Joanna Rutkowska

> Zero cases in the wild Follow along this post and you'll end up with one case in the wild all by yourself on your own machine: https://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-… Xace was designed to address the mess that is Xsecurity and using the SELinux sandbox for GUI apps, except Xace barely works for mitigating exploits well on the desktop; it's so finicky that Dan Walsh himself concluded that XACE does not work and instead opted to use nested X servers (!!): http://people.fedoraproject.org/~dwalsh/SELinux/Presentations/sandbox.…

If you're interested in this kind of thing, Invisible Things Lab are really worth checking out https://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-t…

The chip this uses , the i7-4770HQ , uses vt-d. According to invisible labs[1], vt-d can allow certain malware attacks. Afaik, even after being informed of this by invisible labs researchers, intel did nothing(afaik) to solve this. [1]http://theinvisiblethings.blogspot.co.il/2011/05/following-white-rabbi…

this work from 2011 by IVT doesn't exactly inspire confidence. http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-…

http://theinvisiblethings.blogspot.com/ - blue pill company, etc. http://www.lightbluetouchpaper.org/ - cambridge (uk) security group

This is the approach of Qubes-os: http://qubes-os.org/Home.html By they way read also their blog: http://theinvisiblethings.blogspot.com/

There's really no getting around the evil maid attack[1], if someone can attack your hardware directly. There's even evidence that a sufficiently clever attack can persist through formatting and re-installing a drive[2] - note, people have also found exploits in network firmware... remotely exploitable exploits. If you can do it by accident[3], then most likely it can be done with malice aforethought. Edit: adding a strong pass-phrase /does/ give you a significant level of protection; While it doesn't offer protection from an evil maid type attack (where the attacker trojans your server, then you decrypt your key after said server was compromised) it does offer quite a bit of protection, say, from an attacker who has access to old backups but not your production system. So I think a passphrase on all of your important private keys is a worthwhile thing to have. I just want to make it clear, once you decrypt that key from within a compromised system? all bets are off. [1]https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html [2]https://news.ycombinator.com/item?id=6148347 (of course, this specific attack wasn't as scary as it could have been, say if the same sort of thing was remotely accessible) [3]http://theinvisiblethings.blogspot.com/2010/04/remotely-attacking-netw…

Joanna Rutkowska described a way to avoid this back in 2011 (https://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html), I extended it to be more usable in 2015 (https://mjg59.dreamwidth.org/35742.html). Both solutions make use of a TPM.

X has security issues. For example, an application that has access to your display can do stuff with other applications. For an interesting discussion, see: http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-o…

Wayland has increased security. https://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-… https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/guides/linux-hardening.html#g…

I didnt say it was bad... I said, I was surprised given there is a 6 month schedule, that I randomly decided to check exactly 1 day before said schedule, and yet it was still secretly available. I don't think it runs as root either, I'm more concerned about xinput and keyloggers running as my normal user being able to snoop on even sudo/su prompts running as root in a GUI terminal window running as my user. You know about this right? https://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-… Wayland was supposed to prevent this, but I don't think its going well on OpenBSD. Does OpenBSD have a solution for this?

This is similar to how QubesOS converts “untrusted PDFs” in a disposable VM. Quite nifty, particularly if you use OCR afterwards. See: https://theinvisiblethings.blogspot.com/2013/02/converting-untrusted-p…

Hmm... I don't think this is actually a secure approach, as by default X is not secure. Any client with access can do things like sniff and inject keystrokes (even forwarded over SSH, depending on the value of ForwardX11Trusted in ssh_config): http://theinvisiblethings.blogspot.de/2011/04/linux-security-circus-on… I could be wrong. Apparently X11 has the SECURITY and XACE extensions which are theoretically capable of preventing this, but nobody uses them (except SSH, see above). It's possible that DragonFlyBSD has these integrated somehow and makes the directions secure, but I don't think so.

Can anyone comment whether this problem with GUI isolation http://theinvisiblethings.blogspot.de/2011/04/linux-security... is now solved?

Part 2: http://theinvisiblethings.blogspot.de/2013/09/thoughts-on-intels-upcom…

stuff like intel SGX goes a long way to making something like this possible. http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-intels-upco…

That's because Joanna is against it and will aggressively defend their platform choice. After our argument online [1], she posted this essay [2] comparing QubesOS to other things. She censored my piece-by-piece counter, too, lol. She did eventually do something with trusted path and mentioned QubesOS could be ported to different platforms. So, there's some progress... Honestly, it wasn't clear whether she really understood INFOSEC (esp TCB concept) based on her replies so I avoid QubesOS. [1] http://pastebin.com/5fnh8g2S [2] http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-differe…

I have been using QubesOS for a while now, I am happy to see it got a mention. Before using qubesOS, I had a vmware VM with a browser. I believe using Qubes is a bit more secure than an OS with a hypervisor running another OS with a browser though. See: http://theinvisiblethings.blogspot.com/2012/09/how-is-qubes-os-differe… Or: http://invisiblethingslab.com/resources/2014/Software_compartmentaliza…

No, it's not. Besides driver problems, missing support for newer OpenGL standards, fragmentation of desktop environments and a dozen of other problems, it doesn't even have GUI isolation (meaning that any X11 application can sniff your keyboard input): http://www.hackinglinuxexposed.com/articles/20040705.html http://theinvisiblethings.blogspot.de/2011/04/linux-security-circus-on…

See http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-o…

Important reading for everybody: http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-o…

> Join the live presentation. Wednesday April 15, 4:15-5:30. Requires Microsoft Windows Media player. Seriously? Anyways, what I'd be interested to know is if Intel has found a way to ensure that if the private key is stolen, others can find out about it. Since that seems overly complex/almost impossible, then the alternative should be to let users have their own keys and allow them to change the keys as well. Intel should not have access to those keys (in a provable way). Otherwise we'd never know if the NSA has the keys to all future "secure programs" protected by SGX. http://theinvisiblethings.blogspot.com/2013_09_01_archive.html

I think I picked this up off Hacker News originally, but there's apparently new Intel stuff (aka SGX) coming out to help with this. http://theinvisiblethings.blogspot.com/2013/08/thoughts-on-intels-upco… Unfortunately, I think the reason most open source people have a knee-jerk aversion to trusted platforms are that they've historically been designed to only serve the interests with the most money (read: the government and/or content industry). There's nothing inherently anti-open source about the schemes, and they would provide innumerable benefits to increasing security confidence in a networked world. However, when you can rattle off enough failed or botched encryption initiatives involving a hardware component to fill one hand just from the top of one's head (CSS, AACSS, HDCP, UEFI/SecureBoot, FairPlay), confidence is not inspired...

Edit: Measured boot (DRTM, e.g. implemented by Qubes) has some benefits over "Secure Boot" (SRTM), both for firmware modification and key management. http://www.pcworld.com/article/2883903/how-intel-and-pc-makers-prevent… "There’s also a second option: “Measured Boot” mode, where the hardware securely stores information about the boot process in a trusted platform module (TPM) or Intel Platform Trust Technology (PTT). The operating system could then examine this information, and—if there was a problem—present an error to the user. More on DRTM & SRTM: http://theinvisiblethings.blogspot.com/2011/09/anti-evil-maid.html

Intel's SGX is just a hardware generation away. This allows for encrypted code to run inside hardware protected regions called enclaves - the memory regions are encrypted and decrypted as they are pulled into the core. In a curious design decision, SGX allows the code in the enclave to access all the memory of the process it's associated with so it can do whatever ugly stuff it wants. Can we have proof carrying encrypted code? Or perhaps a trusted code verifier that's not encrypted that runs in an enclave too? https://software.intel.com/en-us/blogs/2013/09/26/protecting-applicati… http://theinvisiblethings.blogspot.co.uk/2013/08/thoughts-on-intels-up…

here is another article about CPU backdoors, http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html and the discussion in the comment section of that one is good and contains some interesting pointers for further sources on this topic... Also, here is a phrack article "System Management Mode Hack" on how to exploit Intel system management mode (with code at the end of the article). http://phrack.org/issues/65/7.html

Url changed from http://theinvisiblethings.blogspot.com/2014/08/physical-separation-vs-… which points to this.

She is aware of this but has a bone to pick with the particular way that SE Linux secures the GUI: http://theinvisiblethings.blogspot.com/2011/04/linux-security-circus-o… I agree, though, that the style is overly aggressive.