Security through isolation. The story of Qubes OS
A Polish researcher who embarrassed Microsoft in 2006 came to the conclusion that no system can be written without bugs. So she decided to build one in which bugs do not matter. Today Edward Snowden calls it the best operating system there is.
In August 2006, at the Black Hat conference in Las Vegas - one of the most important gatherings in the computer security world - a young researcher from Warsaw stepped onto the stage. Joanna Rutkowska demonstrated something she called Blue Pill, a nod to "The Matrix". It was a prototype of malicious software that used the hardware virtualisation of processors to move a running operating system into a virtual machine - without a reboot and without the user knowing. The system kept running, but it was no longer its own master. Underneath it, invisible, someone else was at work.
The presentation made waves. Microsoft was then preparing to launch Windows Vista, marketed as the most secure Windows ever. Rutkowska showed how to bypass its kernel protections. The young Polish researcher's name began to be mentioned in the same breath as the names of the greatest researchers in the world.
A pessimist by profession
The following years brought more discoveries. In 2007 Rutkowska founded Invisible Things Lab in Warsaw. Together with Rafał Wojtczuk, she demonstrated attacks on the lowest layers of the computer: on the BIOS, on Intel's trusted boot mechanisms, on a processor operating mode invisible to the system. In 2009 she described an attack she called "Evil Maid". The scenario was simple: you leave a laptop with an encrypted disk in a hotel room, someone plugs a USB stick into it for a few minutes and replaces the boot program. When you come back and type your password, it is captured. The disk encryption you relied on no longer matters.
After years of finding holes in other people's systems, Rutkowska reached a conclusion that changed the direction of her work. Every operating system has bugs. Every browser, every PDF reader, every network card driver. These bugs cannot be eliminated, because modern software consists of tens of millions of lines of code written by thousands of people. If so, the question is not "how do we write a system without bugs?" but "how do we build a system in which a bug in one place does not mean disaster everywhere?"
The idea: trust nothing
In 2010 Invisible Things Lab announced the Qubes OS project. Version 1.0 came out on 3 September 2012. The project did not promise the impossible. Its motto was modest: "a reasonably secure operating system".
The idea is simple, though its implementation is very hard. On an ordinary computer everything runs in a single environment: the browser, e-mail, password manager, company documents and a game downloaded from the internet. If any of these programs is attacked, the attacker usually gains access to everything else. One infected attachment is enough to take over the lot.
Qubes reverses this logic. The computer is divided into many independent compartments - "qubes" - each of which is a separate, lightweight virtual machine run by the Xen hypervisor. You can have one qube for work, one for banking, one for browsing the internet and one, completely cut off from the network, for encryption keys and passwords. Even the network card and USB ports run in isolated compartments, because hardware drivers are one of attackers' favourite targets.
Windows from different qubes appear side by side on one desktop, but each has a coloured border. Red might mean "untrusted", green "work", black "most confidential". At a glance you can see which world you are working in.
What it changes in practice
Imagine you receive an e-mail with an attachment from a stranger. On an ordinary system you open it and hope nothing happens. In Qubes you open it in a "disposable" qube that is created in a few seconds and disappears without a trace when you close the window. If the file contained malicious code, it infected a machine that no longer exists. Your e-mail, documents and keys remain untouched.
Another example: someone sends you a PDF you need to keep. Qubes can "clean" it by opening it in a disposable compartment, converting it into plain page images and assembling them back into a safe document. Any malicious code is left behind along the way, in a machine that is about to cease to exist.
The most important part of the system - the one that manages the whole computer and displays the desktop - has no internet access at all. It cannot be attacked over the network, because it has no contact with the network. Even the clipboard, the ordinary copy-and-paste between windows, requires a deliberate gesture from the user, so that data does not leak between compartments without your knowledge.
One computer, many worlds
In everyday work Qubes has a few more clever solutions. Programs in most qubes are not installed separately but come from shared "templates". After every restart, the file system of such a compartment returns to the clean state of its template. If malware managed to nest inside, an ordinary restart removes it - only your documents in the home directory remain.
Encryption keys can live in a qube with no network access, while the e-mail program in another compartment only asks for a specific message to be signed or decrypted. Even if the e-mail program is attacked, the private key never touches it. Qubes also integrates Whonix: compartments whose entire traffic is forced through the Tor network. A program running in such a qube does not know your real IP address, because it technically has no access to it - even if it is taken over and tries to give it away.
Snowden's recommendation
Qubes has never been a system for everyone. It requires more powerful hardware, plenty of memory and a change of habits. In return, it quickly won the trust of those for whom security is not an abstraction.
The best-known recommendation comes from a man who knows better than almost anyone what the world's most powerful intelligence agencies are capable of. Edward Snowden - the same man who in 2013 revealed the scale of NSA surveillance - wrote about Qubes briefly: "If you're serious about security, Qubes OS is the best OS available today. It's what I use, and free." The Freedom of the Press Foundation - an organisation that supports journalists and whistleblowers - built the SecureDrop Workstation on it, which newsrooms around the world use to receive material safely from anonymous sources. Precisely where a single infected file from an "informant" could expose an entire newsroom, isolation stops being theory.
In 2018 Joanna Rutkowska moved on to other projects, but Qubes continues to develop as an independent, open project. Its lead developer for many years has, incidentally, also been a Pole - Marek Marczykowski-Górecki.
The limits of isolation
In fairness, we should say what Qubes does not do. It will not protect you if you yourself move an infected file into your most trusted compartment. It will not replace common sense. It will not fix flaws in the processor or firmware, although it makes exploiting them much harder. Rutkowska herself always stressed that her system is "reasonably", not "completely", secure.
But the difference between "reasonably secure" and a typical computer is huge. On an ordinary system a single bug is enough to lose everything. In Qubes, an attacker who takes over the browser holds the browser - and nothing more. To get further, they must find another flaw, this time in the far smaller and much better scrutinised code of the hypervisor. That raises the cost of an attack from days to months, and sometimes to years.
Pessimism that protects
In the world of security, promises come easily. Vendors claim their system is "indestructible" and their protections "unbreakable". Qubes was born from the opposite assumption: everything will fail one day, so let us design the system so that the failure of one element does not drag the rest down with it.
It is a philosophy sailors know well. A ship is divided into watertight compartments not because the designer expects a hole in the hull. It is done because one day a hole will appear - and then the bulkheads decide whether the ship sinks or reaches port.
The computer on which you work with confidential data deserves the same bulkheads.