Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
I think i am fine against this, i have something called sipo and i have to set up that manually in my online bank. Dne pondělí 20. července 2020 13:34:12 UTC+2 unman napsal(a): > > On Sun, Jul 19, 2020 at 07:28:02AM -0700, tomas.s...@gmail.com > wrote: > > Yeah but, in that article: they talk about checking number, not actual > > account number. I never heard of some checking number honestly. I have > > recurring payments and it doesn't work that way, i have no checking > number. > > I don't even know what that means in my language... > > > > On Thursday, July 16, 2020 at 10:10:24 PM UTC+2, awokd wrote: > > > > > > tomas.s...@gmail.com : > > > > Wait a minute... How checking account number, can represent security > > > risk? > > > > > > https://www.consumer.ftc.gov/articles/0196-automatic-debit-scams > > > > > The convention here is not to top-post. > Please scroll to the bottom of the message before you start typing. Or > reply inline. > It only takes you seconds, makes it much easier to follow threads, and > cumulatively saves your fellow users hours. > Thanks. > > In that article *in English* there is no reference to "checking number", > every reference is to "checking account" information or number, so I > suspect something is lost in translation. > A checking account is a US name - we dont have them where I live, but we > have similar accounts, which allow for Direct Debits to be set up. > > The point is that if someone has your account number and sort-code, they > *may* be able to set up a payment out of the account without your > knowledge or authority. > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/2682ffba-24b5-4334-baa5-a54c5383b4f3o%40googlegroups.com.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
On Sun, Jul 19, 2020 at 07:28:02AM -0700, tomas.schutz...@gmail.com wrote: > Yeah but, in that article: they talk about checking number, not actual > account number. I never heard of some checking number honestly. I have > recurring payments and it doesn't work that way, i have no checking number. > I don't even know what that means in my language... > > On Thursday, July 16, 2020 at 10:10:24 PM UTC+2, awokd wrote: > > > > tomas.s...@gmail.com : > > > Wait a minute... How checking account number, can represent security > > risk? > > > > https://www.consumer.ftc.gov/articles/0196-automatic-debit-scams > > The convention here is not to top-post. Please scroll to the bottom of the message before you start typing. Or reply inline. It only takes you seconds, makes it much easier to follow threads, and cumulatively saves your fellow users hours. Thanks. In that article *in English* there is no reference to "checking number", every reference is to "checking account" information or number, so I suspect something is lost in translation. A checking account is a US name - we dont have them where I live, but we have similar accounts, which allow for Direct Debits to be set up. The point is that if someone has your account number and sort-code, they *may* be able to set up a payment out of the account without your knowledge or authority. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20200720113408.GA9057%40thirdeyesecurity.org.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
Yeah but, in that article: they talk about checking number, not actual account number. I never heard of some checking number honestly. I have recurring payments and it doesn't work that way, i have no checking number. I don't even know what that means in my language... On Thursday, July 16, 2020 at 10:10:24 PM UTC+2, awokd wrote: > > tomas.s...@gmail.com : > > Wait a minute... How checking account number, can represent security > risk? > > https://www.consumer.ftc.gov/articles/0196-automatic-debit-scams > > -- > - don't top post > Mailing list etiquette: > - trim quoted reply to only relevant portions > - when possible, copy and paste text instead of screenshots > -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/d9f905bd-f50c-4530-8f07-d0d4d7b66654o%40googlegroups.com.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
tomas.schutz...@gmail.com: > Wait a minute... How checking account number, can represent security risk? https://www.consumer.ftc.gov/articles/0196-automatic-debit-scams -- - don't top post Mailing list etiquette: - trim quoted reply to only relevant portions - when possible, copy and paste text instead of screenshots -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/45f37846-04e8-b96e-74c7-42c9a4b3a73f%40danwin1210.me.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
tomas.schutz...@gmail.com: > I am still looking into this, it is a lot of to think of. Do you know any > sites where is threat modeling for average user? I was trying dozens of > phrases... and i didn't find any threat model website. Everything only for > companies and developers, which were completely useless, i even banned > these words in my search... > "Threat model" is a generic security term. See https://www.macobserver.com/tips/how-to/security-build-threat-model/ for a short example of how to develop one. Very basically, identify what you want to protect, and against who/what. Then you can identify means to defend it. -- - don't top post Mailing list etiquette: - trim quoted reply to only relevant portions - when possible, copy and paste text instead of screenshots -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/e1d80bef-3c53-c54c-35f2-ad1862c4ad61%40danwin1210.me.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
On Friday, June 12, 2020 at 10:10:25 PM UTC+2, Steve Coleman wrote: > > > That being said, it is extremely difficult to reflash your BIOS when > running a general OS in the normal user context, and even more difficult > when running a virtualized system such as Qubes. So, if you can prevent the > machine from booting from any external devices then you have just raised > the bar for that adversary. > Wait what about internal devices ? Like disk. I can't disable NVME in BIOS unfortunately. Couldn't bios be reflashed from disk, before bootup ? So you say even Qubes doesn't protect against firmware viruses, if they are already there. As i am running main Windows and wanted to use Qubes from rom cd in external mechanic. So if i had already firmware virus, even that's very unlikely. Qubes wouldn't protect me in such scenario. Correct ? Than probably best idea would be to use my old computer, disconnect disks and use one of the Linuxes people above suggested just for online banking. And use dedicated mouse and keyboard for that and external cd rom. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/2ee3776b-f616-41fe-ba4c-8813012f017ao%40googlegroups.com.
Re: [qubes-users] Re: Does qubes protect against all firmware viruses ?
On Fri, Jun 12, 2020 at 2:35 PM wrote: > Well that's the problem indeed, knowing if you are clean from firmware > viruses in the first place. But i don't suspect i have firmware viruses and > i have new pc. It takes a lot of time and money and no one would bother to > infect specific user. I am no one. It could be used in attacks on multi > peoples, or if already some firmware virus existed someone could use it i > guess, i don't really know. Even probability is low. I am just acting > responsibly about this. If i can use Qubes, than why not right. So if i use > Qubes, using ROM optical disk in external mechanic. So i should be > generally safe, (nothing is perfect), even if i got firmware viruses > afterwards ? I can't unplug disks and disable all of them in BIOS, i am > using NVME and it is blocked by GPU vertical mount and it was insane to > plug it in the first place and doing that each time, it is not feasible. So > if i boot from live CD, not sure if viruses on hard disks could do > anything. And i won't be booting from Windows when live CD is in and it > would be ROM and i'll use external CD mechanic. > > Also i don't know what i was saying previously, but i can't dedicate old > pc for banking at least with Qubes, it doesn't work there. So i would be > using it on my main PC. But if i used other Linux on my old pc and > dedicated it only for online banking, that should be safe right ? Even if i > had it long time, so i could have potentially some firmware viruses, that > could impact security in future. Even if i had them and they didn't do > anything so far. I don't know. > There is not much one can do to protect against firmware viruses other than to try and prevent situations where someone can reflash your BIOS in the first place. Since the BIOS is initialized even before the software/OS gains control the malware code would already be resident in memory before the DVD booted that read-only media. The DVD drive can not even operate until the system initializes the BIOS that understands how the DVD drive even works, so if someone was able to reflash the eeprom then game-over even before the OS is even loaded. Any software loaded after the malicious code is in memory is of course subject to what that code wants to do with your system in the first place. That being said, it is extremely difficult to reflash your BIOS when running a general OS in the normal user context, and even more difficult when running a virtualized system such as Qubes. So, if you can prevent the machine from booting from any external devices then you have just raised the bar for that adversary. If you can prevent them from gaining physical access to the computer internals, as to attach a JTAG device, then that raises the bar even higher. Chances are the adversary would need physical access to the machine to pull this off, which means that any three letter agency or forign government would have to want you really really bad before they put someone to task to rig your physical machine like that. yes it's possible, but there are easier ways to do what they want than reflashing BIOS so this scenario is unlikely unless you are one very important person. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/CAJ5FDni_eF-YtLtxNHMWh-o08-EaLNd3mLJsfhz_1u6roMJnPQ%40mail.gmail.com.
