Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading this
Windows 2003 Enterprise infected by Conficker; post-infection problems continue
And they talk about nuking it from orbit (which apparently means wiping out the system and starting over) or at least doing an OS reinstall with full format
How are the two things different? Or is it because it is a server thing that these two mean different things?

share|improve this question
    
"We must destroy the village in order to save it" = MilSpeak for The Viet Cong have so infiltrated everything that we can no longer differentiate between friendlies, civilian bystanders and enemy combatants. Which meant, "Call in the BUFFs for a complete carpet bombing to erase it." Same thing goes with a really complete virus/malware pwnage, burn it to the ground to kill the anthrax and start again. –  Fiasco Labs Mar 13 '13 at 1:00
add comment

marked as duplicate by Jeff Ferland Mar 13 '13 at 1:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4 Answers

up vote 2 down vote accepted

The phrase nuke it from orbit basically means to wipe your system and start from a clean slate. What that clean slate might be differs in different situations.

If you perform regular backups of your system, which you should, restoring from a previous backup might be possible IF you were able to use forensics means to discover the time of infection. Restoring from a backup point before you got infected will be safe enough.

Of course, if you do not keep regular backups, you are in for a world of hurt. If you have important files on the system, you must diligently analysis each and every single file and ensure that it isn't infected before transferring it to the new, clean system. This is difficult.

share|improve this answer
    
so nuking is more robust removal method as opposed to restore points? How is it different from format and reinstall? Or does it also include reinstalling of the firmware for routers in case we are talking about servers and networks? –  user13267 Mar 13 '13 at 0:57
    
Yep. Less chance of residual infection from infected backups. You should be aware of malware that's persistent in things like the BIOS as well, in which case Nuke it might mean scrap the hardware as well! –  NULLZ Mar 13 '13 at 0:59
add comment

Substantial difference between nuking it from orbit and formatting disk is that malware may be also present on other components of your server than the disk.

As this answer to the linked question already states, malware can by now - at least theoretically - affect any flashable, persistent storage.

And since there are more and more components running a firmware inside one server, it would be really a PITA to verify each component's (flash) storage.

E.g. someone could modify your NIC's firmware, creating backdoor access to booting the machine from a remote source (network boot) or enabling/exploiting any other remote management feature.

Therefore: Nuke the whole machine!

share|improve this answer
add comment

I say we take off and nuke the entire site from orbit. It's the only way to be sure.

Probably the origin of this saying.

In the context of having your computer infected by a virus: even if malware seems to be removed, it may not be - and the only way to be sure it's completely gone (and even then it's hard to be 100%) is to completely wipe the system and start fresh.

We all know what happens when you don't nuke Xenomorph's from orbit. Don't expect any better from malware.

share|improve this answer
add comment

"Nuke the site from orbit - it's the only way to be sure" is a quote from the movie Aliens, in which the protagonist suggests that an infestation of xenomorphs is so pervasive that a nuclear response is the only sure way to destroy it.

Synonyms in this context include:

  • "Flatten the box"

  • "Repave it"

  • "(FDISK,) Format and reinstall"

  • "Start again"

So when someone says "nuke it from orbit", they're really meaning "destroy it utterly". (and start over).

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.