What's the best way to check if qubes is hacked?I

[2t64tc94whut3o27rjco]

I can only refer you back to

@fsflover

@anon42456682

You kinda can…

You disagree with the Qubes founder herself here:

The inconvenient and somehow embarrassing truth for us – the malware experts – is that there does not exist any reliable method to determine if a given system is not compromised. True, there is a number of conditions that can warn us that the system is compromised, but there is no limit on the number of checks that a system must pass in order to be deemed “clean”.

If you suspect that you are compromised, try Compromise recovery in Qubes OS , and also do it regularly just in case.

There is no way to know for sure if your system is compromised, especially not if you are dealing with an adversary advanced enough to break into dom0. Compared to breaking into dom0 altering a log file is beyond trivial.

[ckN6QwSZ]

@arkenoi

For RPM, it is public key based, thus it is less flexible, but somewhat pre-maintained.

@2t64tc94whut3o27rjco

If they can successfully bypass the isolation built into qubes then they will almost certainly also be able to bypass whatever detection mechanism you set up.

i.e. patch rpm -Va (or a tripwire-binary) to output “everthing is fine here, go away”.

@2t64tc94whut3o27rjco

There is no way to know for sure if your system is compromised, especially not if you are dealing with an adversary advanced enough to break into dom0. Compared to breaking into dom0 altering a log file is beyond trivial.

To prove that dragons don’t exist is kind of difficult, too.

If a malware wants to talk to the outside world, that communication can be hunted down with wireshark on a seperate, trustworthy machine. However, that can be difficult especially if the traffic is encrypted and headed to some (everyday) AWS-Instance.

Finding suspicious stuff like UDP-traffic without screensharing-app (or similiar) running or an iodine-tunnel might be easy. But https-traffic - in which you can’t look inside - connecting to unfamiliar hosts (maybe just the usual advertising and tracking) can be difficult.

[KarlinQubes]

Can you elaborate on the RPM queries please?

[arkenoi]

@ckN6QwSZ

i.e. patch rpm -Va (or a tripwire-binary) to output “everthing is fine here, go away”.

Just like tripwire. And you may run trusted rpm binary from a clean boot, just like tripwire.

However, if dom0 is not compromised, there is a lot of ways rpm is more handy.