This is the desktop of the Qubes operating system.
This is the best desktop operating system to enforce security
through isolation and compartmentalization, in my opinion.
It is still in its early days for the operating system,
but the concept behind it is excellent.
Qubes is a free and open source operating system
designed to provide strong security for desktop computing,
not for servers.
Qubes is based on the Xen hypervisor,
the X-Windows system and Linux.
It uses virtualization to enforce security domains
through isolation and compartmentalization.
This is good because virtualization
reduces the interfaces between security domains
but still allows the security domains to exist and communicate.
Perhaps the best way to think of it is as if you're running on your laptop
a Xen bare metal hypervisor
with some Linux kernel added
and additional code to handle communication
between those virtual machines,
plus some added security features, that's Qubes.
The user environments or the individual VMs
are based on Fedora, Debian, Arch Linux,
Whonix, Microsoft Windows,
and some others through what are called Qubes templates.
It's an operating system like any other that you download
and install on your laptop or desktop,
although it does take about three hours to install, it's quite a beast.
At the moment this is the latest version to download
and there's also a live CD version that you can get,
which you can download here if you want to try it out.
The live CD currently, as I'm recording,
doesn't have the latest features as the full install version,
but at least with the live CD you can test it out
and see whether it works with your hardware.
Note, I haven't found this live CD
or in fact installing it to work on virtual machines,
on any virtual machine, so you'll have to try it on bare metal.
Let's talk about kernel design for a minute.
So most operating systems, Unix, Linux, BSD,
use a monolithic kernel architecture,
which means lots of code runs with high levels of privilege,
or what is called the trusted computing base or TCB.
The TCB is all the hardware, firmware and/or software components
that are critical to a system's security, the trusted computing base.
If security bugs or compromise occur inside the trusted computing base,
it is very likely to jeopardize the security of the entire system.
Vulnerabilities in the kernel are especially dangerous,
so avoiding kernel vulnerabilities is especially critical.
Now what you can see here,
these are examples of monolithic kernel TCB components
that you have to trust are good.
These make up the attack surface of a monolithic kernel,
so the smaller the trusted computing base
the better for security, the smaller the attack surface.
So why is this relevant to Qubes?
Well, unlike VMware and VirtualBox,
which runs directly on a host operating system
like Windows or Debian,
Xen, which Qubes is based on, is a type one or bare metal hypervisor.
Qubes uses a microkernel
as the isolation enforcing code
reducing the attack surface.
Less code equals less potential security bugs,
equals less potential compromises,
or at least that's the theory, a good theory though.
An attacker must be capable of subverting the Xen hypervisor itself
in order to compromise the entire system,
which is more difficult to do
than subvert the host on a type two virtual machine
like VMware and VirtualBox.
There is no full host OS to compromise
with a type one hypervisor, like which Qubes uses.
This is an advantage for security
which Qubes has over VMware and VirtualBox.
Let's talk through the system architecture and the various VMs.
Qubes enforces security domains through different virtual machines
that establish isolation and compartmentalization.
Each of these boxes here represent different virtual machines
and different security domains.
No host operating system is used as Xen is the bare metal hypervisor.
So first let's look at the Xen hypervisor and administrative domain,
or the GUI domain,
which is this one here,
and this one here within the interface.
The host domain or Dom0 is the interface or GUI to everything else,
it's what you see when you are logged in.
Dom0 controls the graphics devices,
as well as input devices such as keyboards and mouse.
Dom0 is what shows what you're seeing now, this desktop.
It is used for running the X server
which displays this user desktop and the Windows manager
which allows the user to start and stop the applications
and manipulate the Windows.
Critically and for security, Dom0 has no network connectivity,
it has as little communication as possible with other domains
in order to minimize the possibility of attack
from a compromised VM.
As you can see, it uses KDE by default
and even for example if there was a bug in this KDE,
Dom0 isn't reachable for an attacker
as there is no network connection to it,
you can just view it in effect.
Because the Dom0 doesn't have network access,
only a few components need to be updated
which the administrator can install the command line.
To view applications running in each VM's domain,
Qubes provides the application viewer.
This provides a false impression for the user
that applications execute natively on the desktop,
as you can see here.
But they are in fact applications running in separate VMs.
Like this window here,
you can see the yellow window with a yellow border,
this is running in the personal virtual machine
and the green window here is running in the work VM,
but because of Dom0’s application viewer,
you have the false impression
that these are just separate windows within an operating system,
but in fact they are entire separate operating systems
as part of a virtual machine
that are isolated from each other by Xen and Qubes.
There is a network virtual machine or NetVM which you can see here.
Also represented in this diagram here, NetVM.
Networking is performed in a separate VM
which is great as a network layer
is a critical component for securing communication.
This VM protects you against exploits,
against things like your WiFi or Ethernet driver,
protocol stacks, or maybe your DHCP client,
and you could also use this to isolate your VPN
and make it available for other virtual machines.
So what I mean by that is the network VM enforces a VPN
and your other VMs are tunneled through that.
This prevents leakage.
Remember the Nightstand from the NSA Ant Catalog.
If as advertised, if we imagine this has some WiFi driver
or protocol stack type exploit that it's able to perform,
if you're using a normal operating system like Windows, Debian,
OSX, Linux, it's game over if they have that type of exploit.
With Qubes, because the network is isolated in the VM,
only the network VM would be compromised by an exploit like that.
The attacker would have to escalate his attack
to get to the other domains or other VMs.
So it's a great idea to have your network
as a separate virtual machine as well,
in fact it'd be great for all operating systems.
This does require that your hardware has IOMMU,
also known Intel VTD.
There is a firewall VM which enforces firewall rules between the network VM
and other domains so that you can configure the protocols,
the sources, the destination etc,
for the communication between the domains.
There are disposable VMs.
So adisposable VM, like the name suggests,
will dispose of the VM once it’s been used.
It is typically used for a single application like a viewer,
an editor, or browser.
You can open a suspicious attachment
with complete safety or browse the web
without storing any local history and preventing tracking.
It's a nice feature, I like it.
You simply just right click on a file and select open as disposable VM.
But it's more to mitigate a threat like malware and stop tracking
than to protect against local forensic examination,
like you get with the Tails amnesiac operating system.
You can use an optional Usb VM,
this would protect the operating system from things like bad USB
being plugged into the laptop or device.
The Usb VM sandboxes all the USB drivers and stack,
protecting you from bad USBs.
Data can then be carefully exported
from selected devices to other app VMs.
Application virtual machines, or app VMs.
App VMs are the virtual machines used for hosting applications
like your web browser, email client, pdf view, etc.
Each app VM is based on an operating system template,
the default being Fedora, the minimal template.
Others include, as you can see here,
Debian, Arch Linux, Ubuntu, Whonix,
that's the two gateway and workstation VM.
Also you have Windows here, so you can run office apps,
Word, Excel, or the things you can run in Windows.
To enforce these security domains,
applications are placed in separate application virtual machines, app VMs.
Here you can see examples of security domains,
banking, personal, untrusted, work, etc.
Because of this, what you see here, this application viewer,
there is an illusion that they are running on the same machine,
but they are in reality separate virtual machines.
You could be running a untrusted browser on hackme.com
and the browser for banking at the same time.
Any exploit from the untrusted browser wouldn't affect your banking VM at all.
Any security domain is labeled by color, you can see here,
each window is marked by the color of the domain it belongs to.
So here is the yellow,
which is personal, which you can see there.
There is a green, which is work,
so it's always clear,
visible as to which domain a given window belongs to.
They also allow for things like secure
copy and paste operations between VMs,
securely copying and transferring files between VMs,
and secure networking between VMs and the internet.
Qubes has inbuilt integration with TOR.
The Whonix gateway and workstation templates
come with Qubes and is a great option for using TOR and preventing leaks.
You get the benefits of Whonix privacy and anonymity,
and the host security isolation and compartmentalization of Qubes together,
which is a very good solution.
Hardware.
Because of its design, Qubes has a level of resistance to malicious hardware:
backdoor nicks, USB drivers, badBIOS, disks and SATA controllers.
Qubes also has some other security features,
sort of added bonuses.
You can split your GPG private key to help protect it,
some functionality to enable that.
And there is a pdf converter to make pdfs trusted effectively.
And I'm sure there'll be other added security features
as the OS matures.
So all of this sounds great, doesn't it?
So what are the downsides?
Why might you not just go out and install this now?
Well, the first one,
one of the big problems with Qubes is a lack of hardware support.
I have a number of laptops and in order to get it to work on my Sony Vaio,
I had to flash the BIOS,
which is a pretty scary prospect for most people,
even highly technical people, as it can break your laptop.
To take full advantage of all the cool security features,
you'll need a CPU that supports virtualization technology,
including both Intel VTX or AMDV,
which you can see here,
and Intel VTD or IOMMU,
which you can see here.
Plus a BIOS with a trusted platform module
to protect against the Evil Maid attack.
You're also going to need a fast CPU
and lots of RAM if you want to run a number of VMs.
Another issue is with the manufacturers.
They often make changes to the hardware of a computer
or laptop or device throughout the life cycle
of that laptop without notice, and yet it’s still called the same model.
And the features Qubes takes advantage of
are not features normally advertised by a vendor,
so you're not quite sure whether the laptop you're going to buy
is going to support the features you need it to support.
This is a clear barrier to entry for any new user and turns people away.
I recommend the live USB to test Qubes
to see if it will work on your hardware.
If you think about getting a laptop,
then have a look at this hardware compatibility list
for examples of devices that fully support Qubes
or partially support Qubes.
The list is growing and is actually much easier to understand now
that they've cleaned up the list,
because it used to be a bit of a mess.
But it's actually pretty good now and you can see quite clearly
what works and what doesn't work,
and has also added commentary on what they needed to do
perhaps to make it work.
But notice, this is community supplied,
so you know, it might not be 100% accurate.
So there's actually quite a few in there,
there's a lot more than there was the last time I looked,
which was a few months ago.
And actually, that's the model that I have with Qubes running on it.
And yeah, actually as it says here,
you had to flash the BIOS.
Yeah, so I had to flush the BIOS on mine to get it working.
But as you can see, there's quite a few that actually do work
and some of the ones on here are not that expensive.
You can get sort of an older laptop around $150,
$200, something like that.
There's also a Google Group for Qubes,
that's useful for help on what hardware might work
and getting your hardware to work.
And I think I mentioned it before,
it doesn't work in a virtual machine,
or at least I've not been able to get it to work in a virtual machine,
so you will need to install it on bare metal
or try the live USB, live CD option.
There is one current Qubes certified laptop,
which is the Librem 13, which you can see here,
which you can get Qubes preinstalled onto.
This was a crowdfunded privacy focused hardware,
I remember seeing it, this is where it was crowdfunded here.
And you can go and buy them from here,
but they're not that cheap, as you can see here, $1,499.
But obviously, that is because the laptop is niche built
to be privacy focused and sourced to be privacy focused.
Check that out if that interests you.
But from the hardware compatibility list,
you'll find laptops that are much cheaper
if you really want to try and get Qubes working.
Another issue to consider,
performance and compatibility could be a problem with Qubes,
especially if you're only going to have one device.
You're not going to be able to run games and high demand software
in virtual machines unless you've got a very very powerful machine,
or it's simply not going to be as good as a native machine
or the same native machine without VMs.
So this will probably just be for work, personal,
and a security laptop,
not a performance laptop or a performance device.
So what are my general conclusions?
Well, this is an operating system still in the early days,
but with the right hardware,
offers some unrivaled security features
for anyone technical enough to take advantage of them.
It is not designed like Tails to prevent local forensic examination,
it is for those most concerned about vulnerability exploitation.
Although it does have disposable VMs,
these are more to remove a threat than to mitigate local forensic examination.
It is a platform for security and exploitation prevention and isolation.
It is arguably the best security platform
for hosting another secure operating system.
Hopefully, the hardware compatibility issues will get easier
and I think they will, and Qubes has got a bright future.
I recommend you try it out and I recommend you use it,
especially if you have high security, privacy, and anonymity needs.
And to finish off, literally a few days ago of me recording this video,
this has been released by the Qubes guys.
This is tutorials on using Qubes,
so check that out, they're also on YouTube as well,
there’s quite a few of them and they're quite good,
thanks to Qubes team for a great OS, keep up the good work.