Serious Discussion Security focused Qubes OS

[Victor M]

Spent the last week on Qubes OS.

As you might know, it uses virtualization to create different virtual machines for personal,
work, untrusted and disposable environments. This should protect against attackers from jumping
from the vm running your browser to the vm housing your important documents.

The one thing I find odd is that there is no password for the user in the vm's. Hence there is no
password for sudo. So what that means is an intruder can completely take over your internet facing vm.
But you are supposed to use a disposable vm for internet browsing.

A disposable vm is wiped every time you shut it down or when you shutdown the machine. And it starts from a clean slate every time you
start it up. ( Your applications are stored in the template and stays intact ) All your attacker's tools will be gone.
What that means is that you have to at least setup your password manager and configure your browser
before you do any surfing. A bit tedious, but I think that is the way it is intended to be used.

There is a Qubues Manager, where you can view all your vm's. It can started via 2 methods. One way
is via the Qubes Domains icon on the top right. Another way is through Applications Menu (top left) > Gear icon
> Qubes Tools > Qubes Manager.

The Qubes Manager is where you do updates. (Update button in Qubes Manager) You will find your OS templates in Qubes Manager.
And they are the ones which needs updating. The built-in templates are fedora, whonix and debian.
You also install your apps in the templates. And then they will be available in your vm's. You start the template
in Qubes Manager, then you start the console/terminal and you use the package manager for the respective distro. Then you shutdown
the template afterwards. You only have to manually start the template when you install applications. You don't need to prestart your template
to do updates - Qubes will start it for you and shut it down afterwards.

To put your applications onto the vm's menu as seen in the top left Applications menu, you
click on Application Menu > vm name > Settings, and go to the applications tab.

The host is called dom0. It does not connect at all. You can't even copy files over to it. You can copy things between
vm's using the clipboard : CTRL-SHIFT-C and CTRL-SHIFT-V. You can copy files across vm using the File Manager right click
and 'Copy to another cube' . But not to dom0.

There are no pre-setup disposable vm's. You have to to go Qubes Manager > New Cube button; Type=disposable.

You don't have to use a disposable vm, instead you can create an AppVM. This kind of vm has a persistent home directory
and the root drawn from the template. You are then running the risk of the attacker hiding her tools within \home. What I
suggest is to use the work and personal vm's to store your valuable data.

It is also possible to create a Windows or other Linux distro vm. Remember to install the Qubes Windows Tool.

To change your wallpaper, you first download it into your <disosable vm name>. Then view the picture full screen.
Then right click on the desktop and choose Applications > System Tools > Screenshot. Take the screen shot and
save it. It will be saved into dom0. Then right click on desktop, choose Desktop Settings
and navigate to where the screen shot was saved.

On the whole I am satisfied with the security of Qubes for now. There is an uneasy feeling to it as the attacker
can setup camp and and control the disposable vm until it is restarted. But Qubes founder Rutkowska is well known in
the security world, and knows virtualization really well, she would have thought thru all the attack vectors.

 

[Bot]

Thank you for sharing your detailed experience with Qubes OS. Your insights will certainly help others who are considering using this security-focused operating system. It's true that the lack of password for sudo in the VMs might seem odd, but as you mentioned, the disposable VMs and the isolation between them should mitigate most risks. The tediousness of setting up a new environment each time is indeed a trade-off for security. As for the potential for attackers to control a disposable VM until restart, remember that they would lose all progress upon each reboot. As with any system, Qubes OS isn't perfect, but it's designed with security as the top priority.

 

[i7ii]

But... was told that even the advance users of this forum - can't use Qubues. Then again, the one who made that statement - proved to be a pathological liar (kept spewing lie after lie with every new post - to the point where he became to childish with his lies to be worth taken seriously - like, claiming he works for some government and has access to some mystical governmental data - which has sensors throughout the global infrastructure spying on all of us for at least 25 years - but then added the most childish thing imaginable - like, claiming that ALL the feeds and statistics from all that spying - reveled that attacks on home users are so 2001... so, basically, the release of Windows XP SP1 or even Windows 98/2K still used by many... proved to be to much for black hat hackers - so they all quit attacking home users around 2001... he actually said that, can't make this up .

Good to know it's not the case. Even tho, i can agree - that Qubues can be a bit overkill for daily use (or at least, it doesn't fit my requirements - what can i say... I'm to basic as a human being to be deemed a high profile target) - but it's definitely fun to play with (something new, like a new toy - healthy food for the brain - in the age when there's to much brainrot content around).

The one thing I find odd is that there is no password for the user in the vm's. Hence there is no
password for sudo. So what that means is an intruder can completely take over your internet facing vm.
But you are supposed to use a disposable vm for internet browsing.

I remember couple of discusion on this subject:

To 'passwordless-root' or not to 'passwordless-root'?

Consider a GUIX overlay to a Debian template for your service VM’s. My Net-sys, Firewall-sys…etc all are passwordless and I remove both Nautilus and Firefox… You can do a lot of other things to make them secure. Use disposables… I can go on and on…

forum.qubes-os.org

Thus, the folowing answer/explanation for that: ://www.qubes-os.org/doc/vm-sudo/

 

[simmerskool]

@Victor M -- QubesOS needs to be installed on hardware, correct? ie, you cannot install it in VMware to test it

 

[Victor M]

Qubes does not need to be installed on hardware, you can use a VM to test it.

 

[Victor M]

I'm to basic as a human being to be deemed a high profile targets

Never say that. Hackers comes in different grades of skills. And they need practice targets. They do not jump from script kiddie to corporate hacker in one day. So guess what? The tree with the low hanging fruit gets picked. So don't make yourself an easy target and install some security layers. There are also hackers who do not want to crossover to serious cybercrime.

Also remember that for every malware that establishes a C2, there is a hacker behind it. Or else they wouldn't have bothered.

Everyone nowadays is talking about infostealers - they harvest personal info, session cookies, and whatever is in your account. And they don't have to escalate to admin. These data sell for low amounts in the blackmarket. My intention of using Qubes is to mitigate that risk. Together with my Yubikey 2FA, and some procedures like always signing out on websites, I hope I can.

 

[roger_m]

like, claiming he works for some government and has access to some mystical governmental data - which has sensors throughout the global infrastructure spying on all of us for at least 25 years - but then added the most childish thing imaginable - like, claiming that ALL the feeds and statistics from all that spying - reveled that attacks on home users are so 2001... so, basically, the release of Windows XP SP1 or even Windows 98/2K still used by many... proved to be to much for black hat hackers - so they all quit attacking home users around 2001... he actually said that, can't make this up .

He made some valid points. You are greatly exaggerating what he said. What he actually said made sense to me, for the most part.

 

[i7ii]

Never say that. Hackers comes in different grades of skills. And they need practice targets. They do not jump from script kiddie to corporate hacker in one day. So guess what? The tree with the low hanging fruit gets picked. So don't make yourself an easy target and install some security layers. There are also hackers who do not want to crossover to serious cybercrime.

Also remember that for every malware that establishes a C2, there is a hacker behind it. Or else they wouldn't have bothered.

Everyone nowadays is talking about infostealers - they harvest personal info, session cookies, and whatever is in your account. And they don't have to escalate to admin. These data sell for low amounts in the blackmarket. My intention of using Qubes is to mitigate that risk. Together with my Yubikey 2FA, and some procedures like always signing out on websites, I hope I can.

True, but unless they have direct access to my device - i should be able to manage the learning types, i think. Even so, owning a computer with Intel's IME embedded microcontroller - or using Windows (with any type of protection - even the pricey business type - like the infamous CrowdStrike - cause of that incident from last year) - there's still to many holes - which a skilled black hatter might be able to exploit. I'm just not worth the time of someone actually skilled - with what one could get from someone like me.(same way - a professional high pay criminal - would not brake into normal people's houses).

Same can be said about info-killers, there's nothing worthwhile on my PC - but i'm also to old school in that regard (don't have a social media presence, canceled my credit card almost a decade ago - still using cash in this age and time). Whatever can be taken from me (browsing interests and such) - is still taken by corporate info-stealers (google and co) - by simply accessing the "infected sites (that's most of them at this point)" .

 

[i7ii]

He made some valid points. You are greatly exaggerating what he said. What he actually said made sense to me, for the most part.

Some, but he mixed those - with a lot of self-contradictory statements (contradictory to those valid points), some rather childish - like the line claiming he's working for some government - actively monitoring the global infrastructure for at least 25 years - and ALL the feeds/statistics gathered in all that time - revealed that home users are secure from attacks since the release of Windows XP (2001). Quite literally what you'd here from a kid boasting about something he made-up just for the sake of impressing others (yet, it's so silly that it can't pass any adult/factual logic). As the saying goes: lies have short legs (facts are easier to remember - but lies not so much, so all it takes is time - and the cracks in the narrative keep getting bigger and bigger). Same way... Putin & Trump made some valid points too - and quite a lot (or at least enough) people were in agreement - while focusing on what they liked to here and ignoring the rest. I don't care about fake validation - if you're impressionable that's on you. But it's 2025 and this is suppsodly a MalwareTips dedicated forum. If you actually belied that childish BS, random (one of many) yet publically available statistics like the folowing...

malware-traffic-analysis.net

malware-traffic-analysis.net

...might shock you (comes with included samples).

 

[bazang]

But... was told that even the advance users of this forum - can't use Qubues.

One (1) user. Provide examples of more please.

Create a poll here on the forum and ask "Do you use QubesOS - YES or NO?" Such a poll is going to quickly confirm what I meant when I stated "people at MT cannot use Qubes."

I never said that people are incapable of figuring out and using Qubes. But that is how you interpreted it or deliberately spun what I posted into something I never said. The first of many instances.

proved to be a pathological liar (kept spewing lie after lie with every new post

Proofs? Provide receipts please.

so, basically, the release of Windows XP SP1 or even Windows 98/2K still used by many...

Less than 0.00001% of the global user base. Despite that small fringe user-base still using obsolete Windows, it still does not change the fact that malicious campaigns targeting home users are not the top priority of the vast majority of threat actors.

Not sure what your point is. What OS is used is not relevant to the trends in malicious digital campaigns.

so they all quit attacking home users around 2001

I never said that. That is your interpretation of what I said.

What I said is that malicious campaigns directed at home users are not the predominant global activity of threat actors. Which is 100% correct. They stopped focusing on home users a very long time ago.

that Qubues can be a bit overkill for daily use

QubesOS, despite its strong security features, faces several challenges that contribute to its lack of popularity:

1. Performance Issues: QubesOS is known to be a resource hog, requiring significant system resources to run smoothly. Users have reported that even high-end hardware struggles with tasks like playing high-resolution videos.
2. Complex Configuration: The constant need for configuration and maintenance can be daunting for users. Setting up and managing QubesOS requires a steep learning curve and a lot of time.
3. Hardware Compatibility: QubesOS has specific hardware requirements, and not all devices are compatible. This limits the number of users who can effectively run the OS.
4. Battery Life: Users have reported poor battery life when using QubesOS, which can be a significant drawback for those who rely on their laptops for extended periods.
5. Lack of Certain Features: Some users find the lack of features like Bluetooth support and GPU utilization to be a dealbreaker. These limitations can hinder the overall user experience.
6. Usability: The unconventional way of using QubesOS, with its compartmentalized approach, can be challenging for users who are accustomed to more traditional operating systems.

like the line claiming he's working for some government

I do. What do you expect? That I post images of my security clearance and officer badges? "Take a pic or it's just not true..." sortah thing for you, right?

actively monitoring the global infrastructure

You do realize that governments have programs that do exactly that - continuous global monitoring, right? Those operational threat monitoring, aggregation, and analysis programs have been running continuously for well over 20 years and the data collected shows the trends that I spoke of. Actually, the UK, US, Israel, Canada, Australia, New Zealand, Netherlands, France, Spain, Norway and others have threat intelligence sharing agreements.

Go back 10 to 15 years, and malware was not the primary global, systemic digital pariah. It was PUPs and PUAs.

actively monitoring the global infrastructure for at least 25 years - and ALL the feeds/statistics gathered in all that time - revealed that home users are secure from attacks since the release of Windows XP (2001).

I never said that "ALL the feeds/statistics gathered in all that time revealed home user are secure since the release of Windows XP (2001)." You are straight-up, purposefully mis-stating what I posted.

Threat intelligence has been around for many decades at this point. Threat actors go after targets with a good return on effort nowadays, which was my point. And which you state yourself here. So thank you for proving my point, and you didn't even need threat intelligence or statistics to figure it out.

I'm just not worth the time of someone actually skilled - with what one could get from someone like me.(same way - a professional high pay criminal - would not brake into normal people's houses).

@Victor M -- QubesOS needs to be installed on hardware, correct? ie, you cannot install it in VMware to test it

There are aspects of QubesOS that - in order to work completely as expected - requires installation on bare metal hardware. The nested virtualization only works as intended when installed directly onto the required hardware.

Even on a super high-end tower PC, QubesOS runs wonky - resource wonky - in a virtual machine.

Installation guide

Welcome to the Qubes OS installation guide! This guide will walk you through the process of installing Qubes. Please read it carefully and thoroughly, as it contains important information for ensuring that your Qubes OS installation is functional and secure. Pre-installation Hardware re...

www.qubes-os.org

 

[simmerskool]

There are aspects of QubesOS that - in order to work completely as expected - requires installation on bare metal hardware. The nested virtualization only works as intended when installed directly onto the required hardware.
Even on a super high-end tower PC, QubesOS runs wonky - resource wonky - in a virtual machine.

Installation guide

Welcome to the Qubes OS installation guide! This guide will walk you through the process of installing Qubes. Please read it carefully and thoroughly, as it contains important information for ensuring that your Qubes OS installation is functional and secure. Pre-installation Hardware re...

www.qubes-os.org

View attachment 287562

@bazang yes, thanks, I confirmed my understanding by re-reading the same thing. @Victor M is perhaps technically correct, it would install & run in VM but not with its intended features.

 

[Victor M]

Yeah, you are right. I tried it under QEMU and Qubes complained it can't see the hardware IOMMU.

Sorry @simmerskool , gave you the wrong answer.

 

[Victor M]

bazang and i7ii, could you move your discussion elsewhere?

 

[Victor M]

Have been running Qubes for 2 months as my primary box now. 8 gigs ram, 256 gig ssd. No show stoppers. But then, this box is 2022 hardware. It is a little bit slower than a normal distro, you have to count to 3 for a vm to start up.

It's security barrier is not os accounts, like in Windows, but the individual vm's. You need to do least privilege and keep different classifications of data in separate vm's. But it is easier than signing in and out of Windows accounts, because all vm's are available simulataneously under one screen. You move things you downloaded to other vm's using the built in copy applet. Of course you never move exe's, that could break the security. You use the base template vm to install from the package manager, the individual vm's like personal work private will inherit it. And you use a vm dedicated to surfing and don't start the browser using the private and vault vm's, you can, but you shouldn't. It is procedural administrative control as opposed to technical, but you'll get the hang of it. (At least there is no hocus pocus UAC. If you haven't heard, MS says it is not a security barrier and refuses to fix UAC bypass problems. )

And I have gotten rid of the Debian base template - no other prebuilt vm's uses it. I prefer Fedora anyways because of their fast updates.

 

[simmerskool]

And I have gotten rid of the Debian base template - no other prebuilt vm's uses it.

your comment re Debian is unclear to me. Is Debian in reference to Qubes? Unless I extend win10 support in my Host, I have been considering Debian to replace win10 as my Host, install VMware in Debian, and continue with my VMs of which fedora has been my favorite. (& also keep 1 or 2 win10_VM Guests)(or replace my motherboard and cpu but various reasons here not to do that)

 

[Victor M]

Qubes comes with 3 templates: Debian, Fedora and Whonix. Then the vm's are bulit using those 3 templates. The vm's that are prebuiilt are personal, vault and untrusted, all of them based on the Fedora template. There are some Whonix vm's but I haven't used them. So Debian is not used, but, you can make a vm based off Debian if you want. I like Fedora more. And since none of the prebuilt vm's use Debian, I deteted that template.

All the vm's inherit the root dir from the templates, and it is read only. And then the home dir is local to each vm; and they are kept / persistent.

Why did you choose to use Debian as your host?

 

[simmerskool]

Qubes comes with 3 templates: Debian, Fedora and Whonix. Then the vm's are bulit using those 3 templates. The vm's that are prebuiilt are personal, vault and untrusted, all of them based on the Fedora template. There are some Whonix vm's but I haven't used them. So Debian is not used, but, you can make a vm based off Debian if you want. I like Fedora more. And since none of the prebuilt vm's use Debian, I deteted that template.

All the vm's inherit the root dir from the templates, and it is read only. And then the home dir is local to each vm; and they are kept / persistent.

Why did you choose to use Debian as your host?

Only considering using Debian as my Host. I do have a Debian_vm Guest with Gnome and I like it well enough. I'm no expert with Debian, but read one of its strength's is its stability. More testing of system and app in Debian (if true) while fedora updates almost daily.

 

[Victor M]

Why not give Qubes a try? It is meant to be a 'host'. And it seems to support more than just 3 distro's. But I haven't tried the other community supported templates. Templates. And Qubes is Very serious about security. Security is baked in during design phase. E.g. See here: Compromise recovery in Qubes OS . And here: Security design goals . While other distro's just touch upon 'being secure' just because everybody else is saying that their distro is secure. And they offer hardening advise as an after thought. Security is better when it is done in design phase.

Yes, I have also read that Debian is a stable distro. But that is from a traditional sys administrator's perspective. More stable = less troubleshooting.
But from a security admin's perspective, fast updates is more important. Fast updates = minimal attack time-window. Hence my preference of Fedora.
So it depends on which role you see yourself as.

 

[simmerskool]

I can see myself installing Qubes on hardware as Host, and having issues, and then having to do it again probably with another OS; whereas, I'm somewhat familiar with Debian (or fedora) and making either Host will just work. for me Qubes would be an experiment, and getting too old to go down that road.

 

[Victor M]

I hate having issues too. I divide 'issues' into 2 kinds. a) when things don't work b) how do I achieve this . For issue class a) Qubes has been around since 2012 and most of the kinks have been worked out .And for b) type issues I have the internet and ChatGPT.

Colleges have been promoting the concept of 'life long learning'. And I see old folks going back to university to work on things for fun and interest. I remember seeing several white hair dudes in my art history class. You are not afraid of problems I know because you are willing to try out different distro's. Some folks don't venture that far from shore.