←back to thread

QubesOS – A reasonably secure operating system

(www.qubes-os.org)
176 points TheFreim | 8 comments | 11 Jul 23 18:11 UTC | HN request time: 0.367s | source | bottom
Show context
weinzierl ◴[11 Jul 23 18:54 UTC] No.36685626[source]▶
I used it when I worked as a hiring manager. For this task it is ideal. All the behavioral security measures, like only to open attachments from people you trust, break down when your job description is basically to figure out who you can trust.

Qubes comes with a "Convert to trusted PDF" out of the box. Joanna Rutkowska explained how it works under the hood pretty nicely[1]. The tldr is that it is very thorough. With Qubes it is convenient too.

I used Qubes to open the application mails and their attachments and converted the interesting ones to trusted PDFs which I then forwarded to the relevant people. All further communication was only with the trusted versions.

[1] https://blog.invisiblethings.org/2013/02/21/converting-untru...

replies(1): >>36685941 #
1. neodypsis ◴[11 Jul 23 19:17 UTC] No.36685941[source]▶
You can use something similar on macOS, Windows or Linux, based on Docker containers, see Dangerzone: https://github.com/freedomofpress/dangerzone
replies(4): >>36686179 #>>36686191 #>>36688631 #>>36691492 #
2. weinzierl ◴[11 Jul 23 19:34 UTC] No.36686179[source]▶
I didn't know about that but that looks really nice. From a quick glance I understand that they can even utilize OCR to make the trusted PDF into more than an image container. Back in the day when I used Qubes it could not do that. (I haven't used it for a while so I don't know if it can now)

I still think security-wise Qubes is a bit better because it relies on VMs instead of containers.

3. Syonyk ◴[11 Jul 23 19:35 UTC] No.36686191[source]▶
The problem is that containers rely on the OS kernel to enforce separation, and kernel exploits are an awful lot less rare than anyone would prefer.

If someone is delivering targeted malware to a company through HR channels, it's safe to assume that if they can escape the document viewer, they can probably also try for a local root/kernel exploit and escape the container.

Containers are separation of convenience - not a hard security boundary.

replies(1): >>36686735 #
4. davidandgoliath ◴[11 Jul 23 20:23 UTC] No.36686735[source]▶
And container escape exploits are getting burned by sending them out via email? Doubtful.
replies(2): >>36686928 #>>36690300 #
5. Syonyk ◴[11 Jul 23 20:41 UTC] No.36686928{3}[source]▶
It depends on who you're targeting and what you want.

But the history of computers security can largely be summed as:

"What? You're just paranoid. Nobody would possibly X!"

Someone gets their asses handed to them by someone Xing.

"What? Why didn't you tell us X was a risk we needed to be concerned about???"

Iterate.

6. mike_d ◴[11 Jul 23 23:39 UTC] No.36688631[source]▶
Dangerzone is an implementation of a concept known as CDR (Content Disarm & Reconstruction), where you convert anything to an image inside a sandbox, and then convert the raw pixel data back into an image inside a different sandbox.

It is a common workflow inside the government or other places where you need to move data across airgaps, or view content that is highly untrusted.

Shameless plug, I wrote my own that supports over 200 file formats: https://preview.ninja/

7. adgjlsfhk1 ◴[12 Jul 23 03:55 UTC] No.36690300{3}[source]▶
well if you bother to send an email that breaks out of the container, you might as well make it retrospectively delete the email to hide the evidence :)
8. no_time ◴[12 Jul 23 07:40 UTC] No.36691492[source]▶
Is this really a good idea? Won't the pdf thumbnail generator pwn you by merely navigating into the folder that contains the infected file?