This is the desktop of the Qubes operating system. 2
This is the best desktop operating system to enforce security 3
through isolation and compartmentalization, in my opinion. 4
It is still in its early days for the operating system, 5
but the concept behind it is excellent. 6
Qubes is a free and open source operating system 7
designed to provide strong security for desktop computing, 8
not for servers. 9
Qubes is based on the Xen hypervisor, 10
the X-Windows system and Linux. 11
It uses virtualization to enforce security domains 12
through isolation and compartmentalization. 13
This is good because virtualization 14
reduces the interfaces between security domains 15
but still allows the security domains to exist and communicate. 16
Perhaps the best way to think of it is as if you're running on your laptop 17
a Xen bare metal hypervisor 18
with some Linux kernel added 19
and additional code to handle communication 20
between those virtual machines, 21
plus some added security features, that's Qubes. 22
The user environments or the individual VMs 23
are based on Fedora, Debian, Arch Linux, 24
Whonix, Microsoft Windows, 25
and some others through what are called Qubes templates. 26
It's an operating system like any other that you download 27
and install on your laptop or desktop, 28
although it does take about three hours to install, it's quite a beast. 29
At the moment this is the latest version to download 30
and there's also a live CD version that you can get, 31
which you can download here if you want to try it out. 32
The live CD currently, as I'm recording, 33
doesn't have the latest features as the full install version, 34
but at least with the live CD you can test it out 35
and see whether it works with your hardware. 36
Note, I haven't found this live CD 37
or in fact installing it to work on virtual machines, 38
on any virtual machine, so you'll have to try it on bare metal. 39
Let's talk about kernel design for a minute. 40
So most operating systems, Unix, Linux, BSD, 41
use a monolithic kernel architecture, 42
which means lots of code runs with high levels of privilege, 43
or what is called the trusted computing base or TCB. 44
The TCB is all the hardware, firmware and/or software components 45
that are critical to a system's security, the trusted computing base. 46
If security bugs or compromise occur inside the trusted computing base, 47
it is very likely to jeopardize the security of the entire system. 48
Vulnerabilities in the kernel are especially dangerous, 49
so avoiding kernel vulnerabilities is especially critical. 50
Now what you can see here, 51
these are examples of monolithic kernel TCB components 52
that you have to trust are good. 53
These make up the attack surface of a monolithic kernel, 54
so the smaller the trusted computing base 55
the better for security, the smaller the attack surface. 56
So why is this relevant to Qubes? 57
Well, unlike VMware and VirtualBox, 58
which runs directly on a host operating system 59
like Windows or Debian, 60
Xen, which Qubes is based on, is a type one or bare metal hypervisor. 61
Qubes uses a microkernel 62
as the isolation enforcing code 63
reducing the attack surface. 64
Less code equals less potential security bugs, 65
equals less potential compromises, 66
or at least that's the theory, a good theory though. 67
An attacker must be capable of subverting the Xen hypervisor itself 68
in order to compromise the entire system, 69
which is more difficult to do 70
than subvert the host on a type two virtual machine 71
like VMware and VirtualBox. 72
There is no full host OS to compromise 73
with a type one hypervisor, like which Qubes uses. 74
This is an advantage for security 75
which Qubes has over VMware and VirtualBox. 76
Let's talk through the system architecture and the various VMs. 77
Qubes enforces security domains through different virtual machines 78
that establish isolation and compartmentalization. 79
Each of these boxes here represent different virtual machines 80
and different security domains. 81
No host operating system is used as Xen is the bare metal hypervisor. 82
So first let's look at the Xen hypervisor and administrative domain, 83
or the GUI domain, 84
which is this one here, 85
and this one here within the interface. 86
The host domain or Dom0 is the interface or GUI to everything else, 87
it's what you see when you are logged in. 88
Dom0 controls the graphics devices, 89
as well as input devices such as keyboards and mouse. 90
Dom0 is what shows what you're seeing now, this desktop. 91
It is used for running the X server 92
which displays this user desktop and the Windows manager 93
which allows the user to start and stop the applications 94
and manipulate the Windows. 95
Critically and for security, Dom0 has no network connectivity, 96
it has as little communication as possible with other domains 97
in order to minimize the possibility of attack 98
from a compromised VM. 99
As you can see, it uses KDE by default 100
and even for example if there was a bug in this KDE, 101
Dom0 isn't reachable for an attacker 102
as there is no network connection to it, 103
you can just view it in effect. 104
Because the Dom0 doesn't have network access, 105
only a few components need to be updated 106
which the administrator can install the command line. 107
To view applications running in each VM's domain, 108
Qubes provides the application viewer. 109
This provides a false impression for the user 110
that applications execute natively on the desktop, 111
as you can see here. 112
But they are in fact applications running in separate VMs. 113
Like this window here, 114
you can see the yellow window with a yellow border, 115
this is running in the personal virtual machine 116
and the green window here is running in the work VM, 117
but because of Dom0’s application viewer, 118
you have the false impression 119
that these are just separate windows within an operating system, 120
but in fact they are entire separate operating systems 121
as part of a virtual machine 122
that are isolated from each other by Xen and Qubes. 123
There is a network virtual machine or NetVM which you can see here. 124
Also represented in this diagram here, NetVM. 125
Networking is performed in a separate VM 126
which is great as a network layer 127
is a critical component for securing communication. 128
This VM protects you against exploits, 129
against things like your WiFi or Ethernet driver, 130
protocol stacks, or maybe your DHCP client, 131
and you could also use this to isolate your VPN 132
and make it available for other virtual machines. 133
So what I mean by that is the network VM enforces a VPN 134
and your other VMs are tunneled through that. 135
This prevents leakage. 136
Remember the Nightstand from the NSA Ant Catalog. 137
If as advertised, if we imagine this has some WiFi driver 138
or protocol stack type exploit that it's able to perform, 139
if you're using a normal operating system like Windows, Debian, 140
OSX, Linux, it's game over if they have that type of exploit. 141
With Qubes, because the network is isolated in the VM, 142
only the network VM would be compromised by an exploit like that. 143
The attacker would have to escalate his attack 144
to get to the other domains or other VMs. 145
So it's a great idea to have your network 146
as a separate virtual machine as well, 147
in fact it'd be great for all operating systems. 148
This does require that your hardware has IOMMU, 149
also known Intel VTD. 150
There is a firewall VM which enforces firewall rules between the network VM 151
and other domains so that you can configure the protocols, 152
the sources, the destination etc, 153
for the communication between the domains. 154
There are disposable VMs. 155
So adisposable VM, like the name suggests, 156
will dispose of the VM once it’s been used. 157
It is typically used for a single application like a viewer, 158
an editor, or browser. 159
You can open a suspicious attachment 160
with complete safety or browse the web 161
without storing any local history and preventing tracking. 162
It's a nice feature, I like it. 163
You simply just right click on a file and select open as disposable VM. 164
But it's more to mitigate a threat like malware and stop tracking 165
than to protect against local forensic examination, 166
like you get with the Tails amnesiac operating system. 167
You can use an optional Usb VM, 168
this would protect the operating system from things like bad USB 169
being plugged into the laptop or device. 170
The Usb VM sandboxes all the USB drivers and stack, 171
protecting you from bad USBs. 172
Data can then be carefully exported 173
from selected devices to other app VMs. 174
Application virtual machines, or app VMs. 175
App VMs are the virtual machines used for hosting applications 176
like your web browser, email client, pdf view, etc. 177
Each app VM is based on an operating system template, 178
the default being Fedora, the minimal template. 179
Others include, as you can see here, 180
Debian, Arch Linux, Ubuntu, Whonix, 181
that's the two gateway and workstation VM. 182
Also you have Windows here, so you can run office apps, 183
Word, Excel, or the things you can run in Windows. 184
To enforce these security domains, 185
applications are placed in separate application virtual machines, app VMs. 186
Here you can see examples of security domains, 187
banking, personal, untrusted, work, etc. 188
Because of this, what you see here, this application viewer, 189
there is an illusion that they are running on the same machine, 190
but they are in reality separate virtual machines. 191
You could be running a untrusted browser on hackme.com 192
and the browser for banking at the same time. 193
Any exploit from the untrusted browser wouldn't affect your banking VM at all. 194
Any security domain is labeled by color, you can see here, 195
each window is marked by the color of the domain it belongs to. 196
So here is the yellow, 197
which is personal, which you can see there. 198
There is a green, which is work, 199
so it's always clear, 200
visible as to which domain a given window belongs to. 201
They also allow for things like secure 202
copy and paste operations between VMs, 203
securely copying and transferring files between VMs, 204
and secure networking between VMs and the internet. 205
Qubes has inbuilt integration with TOR. 206
The Whonix gateway and workstation templates 207
come with Qubes and is a great option for using TOR and preventing leaks. 208
You get the benefits of Whonix privacy and anonymity, 209
and the host security isolation and compartmentalization of Qubes together, 210
which is a very good solution. 211
Hardware. 212
Because of its design, Qubes has a level of resistance to malicious hardware: 213
backdoor nicks, USB drivers, badBIOS, disks and SATA controllers. 214
Qubes also has some other security features, 215
sort of added bonuses. 216
You can split your GPG private key to help protect it, 217
some functionality to enable that. 218
And there is a pdf converter to make pdfs trusted effectively. 219
And I'm sure there'll be other added security features 220
as the OS matures. 221
So all of this sounds great, doesn't it? 222
So what are the downsides? 223
Why might you not just go out and install this now? 224
Well, the first one, 225
one of the big problems with Qubes is a lack of hardware support. 226
I have a number of laptops and in order to get it to work on my Sony Vaio, 227
I had to flash the BIOS, 228
which is a pretty scary prospect for most people, 229
even highly technical people, as it can break your laptop. 230
To take full advantage of all the cool security features, 231
you'll need a CPU that supports virtualization technology, 232
including both Intel VTX or AMDV, 233
which you can see here, 234
and Intel VTD or IOMMU, 235
which you can see here. 236
Plus a BIOS with a trusted platform module 237
to protect against the Evil Maid attack. 238
You're also going to need a fast CPU 239
and lots of RAM if you want to run a number of VMs. 240
Another issue is with the manufacturers. 241
They often make changes to the hardware of a computer 242
or laptop or device throughout the life cycle 243
of that laptop without notice, and yet it’s still called the same model. 244
And the features Qubes takes advantage of 245
are not features normally advertised by a vendor, 246
so you're not quite sure whether the laptop you're going to buy 247
is going to support the features you need it to support. 248
This is a clear barrier to entry for any new user and turns people away. 249
I recommend the live USB to test Qubes 250
to see if it will work on your hardware. 251
If you think about getting a laptop, 252
then have a look at this hardware compatibility list 253
for examples of devices that fully support Qubes 254
or partially support Qubes. 255
The list is growing and is actually much easier to understand now 256
that they've cleaned up the list, 257
because it used to be a bit of a mess. 258
But it's actually pretty good now and you can see quite clearly 259
what works and what doesn't work, 260
and has also added commentary on what they needed to do 261
perhaps to make it work. 262
But notice, this is community supplied, 263
so you know, it might not be 100% accurate. 264
So there's actually quite a few in there, 265
there's a lot more than there was the last time I looked, 266
which was a few months ago. 267
And actually, that's the model that I have with Qubes running on it. 268
And yeah, actually as it says here, 269
you had to flash the BIOS. 270
Yeah, so I had to flush the BIOS on mine to get it working. 271
But as you can see, there's quite a few that actually do work 272
and some of the ones on here are not that expensive. 273
You can get sort of an older laptop around $150, 274
$200, something like that. 275
There's also a Google Group for Qubes, 276
that's useful for help on what hardware might work 277
and getting your hardware to work. 278
And I think I mentioned it before, 279
it doesn't work in a virtual machine, 280
or at least I've not been able to get it to work in a virtual machine, 281
so you will need to install it on bare metal 282
or try the live USB, live CD option. 283
There is one current Qubes certified laptop, 284
which is the Librem 13, which you can see here, 285
which you can get Qubes preinstalled onto. 286
This was a crowdfunded privacy focused hardware, 287
I remember seeing it, this is where it was crowdfunded here. 288
And you can go and buy them from here, 289
but they're not that cheap, as you can see here, $1,499. 290
But obviously, that is because the laptop is niche built 291
to be privacy focused and sourced to be privacy focused. 292
Check that out if that interests you. 293
But from the hardware compatibility list, 294
you'll find laptops that are much cheaper 295
if you really want to try and get Qubes working. 296
Another issue to consider, 297
performance and compatibility could be a problem with Qubes, 298
especially if you're only going to have one device. 299
You're not going to be able to run games and high demand software 300
in virtual machines unless you've got a very very powerful machine, 301
or it's simply not going to be as good as a native machine 302
or the same native machine without VMs. 303
So this will probably just be for work, personal, 304
and a security laptop, 305
not a performance laptop or a performance device. 306
So what are my general conclusions? 307
Well, this is an operating system still in the early days, 308
but with the right hardware, 309
offers some unrivaled security features 310
for anyone technical enough to take advantage of them. 311
It is not designed like Tails to prevent local forensic examination, 312
it is for those most concerned about vulnerability exploitation. 313
Although it does have disposable VMs, 314
these are more to remove a threat than to mitigate local forensic examination. 315
It is a platform for security and exploitation prevention and isolation. 316
It is arguably the best security platform 317
for hosting another secure operating system. 318
Hopefully, the hardware compatibility issues will get easier 319
and I think they will, and Qubes has got a bright future. 320
I recommend you try it out and I recommend you use it, 321
especially if you have high security, privacy, and anonymity needs. 322
And to finish off, literally a few days ago of me recording this video, 323
this has been released by the Qubes guys. 324
This is tutorials on using Qubes, 325
so check that out, they're also on YouTube as well, 326
there’s quite a few of them and they're quite good, 327
thanks to Qubes team for a great OS, keep up the good work.