The OS, called Qubes, is based on Xen, X and Linux and is in a basic, alpha stage right now. Qubes relies on virtualization to separate applications running on the OS and also places many of the system-level components in sandboxes to prevent them from affecting each other.

Qubes implements Security by Isolation approach. To do this, Qubes utilizes virtualization technology, to be able to isolate various programs from each other, and even sandbox many system-level components, like networking or storage subsystem, so that their compromise don’t affect the integrity of the rest of the system.

Qubes lets the user define many security domains implemented as lightweight Virtual Machines (VMs), or “AppVMs”. E.g. user can have “personal”, “work”, “shopping”, “bank”, and “random” AppVMs and can use the applications from within those VMs just like if they were executing on the local machine, but at the same time they are well isolated from each other. Qubes supports secure copy-and-paste and file sharing between the AppVMs, of course.

The concepts of isolation and sandboxing have been around for decades, and are used in a number of applications, including hardened operating systems and some security products. And many security experts say that sandboxing is one of the more effective ways of preventing malicious code from affecting entire systems, rather than just one vulnerable application.

In a guest column in January on Threatpost, security researcher Dino Dai Zovi said that he expected more and more vendors to implement sandboxing and isolation in the coming year.

“The desktop analogue to the network firewall is the privilege separated and sandboxed application.  These mechanisms finally move the bull (untrusted data) from the china shop (your data) to the outside where it belongs (a sandbox).  While it doesn’t quite reduce the attack surface, it significantly raises the bar for an attacker through defense-in-depth.  If an attacker is able to exploit a vulnerability and execute code, they must then exploit another vulnerability in the sandboxing mechanism in order to break free and even read the user’s data,” he wrote.

Rutkowska said that she plans to release the full version of Qubes by the end of 2010, and that she may create some commercial extensions to the OS in the future.

www.threatpost.com

News of “Windows XP Mode” hit on Friday afternoon more or less simultaneously with Microsoft’s post on The Windows Blog announcing that the RC is looking good for next Thursday. Rafael Rivera and Paul Thurrott, who are hard at work on Wiley’s Windows 7 Secrets book and were briefed on the tech back in March, describe XPM as host-based virtualization, and suggest that this might mean that going forward, client versions of Windows may include a Hyper-V-based hypervisor.

It’s not exactly included in 7, though. XPM (which will consist of that virtual environment and a fully licensed copy of XP with Service Pack 3) will be downloadable for those Windows 7 Professional, Enterprise and Ultimate Editions users who want it. But once it’s installed, it’s notably well-integrated — install an app inside the XP environment and without further ado it’s published to Windows 7 as well. That’s right, XP and Win7 apps running on a single desktop. (This ought to sound familiar to Microsoft Enterprise Desktop Virtualization users, but you Virtual PC users have some joy to look forward to. It may also ring a bell with users of Parallels on the Mac.)

Release of XPM is expected to be simultaneous with Windows 7′s release later this year.

www.betanews.com