Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have recently installed an application called 'Deep Freeze' that works by "freezing" the state of an operating system and working off delta disks. Rebooting deletes the deltas and reverts back to the original frozen state.

How effective is this against virus, or other malware, infections?

share|improve this question
1  
A good rule of thumb is if you don't have physical access to the box...it isn't your box. I think this applies to deepfreeze and similar programs. If someone else has your box...there is nothing you can do to be 100% sure changes won't be made –  Rell3oT Sep 10 '12 at 17:37
    
@Rell3oT is referring to Law #3. However, I think Law #1 is probably more applicable to the question here. –  Iszi Sep 10 '12 at 18:44
    
"How effective is this against virus, or other malware, infections?" - Pretty poor. You would only wipe said infections after a reboot, it wouldn't stop the image from being changed, while the system was actually running normally. Unless you are running a public terminal Deep Freeze is a waste of money. –  Ramhound Sep 11 '12 at 14:36
    
so,, does that mean if you deepfreeze the whole system in its clean state, whatever virus or malware that will come, will the deep freeze wipe it of after you reboot your computer? or a virus or malware can stay somewhere in your computer eventhough you deepfreeze the whole of it? –  user25064 Apr 23 '13 at 0:03
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  Terry Chia Apr 23 '13 at 3:25
show 2 more comments

6 Answers

up vote 10 down vote accepted

There are oodles of non-local-harddisk places that malware could stay (although in practice, such is rare in viruses). A few, off the top of my head, the system BIOS (although rare, there is malware which does this), or the firmware of bootable PCI cards.

If a virus can get on to your system, though, preventing it from persisting won't help - it may simply re-infect you after your reboot. Some 'stealthy' malware will stay entirely memory-resident, and will not write to disk, in order to evade detection.

Maybe you need to examine what you're trying to prevent - instead of 'A virus', maybe the answer is 'damage to my documents' or 'exfiltration of my documents'... or even simply 'theft of my banking credentials'. This might help you focus on what threats you should be preventing.

share|improve this answer
1  
One thing I would add: not only might malware re-infect you on reboot, but if you're using deep freeze any patches you apply to vulnerabilities will be overwritten on reboot. Eeek :) –  user2213 Oct 8 '12 at 14:00
    
I'm going to add one more to this - if Deep Freeze loads an image from a place that can be modified, you might as well not use Deep Freeze. I know a cybercafe owner who was very surprised when someone modified his disk image... –  Sébastien Renauld Apr 23 '13 at 17:30
add comment

No, the "virus" can still run and read your (sensitive) files, just like if you are not using Deep Freeze. Only after you restart your computer, will the malware (virus) be gone and you will be presented with the clean state (whatever state was frozen).

share|improve this answer
add comment

In addition to the answer Matrix gave, there is the possibility of a virus modifying firmware allowing it to survive past complete drive content resets.

share|improve this answer
5  
And lest people think this is only theoretical, there was a concrete example of this at BlackHat a few years back. See semiaccurate.com/2009/07/31/…. –  Levi Sep 10 '12 at 17:58
add comment

It is also possible for a virus to disable Deep Freeze. (If it can be disabled, there is no reason a virus can't do it)

Of course, this would have to be a targeted virus, but if a few 15 year old kids can figure out how to disable Deep Freeze, there is no reason any normal developer can't do it programmatically.

share|improve this answer
add comment

You can fight viruses by setting up a lower user-level access account, instead of using an Administrator account.

share|improve this answer
3  
Not completely (or even very effectively), though. –  Falcon Momot Oct 7 '12 at 4:41
add comment

In the sense that you are reverting to a known good state before doing anything sensitive, yes this is a good avenue to take.

However, Deep Freeze appears to store images on disk, which can be modified, so an infection to your host system could happily infect images captured in the past, so you lose your known-good property.

You are much better off creating a live, bootable but not writable medium such as a knoppix CD. Provided the CD image download and burn process is done and checked securely, you can trust the CD forever more to provide a safe local software environment.

As others have mentioned, malware can reside in hardware/firmware. Anything from your keyboard to your laptop battery can be subverted against you. In this case, your safe sofware environment could be infected at run time by the hardware upon which you run it.

Once this is happening, you are pretty much sunk. However, you will likely be able to at least greatly reduce the risk of such firmware-based reinfection by running an entirely different OS as your host OS. For example, if you use Windows 7 for your day to day activities, and boot Knoppix only when you want to do some online banking. In my opinion it is quite unlikely that persistent firmware malware would be able to infect across two different operating systems, meaning that your local software environment is pretty safe once again.

This is assuming that the firmware malware is not autonomous, in that it requires the help of the OS to do nasty things, which they all (to my knowledge) do. One could imagine an infected network card that sends traffic reports to the bad guys regardless of the OS that is running locally, but we're starting to reach the limits of what is possible.

share|improve this answer
add comment

protected by Community Jul 14 '13 at 20:40

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.