Introduction to Qubes OS

A one hour lunch and learn on Qubes OS I gave at the office.

Source on Github:
https://github.com/jclement/presentation-qubesos

Transcript

1. Qubes OS A reasonably secure operating system Qubes OS // 2017-03-02 1
2. Qubes OS is a security-focused desktop operating system that aims to provide security through isolation. “ “ Qubes OS // 2017-03-02 2
3. Life before Qubes OS Qubes OS // 2017-03-02 3
4. Qubes allows separating concerns into VMs Limit harm from rogue processes Limit what data they have access to Strict control over network access Strict control on sharing of data between VMs Identify which domain a process belongs to More practical than physical isolation Security++ and Privacy++ Qubes OS // 2017-03-02 4
5. Life with Qubes OS Qubes OS // 2017-03-02 5
6. Qubes OS // 2017-03-02 6
7. Security Features Xen hypervisor on the bare metal Single User Full drive encryption required Tamper resistance - TPMs & Anti-Evil-Maid Separate concerns by isolating them in VMs Management domain (dom0) handles VM management & window decorations. Risky hardware interactions banished to dedicated VMs Qubes OS // 2017-03-02 7
8. You can't use "beef stew" as a password Qubes OS // 2017-03-02 8
9. You can't use "beef stew" as a password It's not stroganoff Qubes OS // 2017-03-02 9
10. VM Types Concerns (or domains) are separated into VMs. AppVMs run applications and own data TemplateVMs base image for AppVMs (owns apps) SysVMs provide services to AppVMs NetVMs / ProxyVMs provide network access to AppVMs (or other NetVMs) USB VM special VM to handle USB devices DisposableVMs temporary VMs for unsafe ops Qubes OS // 2017-03-02 10
11. Management Tool Qubes OS // 2017-03-02 11
12. Window Decorations Windows from all AppVMs on a common desktop. How do you know which VM a window comes from? dom0 owns the window manager each VM assigned a color (red, green, black, ...) every window is tagged with VM name and color no full-screen applications! Qubes OS // 2017-03-02 12
13. Moving Data between AppVMs Qubes OS // 2017-03-02 13
14. Qubes OS // 2017-03-02 14
15. The clipboard Obviously the clipboard can leak information! so... 1. Each AppVM has its own private clipboard. 2. Manually move data between local clipboard and system clipboard. <ctrl> + <shift> + c copies local clipboard to system clipboard <ctrl> + <shift> + v copies system clipboard to local clipboard Qubes OS // 2017-03-02 15
16. Copying les between Qubes An AppVM can request a le be transferred to another VM Graphical or CLI All les placed in /home/user/QubesIncoming/[source] Always triggers dom0 prompt! qvm-copy-to-vm vault file.txt Qubes OS // 2017-03-02 16
17. Qubes OS // 2017-03-02 17
18. Networking Qubes OS // 2017-03-02 18
19. Networking Each AppVM can be assigned a single NetVM sys-net - unpriv VM with raw network sys- rewall - VM with rewall rules sys-whonix - proxy all traf c through Tor custom VPN - proxy traf c through VPN Each AppVM has its own set of rewall rules If no net VM is assigned the AppVM has no network access! Qubes OS // 2017-03-02 19
20. Qubes OS // 2017-03-02 20
21. Networking - Firewall Qubes OS // 2017-03-02 21
22. TemplateVMs Qubes OS // 2017-03-02 22
23. Templates Save space by sharing base images (OS and Apps) between AppVMs Qubes OS // 2017-03-02 23
24. Templates with Windows?! Is this even allowed by Windows licensing? Qubes OS // 2017-03-02 24
25. Templates and Updates Templates usually own the applications and base system Updates are run against the template. Not each AppVM! Updates through Tor: Prevent targetted attacks denying updates Prevent leak of meta-data about packages being used Updates through special update proxy service Templates have no direct network access! Qubes OS // 2017-03-02 25
26. Hardware Access Qubes OS // 2017-03-02 26
27. Hardware can be dangerous Autorun? Malicious USB rmware with BadUSB OS reads partition tables automatically USB stack parses USB device information on insertion DMA devices can swipe in-memory encryption keys (Qubes doesn't help with this) Qubes OS // 2017-03-02 27
28. USB & PCI USB controller owned by unprivileged USB VM isolating USB stack GUI support for: feeding block devices to speci c AppVMs microphones and cameras (Skype!) Experimental USB passthrough support If hardware supports (VT-d) allows PCI device passthrough for other hardware Qubes OS // 2017-03-02 28
29. Demo Qubes OS // 2017-03-02 29
30. Qubes Sweet Spot - The Road Warrior Securely carry different facets of your life on a single machine Need to access company resources Need to communicate with home (personal email / Skype) Open sketchy attachments from email or USB stick Install sketchy presentation software (cough.. WebEx... cough) Connecting through sketchy wireless hotspots Accidentally revealing personal information during demos Need to conduct personal business while away (banking, ...) Qubes OS // 2017-03-02 30