Re: [qubes-users] Installation security : Usb optical vs sata optical vs usb drive

2018-01-02 Thread Unman
On Mon, Jan 01, 2018 at 09:20:46PM -0800, mmm...@gmail.com wrote:
> So from the installation security guide I read the following:
> "Use a USB optical drive.
> Attach a SATA optical drive to a secondary SATA controller, then assign this 
> secondary SATA controller to an AppVM."
> 
> And for USB Drive:
> "Untrustworthy firmware. (Firmware can be malicious even if the drive is new. 
> Plugging a drive with rewritable firmware into a compromised machine can also 
> compromise the drive. Installing from a compromised drive could compromise 
> even a brand new Qubes installation.)"
> 
> Do usb optical drives not also have the same problem firmware wise?
> 
> What about sata?
> 

I remember some years back playing with WD hard drives, and reflashing
the firmware: it was possible to effectively engineer an exploit that
could spread across disks, and infect hosts.
We spent a little time working on the controllers, before we realised
the obvious - that by that stage the game was already lost. If you were
inside the box you had control anyway.

The principal risk in USB is exactly it's versatility and
accessibility. (I don't include eSATA and eSATAp here.)

So Yes, USB optical drives carry the same risks identified under the
USB drive heading.And it Is possible to attack SATA controllers, but far
less likely than for USB.
And frankly, you have to trust *something*. When you come to install
Qubes, you are trusting that your hardware isn't already backdoored, as
made clear in the first para.

unman

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/20180102232047.cjoguybtznzkqmi3%40thirdeyesecurity.org.
For more options, visit https://groups.google.com/d/optout.


Re: [qubes-users] Installation security : Usb optical vs sata optical vs usb drive

2018-01-02 Thread 'Tom Zander' via qubes-users
On Tuesday, 2 January 2018 06:20:46 CET mmm...@gmail.com wrote:
> So from the installation security guide I read the following:

> And for USB Drive:
> "Untrustworthy firmware. (Firmware can be malicious even if the drive is
> new. Plugging a drive with rewritable firmware into a compromised machine
> can also compromise the drive. Installing from a compromised drive could
> compromise even a brand new Qubes installation.)"
> 
> Do usb optical drives not also have the same problem firmware wise?

The problem with USB is that its universal. An attacker can make his device 
look like its anything USB based. For intance a rarely used web-camera.
The problem with that is that each brand has its own driver in the Linux 
Kernel and most of those drivers are hardly checked for exploits.

As such, an innocent looking thing that connects on USB could root your 
kernel with unknown exploits in any usb driver shipped by the kernel.
Just using a different firmware.
This is why there is the suggestion to have a sys-usb qube to isolate those 
drivers, should you fear your hardware in future falling in the hands of bad 
people.


> What about sata?

I hope someone else can answer this.
-- 
Tom Zander
Blog: https://zander.github.io
Vlog: https://vimeo.com/channels/tomscryptochannel

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/12053226.DA0ORK4ZM7%40cherry.
For more options, visit https://groups.google.com/d/optout.


[qubes-users] Installation security : Usb optical vs sata optical vs usb drive

2018-01-01 Thread mmm648
So from the installation security guide I read the following:
"Use a USB optical drive.
Attach a SATA optical drive to a secondary SATA controller, then assign this 
secondary SATA controller to an AppVM."

And for USB Drive:
"Untrustworthy firmware. (Firmware can be malicious even if the drive is new. 
Plugging a drive with rewritable firmware into a compromised machine can also 
compromise the drive. Installing from a compromised drive could compromise even 
a brand new Qubes installation.)"

Do usb optical drives not also have the same problem firmware wise?

What about sata?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/0f4ae4ef-1b58-474c-ba10-27b87188b409%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.