sent an email attaching the (very suspicious - containing vm name which i didn’t modified) file which exists folders which are seemed to be manipulated. sorry for not to encrypting the email, i didn’t know sufficient knowledge to manage to do that… but i can assure that my email address is qubes + , so that would be the case. make sure open the file in disposable.