# Invisible Things Lab *Invisible Things Lab brings the security of Qubes OS to the enterprise with cutting-edge research in virtualization, kernel, and system-level security.* https://invisiblethingslab.com/ Links: [[Gramine]], [[Qubes OS]] - Founded by [[Joanna Rutkowska]], creator of [[Qubes OS]] ## [Website](https://invisiblethingslab.com/) ### Low-level security consulting and auditing With our extensive background in [system-level security research](https://invisiblethingslab.com/resources/), our expert team of world-class security specialists is prepared to audit your C, C++, and assembly code across a variety of architectures, such as x86, ARM, MIPS, and many more. We’ve been working at the forefront of Intel [[SGX]] for many years (see [Gramine consulting](https://invisiblethingslab.com/#gramine-consulting)), and we’re ready to bring that expertise to bear on your SGX use cases, from helping you devise, deploy, and audit SGX-based solutions to consulting on the security of SGX itself. Whereas most teams specialize exclusively in either offensive or defensive security, ours is renowned in both. Invisible Things Lab has presented numerous attacks against virtualization systems and Intel security technologies, including a famous series of exploits against Intel Trusted Execution Technology. Our attack against Intel VT-d, allowing for a full VM escape, is still the only one that has been demonstrated. We’re also known for showing that it’s possible to break into Intel vPro BIOS and Active Management Technology. This expertise in how to “break” secure systems gives us a unique advantage in building them: We know how to think like attackers, and we understand how to design systems to be truly secure from the ground up. Our team is among the best in the world at identifying exploits in binaries and developing mitigations against them. We can help you analyze the impact of security vulnerabilities, create proof-of-concept exploits, decide on appropriate mitigation measures, and advise on implementing and configuring them. With our deep knowledge of kernel security, we advise on kernel compromises, advanced rootkits, integrity checking, and kernel exploitation techniques. Not only can we help you design and implement kernel and system code; we can also perform a comprehensive security review of an existing or planned implementation. With decades of experience on the cutting edge of virtualization security, we’re well-equipped to advise on hypervisor attacks, secure hypervisor design, and secure hypervisor implementation. In addition, we offer security reviews on all of these aspects of virtualization. Last but not least, our extensive hardware and firmware security experience makes us among the best choices in the world for BIOS, SMM, and chipset security, including the identification of vulnerabilities, the development of proof-of-concept exploits, and comprehensive code review. This includes decades of experience in advanced security technologies like x86 virtualization (e.g., VT-x, VT-d, and AMD-V), Intel Trusted Execution Technology (TXT), and Trusted Platform Modules (TPMs). ### Qubes OS consulting [Qubes OS](https://www.qubes-os.org/) takes a uniquely effective approach to security. While the cybersecurity threats to companies and individuals have sharply increased in both number and sophistication, conventional operating systems are generally still monolithic in nature, leaving them vulnerable to total system compromise in the event of a zero-day exploit. By contrast, Qubes has pioneered an approach called Security by Compartmentalization, which allows users to compartmentalize different digital activities into securely isolated compartments called “qubes” so that if one qube is compromised, the others remain unaffected. Moreover, Qubes seamlessly integrates all of these secure containers into a unified desktop environment, providing a decisive advantage in user experience and productivity over traditional methods of isolation. ### Gramine consulting [Gramine](https://grapheneproject.io/) is a library OS designed to run Linux applications in restricted environments like Intel SGX enclaves. This approach minimizes the porting effort required when migrating to [confidential computing](https://spectrum.ieee.org/what-is-confidential-computing) while maintaining a minimal attack surface. Invisible Things Lab is the driving force behind the core development of Gramine and employs the leading experts on this cutting-edge technology.