Hackfest - Level UP

Abstract:

Qubes OS is known as one of the most secure OS. But what is it actually like to use, customize and attack it? Whether you're a beginner or advanced in the cybersecurity field, join this session to explore this OS and the many amazing features it offers. Finally, stick around for a live bootkit demonstration on a Qubes OS computer, targeting a universal flaw affecting almost any computer, leading to a remote root shell, and disk encryption passphrase exfiltration.

Outline:

1. What is Qubes OS? (~20 mins)

• A reasonably secure OS and a little more
• Recommended by Edward Snowden
• Security by isolation, everything is a VM
• Template system with persistence levels
  • Standalone
  • Template
  • Disposable
  • Bind-dirs
• Any operating systems
  • Default
    • Fedora
    • Debian
    • Whonix (Workstation + Gateway)
  • Any others like:
    • Windows
    • Unix
    • BSD family
    • TempleOS (If you want...)
• Integrations
  • Main visual OS = also a VM (Admin VM, dom0)
  • Seamless windows for other VMs
    • Colored borders
  • Qubes App menu
    • VMs and their apps
  • System Tray with integrated icons from vms
  • Inter-vm
    • Copy-paste
    • File transfer
      • Open in disposable VM
  • USB and PCI devices
    • Isolate USB controller and devices in specific VMs (ex: sys-net, sys-usb)
    • Attach USB and PCI devices to desired VMs
    • Split block devices across different VMs
• NetVMs and ProxyVMs
  • sys-net + sys-firewall
  • sys-whonix
• Idempotent Infrastructure-as-Code
  • Saltstack
• Qrexec
  • Secure inter-VM communication

2. Practical Customizations & Workflows (~15 mins)

Anything, this is linux ... and a hypervisor...
A few examples of my customizations
- sys-backup
- Custom backup system with borg
- Backs up only the desired paths in the desired VMs
- Incremental backups to save space and be able to go back in time
- + saltstack system = Fully redeployable environment on a brand new Qubes OS using one command
- sys-vpn
- Securely route all traffic through a VPN
- sys-auth
- Central auth
- Currently used for fingerprint auth
- Could be integrated to all VMs PE
- vault-keepassxc
- sys-keyboard

3. Live Bootkit Demonstration & Physical Defenses (~15 mins)

Qubes OS is very secure for software-side vulnerabilities and attacks but what about physical ones?
I will do a live bootkit demo on a dedicated Qubes OS computer to gain remote administrative access and exfiltrate the disk encryption passphrase.
I will present the security measures used to prevent physical attacks.

Talk Type:

50 min talk

What you expect from attendees?:

I expect attendees to gain:
- A clear understanding of Qubes OS architecture and customization
- Many concepts related to security and architecture
- A practical understanding of software vs physical threats