Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Let's say I have a computer. It's a personal computer - the one you'd typically find in homes. In this scenario, it's running Windows XP SP3, although it could run 7, Vista, etc.

I have a USB drive which runs as a Linux Boot Disc - with something like Ubuntu, Puppy Linux, DSL...

If that USB OS is loaded into the RAM at boot, without any persistence (nothing is saved after each session), how possible (if at all) is it for malware to infect the main system (the Windows XP/Vista/7 system) that the USB OS is running off of?

Also, if a foreign computer is riddled with malware, is it safe to assume that booting the system to a USB OS will keep the USB OS safe from the Windows malware on the machine?

Thanks.

share|improve this question
    
How are you implementing non-persistance? Is the internal drive protected in any way? i.e. whole disk encryption. –  this.josh Aug 3 '11 at 17:52
add comment

5 Answers

up vote 11 down vote accepted

It all depends on the configuration of your OS, be it USB "stick-ed" or not.

If your live system enable you to write in one way or an other to the physical disk of your home computer, then there is a non null probability that the computer could get infected. Take for example a virus that would copy itself on the MBR of your main disk.

Concerning infection from the main computer to the live OS, it is not impossible too. The thing is that if the malware is a resident one, loaded when you read you disk, it won't be running on your live system because the boot sequence of the infected OS won't be run. But if you have some latent viruses in your files and that virus would know how to target your live OS system, then opening this file with a vulnerable application (or executing it) can trigger infection of your live OS.

In conclusion, it's up to you to configure your OS to take the precautions needed to your operations. In fact, if you don't want to infect or get infected, the best thing to do is to disconnect the drives from the machine. If this is not an option, you would need to take care of the options on the live OS (read-only mode, no exec mode, no auto mounting of disks, running with the least privileges, ...)

share|improve this answer
1  
"If your live system enable you to write in one way or an other to the physical disk of your home computer" - It is worth pointing out that this condition is likely to be true for almost any reasonable home PC install. (There are exceptions, such as where the on-disk filesystems are all entirely encrypted with full disk encryption, but they are pretty rare in home personal computers.) –  D.W. Aug 4 '11 at 4:31
    
@D.W.: "...is likely...", "...pretty rare...", ...I don't see any basis for this judgements either. :) –  Tie-fighter Aug 4 '11 at 13:33
2  
@Tie-fighter, I thought the basis for my judgement would be more or less self-evident to anyone familiar with this field. I alluded to it: namely, at present, very few home PCs are using full-disk encryption on their entire hard drive. I don't have statistics I can cite to quantify exactly what fraction of home PCs have protected their entire hard drive with full-disk encryption, but I'd be amazed if it is over a few percent. –  D.W. Aug 4 '11 at 20:44
add comment

How aware is the user? It would be trivial to craft a clumsy poor bit of malware that mounted any local discs and did something; such malware would have to ask for permission, but there was a spate of malware that did pretty much that, and many users clicked Yes. Examples exist of poorly crafted malware that had to ask the user for permission before it could do damage. Very many users gave permission, not knowing what they were doing. It would be trivial to create malware like that. Worse, the attacker wouldn't need to. Malware could make use of privilege escalation or other exploits to cause damage to the local file system.

Puppy runs as root. The Puppy Linux wiki has some interesting thoughts and guidelines about security: http://puppylinux.org/wikka/security

N.B. choice of operating system becomes irrelevant if recommended security precautions are not applied

share|improve this answer
    
"such malware would have to ask for permission" - I don't think that's right. Malware can mount and tamper with the local hard disk without asking for user permission (e.g., if the attacker gains root access, or uses a privilege escalation bug). –  D.W. Aug 4 '11 at 4:30
    
D.W. is correct. I worded that phrase poorly. Something like "Some malware asked permission before causing damage, and users gave it permission; but be aware that if the attacker gains root access or uses a privilege escalation attack the malware will not need to ask". –  DanBeale Aug 4 '11 at 9:25
    
I've edited the answer, but still have a downvote. :-( –  DanBeale Aug 8 '11 at 11:07
add comment

It is possible but it is quite unlikely.

However, making sure wouldn't take too much effort: you just need to boot from a read only medium.

This can be achieved by using a USB drive with a 'read only' mode, whilst these are few and far between similar results can be achieved by using an SD card. Most SD cards have 'read only' mode and can be placed in a USB SD card reader. This would make it impossible for a virus to spread from the disk to your portable media.

share|improve this answer
1  
But it still would be possible for a virus to infect the internal drive. –  this.josh Aug 3 '11 at 17:50
    
I don't see why you classify it as unlikely. Booting from a read-only medium isn't enough; if you get penetrated while you're running the LiveCD, the attacker could then tamper with your hard disk (even if that's not what you booted from). Nothing stops that. –  D.W. Aug 4 '11 at 4:29
    
Fair enough, I was focusing on a virus getting from the internal drive over the boot usb but I see now that other avenues needed to be explored. –  Andy Smith Aug 4 '11 at 8:04
add comment

If you boot from a USB-based OS, then get infected, the virus can still mount the drives and infect them.

Likewise, a virus can infect the live distro on the USB stick by writing files to the drive, bypassing the normal mechanisms used to prevent this -- unless you have the physical write-protect switch on.

If the system is already infected, it may have a virus lodged in the BIOS (the motherboard BIOS, the video card BIOS, the network card BIOS, etc.). These things are just flash memory, and are updatable by viruses.

Unless you are the NSA, however, you don't have to worry about such things. In practice, booting a "live distro" from a USB stick is perfectly safe for almost everyone.

share|improve this answer
add comment

One way to consider this is to ask yourself "Do I have the ability to mount the host OS disk and modify files?" If you can do it as a user, it can be done as a script. Like others have mentioned, it's unlikely that it will happen, but it wouldn't be impossible for someone to write a script that detects what version of Linux you're using, then check for devices in /dev, then try to mount any of the hard drive devices found, then search those mount points for a "Windows" directory or any other sort of evidence that a Windows system is present. Once all this is discovered, they could then proceed to replace DLLs or delete the SAM file or do any other sort of terror to infect your machine.

share|improve this answer
    
Good answer, except that I don't see any solid basis for calling it "VERY unlikely". –  D.W. Aug 4 '11 at 4:33
    
I agree with @D.W. - I think this would be better off with the word "VERY" removed –  Rory Alsop Oct 5 '11 at 11:53
    
fixed. Removed "VERY". Never say never! –  Safado Oct 5 '11 at 14:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.