On Tue, Nov 22, 2016 at 1:30 PM, Steve Coleman <[email protected]> wrote: > ... APT is likely preventable if you have the tools to trap > their initial probes and exploits rather than log them, and while we watch, > the logs just get removed to clean up behind them. If we don't know to check > a log before its removed then what has it accomplished? The answer is it > needs to be event driven, and then perform active measures in response to > any detectable tampering. Not all is detectable, but a lot of it is.
There are two points here: 1) Make inspection event-triggered such that an exploit which cleans up after itself is observable (avoid ABA problem inherent to e.g. periodic scanning). 2) Make logged events immutable. #1 Is a challenging problem of what to hook and how to find signal in the noise. I do not have any answers here and would be happy to be pointed at relevant material. #2 (assuming we are interested in events within a VM and that the isolation properties of our hypervisor holds) can be solved by storing append-only logs in a separate VM, with data sent over existing qubes rpc system. There has already been discussion and PoCs of this in context of build logs, but it is applicable to much more as well. This is on my (and undoubtedly others') personal Qubes to-do list. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To post to this group, send email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CABQWM_AwhFQ621fjhEzfNnb9GmF8wup4pNbPJYdUY1n0sppbRw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
