Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subgraph OS: Adversary resistant computing platform

subgraph.com

Post reply on HN
Print view View original

61–70 of 88 posts

Re: Subgraph OS: Adversary resistant computing platform

#61

Post by saganus »

nickpsecurity wrote: post #52
xdma wrote: post #41

Earlier quoted context omitted.

Subgraph does lots of things Qubes doesn't, and this will only increase over time. For example: an experimental Subgraph OS feature[1] is to, by mandatory sandbox policy, prevent a specific application from connecting to anything except TLS endpoints, or specific TLS endpoints while adding certificate pinning outside of an application and performing extra-app validation. Could be useful over Tor or public wi-fi, righ…

" Qubes is not going to build this, yet I am running a prototype of it on my SGOS dev laptop." You can do that in Qubes or the architecturally-superior GenodeOS. Genode is FOSS so nothing stops you. Any programs computing with secrets can run in an isolated partition to prevent leaks. Similar with protecting integrity of backups like in some partitioned filesystems. And you get the benefits of subgraph on the inside.

Sorry for being OT but do you mind explaining a bit what exactly does Genode do/is? I read about it in their web page but I'm not sure I understand the difference between "an OS" and "an OS framework".

It seems that they are trying to create an architecture with all components compartmentalized, but it says it can run Linux and Windows so I'm guessing it's virtualizing something at some point.

Also, they say they have a reference implementation of the architecture, so I guess the real work is defining that architecture and making an API compatible with what modern OS's do so later on they can jump on board and make it Genode compatible?

It sounds very interesting but it feels like I'm misunderstanding a lot and thus hitting a wall here due to lack of knowledge so any pointers are appreciated :)

Re: Subgraph OS: Adversary resistant computing platform

#62

Post by tptacek »

delinka wrote: post #60
Animats wrote: post #3

They try to avoid saying it, but it's mostly a patched Linux.

After reading the article, and reading replies to you, I still have to guess whether this is a Linux kernel or something else. And I still don't understand why they don't mention this on their site. The talk of "kernel with certain patches" has me guessing it is indeed Linux.

They are practically screaming grsec/PaX from the rooftop. It's even in the diagram! What else could they possibly be?

Re: Subgraph OS: Adversary resistant computing platform

#63

Post by nickpsecurity »

saganus wrote: post #61
nickpsecurity wrote: post #52

Earlier quoted context omitted.

" Qubes is not going to build this, yet I am running a prototype of it on my SGOS dev laptop." You can do that in Qubes or the architecturally-superior GenodeOS. Genode is FOSS so nothing stops you. Any programs computing with secrets can run in an isolated partition to prevent leaks. Similar with protecting integrity of backups like in some partitioned filesystems. And you get the benefits of subgraph on the inside.

Sorry for being OT but do you mind explaining a bit what exactly does Genode do/is? I read about it in their web page but I'm not sure I understand the difference between "an OS" and "an OS framework". It seems that they are trying to create an architecture with all components compartmentalized, but it says it can run Linux and Windows so I'm guessing it's virtualizing something at some point. Also, they say they hav…

There's a lot of conceptual similarity to Nizza architecture that's explained thoroughly in this paper:

https://os.inf.tu-dresden.de/papers_ps/nizza.pdf

From there, Genode is a different take on the same concept even using some of the same components (eg Nitpicker GUI). In both, there are various components integrated that might be used in other projects. A specific set of components together makes up a desktop. A different set might make an appliance. A different set a TV box. Much like how you build your Linux distros with packages and source files but these components can run on the microkernel communicating with each other and operating within their resource-management scheme. That scheme is hierarchical where each process spawns others with control of their memory or resources. Includes ways to let them communicate in such a way that your attack surface is mostly restricted to that composition.

Feske, the designer, gives specifics here:

http://www.slideshare.net/sartakov/genode-os-framework

Nitpicker by itself is worth looking at if you're unfamiliar with trusted paths. Too few systems have a good one.

https://os.inf.tu-dresden.de/papers_ps/feske-nitpicker.pdf

Re: Subgraph OS: Adversary resistant computing platform

#64

Post by brl »

dlevi wrote: post #57
eddyl wrote: post #55

Earlier quoted context omitted.

> Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes. According to Joanna Rutkowska, developer of Qubes: "Unlike Qubes OS, Subgraph doesn't (cannot) isolate networking and USB stacks, or other devices and drivers."[1] [1] https://secure-os.org/pipermail/desktops/2015-October/000002...

Thanks for that - it pretty much answers my question. In this case it seems that Qubes exposes less attack surface.

I'm from Subgraph and I disagree.

On Qubes OS the networking VM runs a standard Linux kernel with no special security hardening at all apart from the simple fact that it runs in a separate Xen VM. If an attacker is able to compromise NetVM, they may not have direct access to user data, but they have dangerous access to perform further attacks:

  - Attacks against hypervisor to break isolation
  - Side channel attacks against other Qubes VMs to steal cryptographic keys
  - Interception and tampering with networking traffic
  - Attacks against any internal network this Qubes OS computer connects to.
So if you assume that remote attacks against the Linux kernel networking stack are an important threat, the consequences of a successful attack even against Qubes are pretty bad.

Subgraph OS hardens the Linux kernel with grsecurity, which includes many defenses against exploitation which have historically prevented local exploitation of most security vulnerabilities against the kernel. Exploiting kernel vulnerabilities locally is so much easier, probably never less than an order of magnitude easier. It's so rare to reliably exploit kernel vulnerabilities remotely even against an unhardened kernel that teams present papers at top security conferences about a single exploit:

https://www.blackhat.com/presentations/bh-usa-07/Ortega/Whit...

I know it's contentious to say so, but I don't believe that anybody will ever remotely exploit a kernel vulnerability against a grsecurity hardened Linux kernel, especially since RAP was introduced:

https://grsecurity.net/rap_announce.php

The threat of remotely attacking the Linux kernel through the networking or USB stack was always low in my opinion, but as the threat approaches zero it raises some questions about how justifiable the system VMs are in Qubes OS considering the system complexity and usability impairment they introduce.

Re: Subgraph OS: Adversary resistant computing platform

#65

Post by brl »

dlevi wrote: post #50

Does Subgraph isolate USB and network? The isolated serviceVMs for USB and network are in my opinion a very strong value proposition of Qubes. Furthermore, is Subgraph supposed to be an OS for everyday use, like Qubes, or just for anonymous usage like Tails or Whonix? If its the former I don't understand why all traffic should be routed via Tor by default - it wouldn't make sense to route non-anonymous traffic (banki…

> I don't think there are any amnesic features like in Tails nor strong isolation between gateway and workstation to prevent IP leaks like in Whonix.

Subgraph sandboxes run in a network namespace with no direct access to the network or ability to view any of the physical network interfaces on the system. There is no way for an attacker to send network traffic directly or to discover the real IP address of the system without breaking out of the sandbox.

Re: Subgraph OS: Adversary resistant computing platform

#66

Post by mad_titan »

nickpsecurity wrote: post #51
tptacek wrote: post #9

Earlier quoted context omitted.

The tipoff that it's not L4 is that it's a desktop OS that runs applications.

You can do a desktop on a microkernel that runs Linux in user-mode or with hypervisor support. Critical stuff stays outside directly on microkernel. It's what every vendor of separation kernels does. Two examples from commercial and FOSS that's similarly alpha: Sirrix TrustedDesktop on Turaya: https://www.sirrix.com/content/pages/trusteddesktop_en.htm Turaya's architecture: http://www.perseus-os.org/content/pages/Ove…

Have you use any of those commercial offerings? I've honestly never heard of them before. Can i, as a regular consumer go purchase one of those operating systems and use it on my laptop?

Re: Subgraph OS: Adversary resistant computing platform

#68

Post by nickpsecurity »

mad_titan wrote: post #66
nickpsecurity wrote: post #51

Earlier quoted context omitted.

You can do a desktop on a microkernel that runs Linux in user-mode or with hypervisor support. Critical stuff stays outside directly on microkernel. It's what every vendor of separation kernels does. Two examples from commercial and FOSS that's similarly alpha: Sirrix TrustedDesktop on Turaya: https://www.sirrix.com/content/pages/trusteddesktop_en.htm Turaya's architecture: http://www.perseus-os.org/content/pages/Ove…

Have you use any of those commercial offerings? I've honestly never heard of them before. Can i, as a regular consumer go purchase one of those operating systems and use it on my laptop?

You probably have to buy hardware from them if the drivers are on the microkernels because I doubt they're doing many ports. I haven't used the product as I had custom stuff. Here's a video of the academic prototypes that both the commercial stuff and Genode drew from if you're wondering about performance. That's on a Core Duo 2 @ 1.6GHz. The L4Linux VM's were fast.

https://www.youtube.com/watch?v=x9IwtY9gqCg

Re: Subgraph OS: Adversary resistant computing platform

#69

Post by formula1 »

xdma wrote: post #19
formula1 wrote: post #17

Ill give it a shot. Ive been feeling quite vulnerable on 16.04 due to the absurd amount of unfixed bugs. I have a couple of questions - its mentioned that it does not have access to documents and downloads within the user folder. When it wants/needs read access, how am I told? - if it doesnt have access to these folders, does it only write to its own subset? - is it possible to make my home downloads folder an aggreg…

These are great questions. We have a Gnome shell plug-in to move files into sandboxes while an application is running. Certain applications also have shared directories (e.g. "Downloads/TorBrowser", "Documents/LibreOffice"). This is a UX work in progress though, neither of these are adequate, though together they're workable. re: Applications and network access: we have an application firewall, unique to Linux-based…

Will do! Im very excited for this. Containerization and safety is a very important problem to me. Im not particularly interested in running a docker instance or a vm just to use an application. And if I do, id prefer it being automated.

Re: Subgraph OS: Adversary resistant computing platform

#70

Post by hrehhf »

brl wrote: post #64
dlevi wrote: post #57

Earlier quoted context omitted.

Thanks for that - it pretty much answers my question. In this case it seems that Qubes exposes less attack surface.

I'm from Subgraph and I disagree. On Qubes OS the networking VM runs a standard Linux kernel with no special security hardening at all apart from the simple fact that it runs in a separate Xen VM. If an attacker is able to compromise NetVM, they may not have direct access to user data, but they have dangerous access to perform further attacks: - Attacks against hypervisor to break isolation - Side channel attacks aga…

I agree with your comments about grsecurity making the kernel much more secure. However your comments about remote exploits and Qubes are somewhat contradictory. You claim that a remote kernel exploit is very rare/difficult, therefore the Qubes NetVM must be very difficult to attack because it runs no applications or services. It functions as a router and does essentially nothing else. By your own argument it would be very difficult to attack the NetVM. It is only the AppVMs or any others which run applications that are vulnerable, and if these are attacked, Qubes's design will likely prevent a permanent backdoor from being installed in that VM and make it difficult for the attacker to gain access to any of the other AppVMs.

I still think Subgraph looks promising and I look forward to your future work.

Post reply on HN