Potential improvements for Virtual Machine Cloaking - KVM

[7up]

@Patrick

cat /proc/cpuinfo

processor	: 0
vendor_id	: GenuineIntel
cpu family	: 15
model		: 107
model name	: QEMU Virtual CPU version 2.5+
stepping	: 1
microcode	: 0x1
cpu MHz		: 2688.042
cache size	: 16384 KB
physical id	: 0
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 0
initial apicid	: 0
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx lm constant_tsc nopl xtopology cpuid pni cx16 x2apic hypervisor lahf_lm cpuid_fault pti ssbd ibrs ibpb md_clear
bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs itlb_multihit mmio_unknown bhi ibpb_no_ret
bogomips	: 5376.08
clflush size	: 64
cache_alignment	: 128
address sizes	: 40 bits physical, 48 bits virtual
power management:

processor	: 1
vendor_id	: GenuineIntel
cpu family	: 15
model		: 107
model name	: QEMU Virtual CPU version 2.5+
stepping	: 1
microcode	: 0x1
cpu MHz		: 2688.042
cache size	: 16384 KB
physical id	: 1
siblings	: 1
core id		: 0
cpu cores	: 1
apicid		: 1
initial apicid	: 1
fpu		: yes
fpu_exception	: yes
cpuid level	: 13
wp		: yes
flags		: fpu de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx lm constant_tsc nopl xtopology cpuid pni cx16 x2apic hypervisor lahf_lm cpuid_fault pti ssbd ibrs ibpb md_clear
bugs		: cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass l1tf mds swapgs itlb_multihit mmio_unknown bhi ibpb_no_ret
bogomips	: 21471.23
clflush size	: 64
cache_alignment	: 128
address sizes	: 40 bits physical, 48 bits virtual
power management:

@Patrick

We need 1 actionable item per ticket / forum thread. This alone is 2 different suggestions.

My suggestion is to add a new optional KVM configuration and accompanying documentation on best practices for Whonix Workstations. This is for users who want to reduce the number of unique identifiers present. I think it’s only one item.

@Patrick

Non-issue. The Whonix KVM, Shared Folders documentation does not require administrative (root/sudo) rights.

OK, you’re correct. Only virtiofs requires sudo, while virtio-9p does not.

@Patrick

@7up

Do most security updates require a reboot?

I don’t have a statistic but it’s not uncomon.

Yes, well, the security model already surpasses that of Tails, which is the only amnesiac alternative.?

@Patrick

@7up

• Enable the user to boot into live mode with sudo rights.

Already available:

• LIVE Mode | SYSMAINT Session | maintenance testing

The display size in sysmaint is non-standard (1280x800) compared to user mode (1920x1080). Running torbrowser in sysmaint also results in:

[ERROR] [torbrowser] Failed to start Tor Browser!

Failed to run:
systemctl --no-pager --no-block status tb-updater-first-boot.service.

systemctl output:

○ tb-updater-first-boot.service - Helper Service for /usr/bin/torbrowser to determine when it is save to Copy Tor Browser from /var/cache/tb-binary to user home by Whonix developers
     Loaded: loaded (/lib/systemd/system/tb-updater-first-boot.service; enabled; preset: enabled)
     Active: inactive (dead)
       Docs: https://github.com/Whonix/tb-updater

To see this for yourself, you could try: Start Menu -> System -> Xfce Terminal
Then run:
systemctl --no-pager --no-block status tb-updater-first-boot.service

Users must know to run a command like xrandr --output Virtual-1 --mode "1920x1080", and systemctl start tb-updater-first-boot before launching torbrowser.

What I’m saying is that it’s not an exact comparison. Sysmaint does not appear to be designed for regular desktop use.

The possible solutions, in my view, are to either:

• Make sysmaint more similar to an unrestricted user mode.
• Allow upgrade-nonroot to be run by the user again, possibly by using something like apt-get-noninteractive.
• Introduce a third boot option that grants sudo rights without removing the sysmaint split (though this may encourage bad user habits).
• Make the sysmaint split opt-in or offer an image with an opt-in option (though this may be more difficult for releases).

@Patrick

This might be useful in context of Read-Only: Setting Hard Drives to Read-Only. Is this the same that Read-only - KVM wik chapter is doing?

Yes, should be. I suggest creating a new configuration that includes all the necessary features, including increased RAM and qemu64 CPU, so users don’t accidentally forget to add it themselves.

@Patrick

Once you boot a VM it’s unique due different speed of boot and log timestamps. Also Benchmarking.

I mean non-unique like when using Tor Browser to visit a website, cookies from the website persist until a restart. This means that each boot cannot be traced to a specific user, ensuring non-uniqueness.
I am not aware of any practical de anonymization methods using benchmarking, but there are factors making it more challenging:

• The image can be stored on various storage devices, such as a portable HDD, internal SSD, USB flash drive or even RAM, affecting boot times
• HDD benchmarking doesn’t seem possible if exclusively in live mode?
• KVM does not come with 3D acceleration by default, making GPU benchmarking more challenging.
• CPU benchmarking is also more difficult with qemu64 due to performance limitations.

With these considerations, the results may only be accurate for single-core CPU performance and memory type (DDR3 vs. DDR4). Maybe it’s even harder because it’s in a VM. More research needs to be done.