Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say you boot into Linux from a brand new Live USB. The USB is write protected. The memory stick has never been exposed to the Web in its life. You surf all day on Firefox building your library of bookmarks. You backup your bookmarks to a .json file and send it to your Gmail account. You close down the computer and erase ram. Nothing is saved to the stick.

Five minutes later you cold boot into Linux with your USB still in write protect mode, open Firefox, go online to Gmail and download the bookmarks file. The moment the file has finished downloading you go offline. You restore the .json file to Firefox then set your USB to write mode. You save the new configuration to the USB, close down and remove your memory stick.

What are the chances this stick is now infected with malware, keyloggers et al using this routine? Is there a better way to keep the USB uninfected?

share|improve this question
It would be far easier to simply use Firefox's sync functionality. This would allow you to store your bookmarks in the cloud and have Firefox simply import them whenever you start the thumb drive. It's effectively the same as what you are doing now, but with less steps. – AJ Henderson Jul 19 '13 at 15:06

So, clearly any processes that are running while the USB is not write protected could have an effect on its contents.

However, given that you are booting from a known-good state, I would say this window is microscopic, it is unlikely in the extreme that a persistent infection could occur. If all you do is open firefox and download your attachment, and not visit any other pages in particular, and the machine has no open internet-facing ports, I'd say you're as good as you can be.

It is quite easy to tell however. Make another known-good copy of the USB, put them both in a known-good, isolated machine, and make a filesystem comparison. The only files that should show differences are the ones related to the firefox configuration, and maybe a few system logs in /var.

share|improve this answer
Tkx lynks. Re filesystem comparison is there an app for that? – Edwardo Jul 13 '13 at 15:42… > Tripwire – Edwardo Jul 13 '13 at 16:56
@Edwardo yeah there are a number of things you can do. The easiest would be to use unix tools like find, md5sum and diff. – lynks Jul 13 '13 at 22:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.