Preserving anonymity with ring 0 malware infected PC

Question

I am attempting to determine whether it would be possible to maintain your anonymity while using an internet-connected PC infected with ring 0 malware. The threat model assumes the adversary is willing to purchase zero-day exploits and craft malware specifically targeting the victim in question.

Furthermore, I am assuming my adversary is capable of performing a virtual machine escape, which has previously been done on Qubes OS. My threat model assumes ring 0 access to my physical hardware.

Here are the current threats I have considered along with potential solutions:

Threat #1

The malware simply pings a server controlled by the adversary to leak the victim's real IP address.

Potential solution: The device will exclusively be connected via Ethernet to a router which routes all traffic through Tor. This router will be configured to disable all remote access (i.e. SSH).

Threat #2

The malware reads the hardware's MAC address, serial number, or other unique identifiers that tie it to a specific purchase, which could then lead to the victim's identity.

Potential solution: Anonymously purchase the hardware (i.e. use cash to buy a laptop found on craigslist) and never connect to any WiFi network (to ensure the MAC address is not associated with your identity).

Threat #3

The malware scans for nearby WiFi networks to attempt to estimate the victim's location by using a combination of the global maps of wireless access points and the WiFi signal's strength.

Potential solution: Physically remove any WiFi adapters from the device and exclusively use an Ethernet connection.

Threat #4

The malware uses the victim's camera or microphone to record them, potentially allowing the adversary to uncover the victim's identity.

Potential solution: Physically remove any cameras or microphones from the device.

Notes

The victim will operate under the assumption that their device has been infected with malware. Naturally, if the victim uses the device to log in to their personal Facebook account, their identity will be compromised.

Question

Are the solutions I presented adequate, and are there other de-anonymization tactics I have not considered? In short, is it possible maintain your anonymity while using a ring 0 malware infected PC?

Answer 1

With Ring 0 (kernel) malware anonymity can be preserved

You just need to make sure you are under control of Ring -1 before you get infected by using a Type 1 hypervisor (one that runs underneath the operating system's kernel), and that the Virtual Machine that receives the attack is completely isolated from anything that can leak any identifying information.

One desktop operating system that is specifically designed to prevent those attacks is Qubes OS, which integrates seamlessly the windows of different Linux virtual machines running on top of the Xen hypervisor (Type 1). One of the included Linux distributions inside Qubes is Whonix, which is designed specifically for anonymity, and it is run on two separate virtual machines: the workstation, which is the one that has the Tor browser, and the gateway, which provides the workstation with access to the Tor network only in order to prevent leaks.

As a bonus, Qubes comes with disposable virtual machines out of the box, which prevent a successful attacker from gaining persistence by destroying the virtual machine once you have finished using it.

Note: for virtual machine isolation to work properly, hardware Virtual Machine extensions and I/O MMU virtualization should be enabled at BIOS level, the CPU should not be vulnerable to speculative execution exploits (or at least have it completely disabled) and the laptop should have ECC memory in order to prevent Row hammer attacks.

---

With Ring -1 (hypervisor) malware, maybe...

Aside from the potential solutions you mentioned, the following measures could make it feasible:

• If the threat is an authoritarian nation-state, while buying that laptop all identifying clothes should be avoided, the face and all identifying marks (scars, tattoos...) should be covered (covid mask + sunglasses, helmet, long sleeves...), the hair should be dyed or not visible, the means of transport should not have an identifying plate (bike, electric scooter...), no devices with radios should be worn to the meeting point and talking should be avoided. The laptop and BIOS clock battery should be both removed immediately (or in an unidentifying place) until the webcam, microphone and all the radios are removed from it (Bluetooth too).

• With the laptop still switched off and with the batteries out (with an EEPROM Programmer) the BIOS firmware should be replaced with an open source firmware (Coreboot, Libreboot, Oreboot...) image modified in order to have ALL internal device controller's (SATA, USB bus...) names and serial numbers changed/translated into fake ones to the OS. Of course, the laptop should be compatible with your firmware of choice and the patch should be developed, but achieving that is far less work than programming a secure OS or hypervisor from scratch. The patch should also address other hardware deanonymization methods, like the ones listed on the Whonix Wiki:

• The gateway's MAC address should be faked too and, to prevent traffic correlation attacks, it should run a Tor relay and/or use/be a Tor bridge with a pluggable transport that randomly pads the frames (like obfs4). It should also use a different OS with a different kernel (BSD...), a different Instruction Set Architecture than the laptop (ARM, PowerPC, MIPS, SPARC...) -and preferably a different open source firmware too- to prevent the malware from exploiting the same vulnerabilities on the gateway.

• All human interaction should be kept unidentifiable.

---

With Ring -2 (firmware) malware, I don't think so.