1

I am attempting to determine whether it would be possible to maintain your anonymity while using an internet-connected PC infected with ring 0 malware. The threat model assumes the adversary is willing to purchase zero-day exploits and craft malware specifically targeting the victim in question.

Furthermore, I am assuming my adversary is capable of performing a virtual machine escape, which has previously been done on Qubes OS. My threat model assumes ring 0 access to my physical hardware.

Here are the current threats I have considered along with potential solutions:

Threat #1

The malware simply pings a server controlled by the adversary to leak the victim's real IP address.

Potential solution: The device will exclusively be connected via Ethernet to a router which routes all traffic through Tor. This router will be configured to disable all remote access (i.e. SSH).

Threat #2

The malware reads the hardware's MAC address, serial number, or other unique identifiers that tie it to a specific purchase, which could then lead to the victim's identity.

Potential solution: Anonymously purchase the hardware (i.e. use cash to buy a laptop found on craigslist) and never connect to any WiFi network (to ensure the MAC address is not associated with your identity).

Threat #3

The malware scans for nearby WiFi networks to attempt to estimate the victim's location by using a combination of the global maps of wireless access points and the WiFi signal's strength.

Potential solution: Physically remove any WiFi adapters from the device and exclusively use an Ethernet connection.

Threat #4

The malware uses the victim's camera or microphone to record them, potentially allowing the adversary to uncover the victim's identity.

Potential solution: Physically remove any cameras or microphones from the device.

Notes

The victim will operate under the assumption that their device has been infected with malware. Naturally, if the victim uses the device to log in to their personal Facebook account, their identity will be compromised.

Question

Are the solutions I presented adequate, and are there other de-anonymization tactics I have not considered? In short, is it possible maintain your anonymity while using a ring 0 malware infected PC?

5
  • It depends, are you using Microsoft Windows? None of the approaches you stated will stop Windows from reporting metrics to Microsoft that uniquely identify your machine. – user10216038 Oct 18 '20 at 23:27
  • The only good Windows is an air-gapped one! ;) – Albert Gomà Oct 18 '20 at 23:29
  • @user10216038 No, I would likely be using QubesOS, and assume my adversary is capable of performing a "Virtual Machine Escape" exploit. – Margret Englar Oct 18 '20 at 23:49
  • Also, @user10216038, I am not concerned about Microsoft "uniquely identifying my machine." That doesn't matter if the machine itself is not tied to my identity. They can know exactly where the machine was manufactured, and how, without uncovering my identity. – Margret Englar Oct 18 '20 at 23:59
  • Regarding Threat 1: So if the attacker manages, through the already compromised physically connected PC, to infect the router and change its configuration, you have lost. The router needs to be secured as well. – kutschkem Oct 21 '20 at 14:56
3

With Ring 0 (kernel) malware anonymity can be preserved

You just need to make sure you are under control of Ring -1 before you get infected by using a Type 1 hypervisor (one that runs underneath the operating system's kernel), and that the Virtual Machine that receives the attack is completely isolated from anything that can leak any identifying information.

One desktop operating system that is specifically designed to prevent those attacks is Qubes OS, which integrates seamlessly the windows of different Linux virtual machines running on top of the Xen hypervisor (Type 1). One of the included Linux distributions inside Qubes is Whonix, which is designed specifically for anonymity, and it is run on two separate virtual machines: the workstation, which is the one that has the Tor browser, and the gateway, which provides the workstation with access to the Tor network only in order to prevent leaks.

As a bonus, Qubes comes with disposable virtual machines out of the box, which prevent a successful attacker from gaining persistence by destroying the virtual machine once you have finished using it.

Note: for virtual machine isolation to work properly, hardware Virtual Machine extensions and I/O MMU virtualization should be enabled at BIOS level, the CPU should not be vulnerable to speculative execution exploits (or at least have it completely disabled) and the laptop should have ECC memory in order to prevent Row hammer attacks.


With Ring -1 (hypervisor) malware, maybe...

Aside from the potential solutions you mentioned, the following measures could make it feasible:

  • If the threat is an authoritarian nation-state, while buying that laptop all identifying clothes should be avoided, the face and all identifying marks (scars, tattoos...) should be covered (covid mask + sunglasses, helmet, long sleeves...), the hair should be dyed or not visible, the means of transport should not have an identifying plate (bike, electric scooter...), no devices with radios should be worn to the meeting point and talking should be avoided. The laptop and BIOS clock battery should be both removed immediately (or in an unidentifying place) until the webcam, microphone and all the radios are removed from it (Bluetooth too).

  • With the laptop still switched off and with the batteries out (with an EEPROM Programmer) the BIOS firmware should be replaced with an open source firmware (Coreboot, Libreboot, Oreboot...) image modified in order to have ALL internal device controller's (SATA, USB bus...) names and serial numbers changed/translated into fake ones to the OS. Of course, the laptop should be compatible with your firmware of choice and the patch should be developed, but achieving that is far less work than programming a secure OS or hypervisor from scratch. The patch should also address other hardware deanonymization methods, like the ones listed on the Whonix Wiki:

  • The gateway's MAC address should be faked too and, to prevent traffic correlation attacks, it should run a Tor relay and/or use/be a Tor bridge with a pluggable transport that randomly pads the frames (like obfs4). It should also use a different OS with a different kernel (BSD...), a different Instruction Set Architecture than the laptop (ARM, PowerPC, MIPS, SPARC...) -and preferably a different open source firmware too- to prevent the malware from exploiting the same vulnerabilities on the gateway.

  • All human interaction should be kept unidentifiable.


With Ring -2 (firmware) malware, I don't think so.

4
  • I already intended on using QubesOS, and I am operating under the assumption that a "Virtual Machine Escape" exploit would be performed. Such exploits have been performed on VirtualBox, VMware, QEMU, and even QubesOS. I was hoping for a hardware solution to this problem, not just virtualization. – Margret Englar Oct 18 '20 at 23:47
  • If it's for a headless service my advice would be to write a bare-metal program in Rust and connect the host to the anonymizing gateway. Without vulnerable code nor an OS the attacker can't exploit anything. I'd use ECC memory, a CPU architecture immune to speculative execution exploits (PowerPC?) and, if possible, open source firmware or none at all. – Albert Gomà Oct 19 '20 at 0:00
  • It's not for a headless service. It's for normal usage as a personal computer (aka a PC, as per the title). – Margret Englar Oct 19 '20 at 0:04
  • @MargretEnglar Then Xen bug used in that august 2016 link was patched in Qubes on july 2016 two weeks before. That being said, other unkown and not patched Xen bugs could be a problem indeed – bradbury9 Oct 19 '20 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.