What's your system layout like?

[fiftyfourthparallel]

@tripleh

Anyway you’ll have sys-net et al constantly running which makes them prime targets for such attacks. Making them disposable helps a bit at least.

ed on my very limited knowledge). At least, it’d tide us over until someone bothers to make an ethernet unikernel.

Further discussion:

Is sys-net the weak link in our systems' security?

An XSA in the most recent QSB* reminded me to ask about the vulnerability of sys-net and whether there should be increased efforts to make this particular sys-VM run from a unikernel, microkernel, or something else with a minimal attack surface, especially since it really only does one simple job (I think). In brief: My gut feeling since before this QSB has been that sys-net presents the most accessible target for a remote attacker who might want to compromise the whole system as it isn’t (can’…

 

@adw

It’s true. Even something like posting a screenshot of your dom0 desktop (without any confidential data in view) could be used to launch an attack against you, since knowing exactly what your dom0 desktop looks like might allow an attacker to take over a VM with fullscreen permissions to create a convincing simulation of your dom0 within that VM, inducing you to perform sensitive actions like entering passphrases.

I see the concerns, but since nothing as specific as a screenshot of dom0 is needed, Kermit’s Law should be a good enough assurance. If an attacker has enough information about your system (across many VMs) to identify you from some details given here, then you have much bigger problems that not posting wouldn’t have prevented.

Pictured: Kermit’s Law

@adw

Physical air gaps are not always superior! For certain use cases (particularly those mentioned in the paper), Qubes compartmentalization is arguably be more secure.

And @fslover I see the argument, especially since BadUSB is a massive issue (though USB isn’t the only means of data transfer)–but considering the unknown unknowns, physical airgapping just makes me feel safer. It’s this big baby’s security blanket, if you will. Or maybe that should refer to the faraday blanket wrapped around the computer.