Alright so now we have pretty much covered all way to defend against Kernel attacks, now we will focus on the application layer security, basically ring 2-3

Here are the previous parts, make sure your read them all if you want to stay up to date:

• 1) Hardware Selection & Proper Usage 1
• 2) Hardware Selection & Proper Usage 2
• 3) Kernel Defense 1
• 4) Kernel Defense 2
• 5) Kernel Defense 3

Okay so if you have read episode 5, which is really a correction over episode 4, I really recommend people to use Qubes. But if for some reason you don’t like it or find it complicated (which it isn’t), at the bare minimum you have to use Linux. This tutorial is worthless if you are not using at least Linux.

And as I said in previous episodes, you should not mix it with other crap, not even other Linux. So Dual Boot is out of the question, and so is multi user!

No Multi User

So the concept is pretty simple, your computer should be your computer only, protected by a password, it’s your stuff. You should not share it with your spouse, kid, friend, whatever. It’s none of their business. Me and my wife have our own separate computers, I have 2.

C’mon don’t be a cheap fuck, you can literally buy an average computer for 150 EUR, perhaps a second-hand one for even 50$. Don’t be a schmuck, you don’t even need a high end computer for just web browsing and writing essays on Steemit. You really need to get your own computer and that means that it will be exclusively yours.

So no multi-user shit, neither dual boot:

• 1 computer , 1 operating system , 1 user

That’s it, so this eliminates tons of vulnerabilities from others messing up your computer to Evil Maid/Cold Boot attacks, and other possible rootkits. So that’s it don’t share your computer and don’t setup additional accounts, and then Ring 2 is secured, it’s just that easy.

Qubes doesn’t support multiple users by default. It’s just a security vulnerability, tell your wife to buy a laptop for herself!

Device Drivers

Device drivers are tricky though, so let’s see we have eliminated or greatly reduced threats from:

• Ring 0 (and the Bootloader) (in previous episodes)
• Ring 2 (here)

Now what to do about Ring 1 threats? How to secure device drivers?

Well what threats can happen here? Some exploit in the webcam driver that would hijack it and turn it into a “Big Brother”. Well we already covered that in the first 2 episodes. So the microphone, webcam, and other unnecessary peripherials should be turned off or physically removed when not in use. It’s just that simple.

What other drivers could be hijacked? Well I don’t see much more problems there, in fact if the kernel is intact, it can block the a malicious driver script, so we really defend against this by keeping the kernel clean.

Even if the apps would hijack the network driver for example, you can use a secondary router to defend against that, or perhaps remove the wireless adapter entirely if wireless hacks are your concern. As described in the first 2 episodes there is really not much use for wireless in home networking, only when you are on travel, so just use cable and a commercial grade router specialized for security (since basic cheap routers are probably easy to hack).

So really not much damage can be done from the driver layer if the other security protocols are in place. So Ring 1 is safe too.

Application Layer

Now the application layer is a complex and long topic. So after we have secured everything wrong from Ring 0 to Ring 2, then the only thing we need to worry about is some kind of malicious app, who’s damage we have already limited if we are using Qubes and quarantining malware, but nontheless a potential malware is still dangerous, at least in it’s own environment, if not for the entire environment.

So we have to decrease the probability of infection to the smallest we can, since we might never know when a bug in the kernel can allow the malware privilege escalation and then it can devastate the entire system.

So even a malware under control should not be underestimated since by it’s own it’s not a threat but if it’s coupled with a vulnerability in the kernel, it would lead to it escaping it’s “quarantine” and compromizing the entire computer.

So there is no perfect VM, not even Qubes can guarantee perfect isolation, despite still being the best OS out there, since Xen vulnerabilities get discovered all the time:

“At the same time, the Xen Security Team released several other Xen
Security Advisories (XSA-238 through XSA-244). The impact of these
advisories ranges from system crashes to potential privilege escalations.”

And this was 2 days ago, so anyone using an earlier version than that is probably vulnerable to this, despite their best efforts.

So as you can see they are doing their best, and virtualizing everything is a good security practice, but it’s not enough. So the entire chain has to be secured from Ring 0 down to Ring 3.

In the next episodes I will talk about each popular application and how to configure them to be safe.

---

Sources:

• https://pixabay.com

---

Upvote, ReSteem &