Hardening Qubes-Whonix

Qubes-Whonix
75

I’ve decided to go for a general checklist of the most important ‘hardening’ ideas as a wiki entry instead and mark some items as ‘Qubes-Whonix or non-Qubes-Whonix only’.

This fits better with the Security wiki and it’s nice to have a quick reference for users who don’t want to trawl the documents and discover various things they could (or should) have done, but missed.

See the suggested entry further below. If you’re happy with it, I’ll post it straight away.

Ideas I’ve discarded:

Running hardened alpha Tor Browsers if adventurous due to near-term (December) sandboxing opportunities;

→ Scrapped this idea, since we now know sandboxing works with any Tor Browser series.

following Qubes guideline for MAC spoofing

→ Scrapped this idea.

Although this is now easy using a Debian-9 template and the latest Network Manager (see updated Qubes docs), MAC spoofing is NOT recommended for home PCs or laptops from my reading e.g. TAILS docs, because it hurts your anonymity. So, this can’t be recommended unless one is using a laptop from various locations. Plus, MAC addresses are largely hidden, especially with use of VMs and Whonix.

Anyhow, based upon the lengthy discussions in this thread and input from various people, I think this entry is now suitable for the Security wiki:

#General Hardening Checklist

It is possible to significantly harden your platform and improve the chances of successful anonymous activity. This depends upon a user’s skill level, motivations and available hardware. This checklist is intended to provide a quick overview of some of the most important issues, categorized by difficulty level (easy, moderate and difficult).

Note: some of these recommendations are Qubes-Whonix or non-Qubes-Whonix specific; they have been marked accordingly.

###Easy

Blogging

  • To blog anonymously, follow all the Whonix recommendations to minimize threats of keyboard/mouse biometrics, stylometry analysis and other covert channels. Surfing Posting Blogging - Whonix

Disabling/Minimizing Hardware Risks

  • In Qubes-Whonix, only use a mouse and keyboard utilizing PS/2 ports (not USB ports) to prevent malicious compromise of dom0 (PS/2 adapters and available controllers are required);
  • Do not enable audio input to any VM unless strictly required and consider disabling microphones where possible (muting on the host) or unplugging external devices; Computer Security Education - Whonix
  • Preferably detach or cover webcams unless they are in use; and Computer Security Education - Whonix
  • Avoiding using wireless devices, since they are insecure. Computer Security Education - Whonix

Mandatory Access Control

Passwords and Logins (Qubes-Whonix Only)

  • Store all login credentials and passwords in an offline vault VM (preferably with KeypassX) and securely cut and paste into the Tor Browser; and
  • Copy something else into the clipboard after pasting so the password is purged and cannot be accidentally pasted elsewhere.

Tor Browser Series and Settings

  • Consider using the ‘hardened’ Tor Browser series for additional ALSR memory protections;
  • Default search settings to the DuckDuckGo .onion hidden service;
  • Select ‘ClearClick’ protections in NoScript;
  • Run the Tor Browser Security Slider in the highest position;
  • Disable Javascript by default and only allow sparingly for trusted sites;
  • Use .onion hidden services where possible to stay within the Tor network; and
  • Follow all other Whonix recommendations for safe use of the Tor Browser. Tor Browser Essentials

VirtualBox (non-Qubes-Whonix Only)

Whonix Updates

###Moderate

Create a USB Qube (Qubes-Whonix only)

  • Prepare and utilize a USB qube to protect dom0 from malicious USB devices. Redirecting…

Networking (Qubes-Whonix Only)

Newer Kernels (Qubes-Whonix Only)

  • Install newer kernels to benefit from additional protections (including grsec elements) being mainlined by the kernel hardening project. Redirecting…

Onionizing Repositories

Sandboxing

Secure Back-ups (Qubes-Whonix Only)

Time Stamps (non-Qubes-Whonix only)

###Difficult

Anti-Evil Maid (Qubes-Whonix only)

Chaining Anonymizing Tunnels

  • Avoid this course of action; the anonymity benefits are unproven and it may actually hurt your anonymity and security. Combining Tunnels with Tor

Disposable VMs (Qubes-Whonix Only)

  • Run all instances of the Tor Browser in a DispVM - preferably uncustomized to resist fingerprinting. Qubes Disposables

Email (Qubes-Whonix Only)

  • Use split-GPG for email to reduce the risk of key theft used for encryption/decryption and signing. Split GPG | Qubes OS

Grsec Templates

Host Security (non-Qubes-Whonix Only)

2 Likes