Sandboxing vs Virtualization

So we just had a discussion on "Simple questions thread" that I think deserves it's only thread. The discussion is about virtualization vs sandboxing. I'll post the comments bellow and you can contribute to it.

>the thread starts here why are you using whonix? It's much simpler to just point all your traffic to localhost and allow TorDNS. You'll not leak nothing. All these things about Whonix, and Qubes and Tails seems kinda idiot to me (except some good bits, like randomized mac address by default). Virtualization doesn't mean more security. It mean "security done the bloat way"

>>123 >But, I'm curious: why are you using whonix? I use it just to experiment, but it is really more secure. Unless an attacker manage to get out of the VM or attacks the gateway your IP is safe, someone with root privileges can bypass a firewall. >All these things about Whonix, and Qubes and Tails seems kinda idiot to me Why do you think so? There are great advantages in some of those. >Virtualization doesn't mean more security. It mean "security done the bloat way". Virtualization really means that it is more difficult for someone to get full control over your computer.

>>124 Virtualization is the bad way to do security. Let's get the Matryoshka doll analogy: you want something to be safe. Will you add more dolls to cover the layer 0 (that's where your secret stuff is) or do you want only one doll, but with much stronger security? You can still say that you want more dolls, but you're not considering one factor: the materials cost. When you put too many dolls there's too much effort to do these dolls and to maintain their security and it turns to be simple to get an exploit when you have so many "materials" (code). The right way to do it is to fortify the layer 0 with better materials, not more materials (in this analogy it would be the equivalent to use sandboxes), not to put more, entire, dolls. You can also check this thread: http://marc.info/?l=openbsd-misc&m=119318909016582&w=2 Together with the above said, the x86 virtualization is not a real virtualization. Different from other architectures like SPARC64 that had a special chip for virtualization, x86 runs virtualization on microcode. Since microcode is absolutely close source, you don't know what the fuarrrk is going on. >There are great advantages in some of those. I can see only one advantage these, and it's on Tails: the non persistence of changes. But, you can do that with other systems too, especially the runs that use ramdisk.

>All these things about Whonix, and Qubes and Tails seems kinda idiot to me Yes, it's kinda idiotic to put the system/applications in a virtual machine, rather than actually harden them. In fact, we do have underlying groundwork, such as the famed PaX/Grsecurity kernel, and recent plagiarism adoption by KSPP is a great improvement of security; userspace/compiler hardening is essential also, we already have NX, stack-protector-strong, RELRO, D_FORTIFY_SOURCE, PIC/PIE. A sandbox/virtual machine can't provide these protections, we need more of them, and we need to adopt them to systems. And systemic audits are always needed. But please understand, even with these hardening, sandboxing/virtual machine is a requirement if higher degree of security is needed, in order to restrict the damage of an exploit if it has happened. Instead of a single point of defense, we need defense in depth. Also, a PDF reader code execution can do everything a user can. Given how our operating systems, applications are designed, there is really no better way to achieve privilege separation and reasonable level of security, especially on the desktop system. Yes, if the applications and operating systems adopt a different approach to security, it will be the elegant the completely solution, but we still need FireFox to browser the web and use a Unix-like system in a foreseeable future, that is what virtualization is coming for. This xkcd comic #1200 elaborates this problem well. Also, an attacker can do a lot of things, as everyone knows, it can implant a rootkit, but what less known is, they can also insert a permanent hardware (firmware-level) malware that almost nobody can detected because it starts before any OS kernels or even bootloaders. And all of these can be done remotely, by software exploits alone. So once you have been hacked, booting from Tails CD could still gives you a compromised system. There is no effectively countermeasures, at least on x86, besides virtualization. You really need to check the "x86 considered harmful" article by a main Qube dev. ps. link to a image and to the pdf cited: https://www.lainchan.org/sec/src/1492492344800-0.png https://www.lainchan.org/sec/src/1492492344800-1.pdf

>>126 I don't know... I understand your argument, but I think reinforce my previous one. >restrict the damage of an exploit That's why we need privsep and sandboxing. I do not disagree with the usage of privsep mechanisms, but I do disagree with the estimated 'security' people think virtualization will bring. If you need to restric the damage, don't throw thousands of LOC above the main system. That's why there is capsicum and pledge. >Instead of a single point of defense, we need defense in depth. My point is that, it's not depth. It's an illusion. If you put many lines of code, that can hardly be audited, above everything else, how is this going to help? Using a simples sandbox would be better, or, use better software that is simple enough to spot all the high risk bugs and that has privsep by default. >a PDF reader code execution can do everything a user can That's a issue for the pdf software, isn't it? Just use something better, like mupdf without the JS module and without the networking module, or, for the most paranoid, convert pdf to images then open it. >there is really no better way to achieve privilege separation and reasonable level of security, especially on the desktop system http://man.openbsd.org/pledge.2 >we still need FireFox to browse I, personally, don't. I use Links most of the time (on ion3 wm for tabs). But, I understand what you're trying to say... >And all of these can be done remotely Well, if you find some proof please send it on misc@openbsd.org It is possible to reflash your firmware with malicious code, but not remotely, unless you find some really nasty vulnerability. Also, firmware malware is not the worst. The worst is hardware trojans, that is the manipulation of the microarchtecture itself to defeat some functionality of the processor. That's way worst scenario than firmware or system vulnerability, since no one can verify that (there is some academic tests, but not really). >You really need to check the "x86 considered harmful" article by a main Qube dev. I'll check that, thanks. I can see myself support Qubes in the future if they go with seL4 VM, then that would be some interesting soykaf (even though it would still be susceptible to microcode attacks).

>>127 Capsicum is like kicking dead whales down the beach however, Pledge is the only thing that is being implemented on large scale. There also is Seccomp for Linux but it isn't being used on large scale few applications use seccomp where Pledge is being used in the entire base already. I think only OpenBSD does virtualization right with vmm/vmd with Pledge? What i miss on OpenBSD is a RBAC like grsecurity has. Anyway i don't think Xen is the right way but OpenBSD can indeed be improved here and there. Just a reminder that most applications aren't built with security in mind so there is very little priv seperation, the only ones actually doing it are OpenBSD applications ( OpenSSH, OpenSMTP, ect )

>>125 Sounds nice in an ideal world where everyone can run the Muen seperation kernel, but in the real world we have linux which is a big security vulnerability, and windows which is an even bigger one. >>127 >big = insecure many short, easily-understood programs are actually very vulnerable, and many giant projects are airtight. What matters is how well those are designed and maintained, not how tiny they are. I encourage everyone here to look into genode, which makes sandboxing and application seperation a core part of the OS architecture. I firmly believe it's the future of OS design.

New publication about VM escape: http://www.phrack.org/papers/vm-escape-qemu-case-study.html VM is not security. It's bloat with a mask of a security guard.

>>392 VM escapes are much, much rarer than privescs

>>525 That there haven't been many VM escapes doesn't mean that there aren't there, in fact there have been many VM escapes in things like Xen.

>>541 yes, but other software vulnerabilities are much more common. I'd reckon by at least an order of magnitude. No, VM's aren't "perfect" security. But neither is anything else, and they're better than other things.

I think alot of you might have missed one of the major reasons why things like tails and more specifically qubes might be used. Hardening and virtualization both have the same problem. Given enough time unless the software is known to be secure with mathematical proofs to back it up someone will figure out a privesc. The point of qubes when it was first mentioned to me was not just sandboxing it was to limit how much of the hardware the software could see so that you could virtualize windows or something and not let it see your other hard drives or sections of ram. This control over what the programs can see is the real power of virtualization. Privilege escalation is not the real problem it's persistence and data theft. If you are using something like tails which runs in ram and can't persist changes (unless they fuarrrk with the hardware which is what qubes is trying to prevent) then even if you get owned you don't stay owned. If there was a solution out there that combined non persistence, containerization and some kind of file access/heuristic analysis of what's going along with frequent rolling reboots of the machines to known clean images it would stop most non government attackers. The problem with that kind of solution is that programs need data to run and any running program that gets exploited will have access to the data it's using. So on top of all of that you need some insane firewall. Now call me crazy but I think a solution is to limit inbound/outbound messages to just ascii characters and mostly plaintext messages.

Does anyone have a full list of Windows 7 updates to avoid? I want to patch my computer because of the fairly recent NSA/CIA tool dump, and I don't want to install a bunch of telemetry enabling horse soykaf at the same time.

>>548 It's closed source. You can't know.

>>549 I recall seeing a list of some updates to avoid before. I would assume that it was gathered by installing single updates and then monitoring outgoing connections.

>>392 >VM is not security Then, what's security for you? Do you imply that other security measures aren't pottentially vulnerable to circumvention? No security measure is perfect, and no one will ever be, since security isn't the ultimate goal, rather it's an endless race of arms between parties involved. That being said, i can see a point in calling VMs a bloat, however as a security measure it's pretty decent in most cases. There's a ton of exploits and malware that don't aim for VM escape/exploitation, but otherwise disastrous, which ran on your host would compromise it to the last bit, while in VM they will do nothing to it. You still call it a lack of security?

>>392 Do you seriously not understand how security works? >>549 Just because it's closed source doesn't mean it turns your entire computer and home network into an unobservable black box. Why does it feel like more and more posters here (and on boards about technology on other imageboards) just parrot what they hear without actually understanding what they're talking about?

Fellow WinLain here, is this what you're after? https://nullrefer.com/?http://www.angelfire.com/comics2/fatboy9175/ Also dumping (or rather linking) a decent guide on securing and hardening Windows systems https://nullrefer.com/?https://adsecurity.org/?p=3299 (no, it doesn't have anything to do with advertisements, "ad" stands for "Active Directory" here) >>561 It's an imageboard thing in itself, but I keep noticing such kind of stance among anons more and more, often with a mix of ignorance and being on a high horse towards anyone who doesn't use [put obsessively worshipped thing here] and while i wholeheartedly love FOSS, use it, and can agree with the fact that it is in many ways waaaay more secure by definition, I hate how i.e. Windows users are being ignored most of the time, because someone dared to interrupt GNU fapping session (well, i'm exaggerating, it's not always the case though). Everyone deserves some love, regardless of what OS they're using [] except s4s-style nonfat-soykaf drinkers who contribute nothing []. If the only thing you have to say is >It's proprietary, you can't know It's being a captain obvious (mostly for the proprietary part). It's not like that anon who asked isn't aware of this fact, and if such kind of reply was all he's hoping for, he wouldn't have posted it at all... right? Enough of my ranting, enjoy the links

>>563 >It's an imageboard thing in itself It wasn't always that way. I remember when I first found /k/ on 4chan, and the posters there would rail on people who would repeat claims without understanding them. I want to say the problem is related to people coming to imageboards for reasons other than interest in discussing whatever the topic of the board they're posting on is (such as the people who come for the memes, just because they want to be on an imageboard, or to push activist bullsoykaf) and just repeat things in an attempt to fit in, but can't really present any hard evidence to support that.

>>559 >Then, what's security for you? Simpler priviledge separation, like pledge(8) >Do you imply that other security measures aren't pottentially vulnerable to circumvention? No. What I mean is that you can achieve the same level of security with very few lines of code, and the bloat of the VM code could be exploitable, because it requires too much work and maintenance than most open source projects have the ability to support. Unless, of course, where's talking about something like seL4, as I said above.

>>568 >Simpler priviledge separation, like pledge(8) Suppose someone finds a vulnerability in your kernel. I assure you, unless you're using sel4, they exist in multitudes. What then? > What I mean is that you can achieve the same level of security with very few lines of code, >same level of security Nowhere near the same level. A VM protects the host computer from all but a very small subset of attackss, application sanboxing can only protect against userland-level attacks.

>>125 Yes, nested VMs are re torded However, a VM itself is basically just a sandbox on steroids. Yes, given VT acceleration and MMU hackery and all that, it's probably both diluted and still has room to be slimmed down, but that doesn't make them any less awesome and useful

>>392 VM is indeed legitimate for security It's like, however secure you had before, PLUS ONE Instead of it being more attack "surface" it's basically the equivalent of >it was just a hologram (except viable and not cheating) for when the hacker hacks his way to root

hardware whonix-like gateway on hardened BSD MIPS-based machine and DPI firewall before it to ensute tor traffic is actually tor traffic and not a plaintext siphoning to compromised bridge.. >>123 >Virtualization doesn't mean more security. It mean "security done the bloat way" All virtualization larpers masterbate to amounts of code underlying within everything because "muh auditability". They praise Xen for 100k lines of code instead of 5 million in Linkeks kernal, not mentioning that I cite Rootkowska, an author of Qubes OS that has a bloated virtual spaces manager on top of Fedora dom0 kek. After all, hardware-related exploits exist and all modern virtualization is done within hardware-bound instructions. An ideal microkernel with proper MAC would be equal to what virtualization does to be honest. >>125 Real world analogies are similar to comparing urine against feces, they mean nothing, unowotimsayn. >SPARC64 that had a special chip for virtualization >x86 runs virtualization on microcode. What's the difference between dedicated chip with microcode or microcode that runs within certain CPU areas? Silicon size. >>126 You can not harden proprietary Windows software or malicious javascript within your furry browser, this is what Qubes was made for. >Also, a PDF reader code execution can do everything a user can. And changing date on an iPhone sends it to a bootloop. >xkcd comics as arguments ever >>127 >convert pdf to images then open it. A bug exploits converter to run arbitrary code on your system tl;dr: in order to exploit Loonicks malware needs to find a bug within it's 6 gazillion kernel modules and SystemD hooks. In order to exploit a virtual machine, it needs to exploit the virtual kernel and then the super hardened hypervisor kernel just to find out that this computer has no network stack and uses RS-232 to interface with semaphore line. >inb4 hurr-ba-doodle-durr we were pretending to be retarded, virtualization is not for security but to run obscure old operating systems without compatibility issues

>>3364 >All virtualization larpers masterbate to amounts of code underlying within everything because "muh auditability". They praise Xen for 100k lines of code instead of 5 million in Linkeks kernal, not mentioning that I cite Rootkowska, an author of Qubes OS that has a bloated virtual spaces manager on top of Fedora dom0 kek. I think you are getting confused. In Qubes, Fedora is not part of the TCB. Fewer lines of code means fewer bugs. >tl;dr: in order to exploit Loonicks malware needs to find a bug within it's 6 gazillion kernel modules and SystemD hooks. In order to exploit a virtual machine, it needs to exploit the virtual kernel and then the super hardened hypervisor kernel Maybe you should read that xkcd comic again. Security is not just a vertical race to root. That's why Qubes is a well rounded security project unlike, say, OpenBSD which only focuses on a single axis. >just to find out that this computer has no network stack and uses RS-232 to interface with semaphore line. Don't make things up. Also >hardened BSD Garbage. >MIPS-based machine Utter garbage. >and DPI firewall before it to ensute tor traffic is actually tor traffic and not a plaintext siphoning to compromised bridge.. This is the most retarded thing I've heard. Your "whonix" gateway has access to anything on the internet by virtue of talking Tor. Even if you only let through traffic to specific entry guards. Also also Learn to fuarrrking spell.