Why the system is more favorable to malicious attackers and not users

[fsflover]

There have been a lot of discussions on these topics:

Intrustion Detectors in dom0: bad idea?

Continuing the discussion from Running AIDE in dom0: I’ve seen couple of times users talk about installing IDEs (Intrusion Detection Systems) in dom0 and I wanted to start a discussion on this to see people’s takes on it.

Consistently compromised Qubes

No matter what steps I try to take I can’t seem to suss out malicious and entitled hackers from consistently compromising my networked devices. Not sure if they keep regaining access to Qubes from the router, usb keyboard or both and I’m not very technically inclined or learned in IT so I’m not sure what steps to take. Are there any log files I can send out to potentially help benefit this community? Running iftop on net/firewall seems to indicate that something is bypassing the internal 10...*…

This is not easy to hack Qubes OS at all:

@fsflover

To hack Qubes, i.e., dom0, you need to escape the hypervisor or perform a side channel attack . AFAIK, last time the former was achieved in 2006 by the Qubes founder . In other words, it’s extremely hard and unlikely. Concerning the latter, see also: Xen security advisory (XSA) tracker | Qubes OS and Qubes security bulletins (QSBs) | Qubes OS.

Qubes founder said this:

The inconvenient and somehow embarrassing truth for us – the malware experts – is that there does not exist any reliable method to determine if a given system is not compromised. True, there is a number of conditions that can warn us that the system is compromised, but there is no limit on the number of checks that a system must pass in order to be deemed “clean”.

Fortunately, you can always recover to a non-compromised state in the following way (and it’s not that complicated):

Compromise recovery in Qubes OS

@unman

It’s easy to use Qubes without the command line: it has been for years.

Indeed I am using Qubes without a command line (although I can use it when I want). However, certain things are not yet implemented in the GUI, e.g. volume revert. This is work in progress and, @sosqubesinstal, you can always help it.