If I were using the configuration below and an adversary had used a zero-day vulnerability to gain access to my workstation, implant malware, escape the VM, and execute another zero-day, would Kicksecure mitigate the attack?
Here is the setup:
[Kicksecure] > [Whonix-Gateway] > [Whonix-Workstation] > [Tor Browser] > [Internet]
Note: NO Physical Isolation
Referring to Comparison with Others wiki page (Overview Section):
Would this protect against attack #6 and #7? They would have to get malware on the workstation, leak into the gateway, which would then breakout into Kicksecure. They would then need another exploit to reveal information (ie. IP address) to identify their target.
That really depends on the type of vulnerability. Hardening by Kicksecure might mitigate some vulnerabilities.
For example, Quote GitHub - Kicksecure/security-misc: Kernel Hardening; Protect Linux User Accounts against Brute Force Attacks; Improve Entropy Collection; Strong Linux User Account Separation; Enhances Misc Security Settings - https://www.kicksecure.com/wiki/Security-misc
All mitigations for known CPU vulnerabilities are enabled and SMT is disabled.
Which might help mitigating side-channel attacks, which are not a VM escape but also very dangerous since with some side-channel attacks the VM can snoop information from the host.
But no defense is perfect. I don’t think an easy “yes” is conceptually possible here. It would require security research to check which past Virtual machine escape - Wikipedia vulnerabilities would have been or could have been prevented through any realistic hardening that Kicksecure can apply.
This question seems mostly unspecific to Whonix.
For more Kicksecure specific questions, please move over to: