Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?

Or can something still persist installed in the bios or something like that? What to do then?

To be clear, not concerned about common malware. The question is more specific about a machine to which people other than the user had physical access for many hours. So when the user returns cannot be sure that nothing changed, so the user makes a fresh install after some weeks. Is that enough to "clean" it?

Hardware keyloggers are not part of this question as they should continue after software reinstallation.

share|improve this question
    
What is the sophistication level of the people who had physical access for several hours? –  this.josh Sep 18 '11 at 4:06

6 Answers 6

up vote 22 down vote accepted

It is possible for malware to persist across a re-format and re-install, if it is sufficiently ingenious and sophisticated: e.g., it can persist in the bios, in the firmware for peripherals (some hardware devices have firmware that can be updated, and thus could be updated with malicious firmware), or with a virus infecting data files on removable storage or on your backups.

However, most malware doesn't do anything quite this nasty. Therefore, while there are no guarantees, re-formatting and re-installing should get rid of almost all malware you're likely to encounter in the wild.

Personally, I would be happy with re-formatting and re-installing. It's probably good enough in practice.

share|improve this answer
10  
Most importantly; none of those things are consistent between machines. Malware would not only have to be that nasty, it would also be limited to a specific set of hardware. –  Billy ONeal Sep 16 '11 at 15:43
    
Like... macs? (EFI bios seems like a ripe target for this sort of thing) –  Ori Aug 3 '12 at 3:40

It is definitely possible for a slightly sophisticated attacker to leave malware outside the direct reach of the operating system. Reinstalling the operating system means a disk wipe at most. Even there, you need to be careful if you restore any data that may have been compromised.

Malware can be stored in one of the many rewritable memories that lurk in just about every component of a modern computer. These memories store that component's firmware and are usually rewritable; all it takes is knowing the right address to it, and manufacturers usually provide tools to upgrade the firmware, so all the attacker to do is substitute his own code (there is almost never any cryptography).

For example, there is a known (and fairly simple) exploit for Apple keyboards, found by K. Chen. Chen's presentation shows how to take advantage of the available memory (only about 1kB to spare) to open a shell on a TCP port by injecting keystrokes, or log keystrokes in a context where a passphrase is expected and replay them.

For another example of a firmware vulnerability in the wild, try CVE-2010-0104: Broadcom NetXtreme management firmware ASF buffer overflow. This is a bug in some Ethernet firmware that allows a remote attacker to take control of the network firmware (and so at the very least actively attack all network traffic), and potentially of the whole computer (I don't know if there's an exploit for that, but once you have access to the PCI bus, I doubt that much is barred). Interestingly, this vulnerability is easiest to exploit on a computer that's switched off, since the bug is in a remote management protocol parser, which in particular handles wake-on-LAN.

This question asks for firmware on video cards. As I write, no one has given an example of a malware in the wild, but the possibility is definitely there.

There is no real protection against compromised firmware on a typical PC. You'd need to keep track of every single piece of flash memory in the computer. There are efforts to require firmware to be authenticated; on PCs, the most advanced such effort is the TPM, which currently can check the integrity of the BIOS and the OS bootloader, if you have the required hardware and a BIOS that supports it. I'm not aware of a PC where all components have their firmware checked for integrity (at least, before they're allowed to access the PCI bus). There are similar efforts in the smartphone world leveraging security features of ARM chips, but again it's a far cry from the existence of security feature to the inclusion of all firmware in the trusted base.

In practice, if you aren't a high-profile target, you don't need to worry much. There aren't any exploits in the wild at script kiddie level. But the possibilities are rife for your attacker with technical skills (or the means to hire a skilled hacker).

Firmware attacks are becoming easier over time. At Black Hat USA 2012, Jonathan Brossard presented “a generic proof of concept malware for the intel architecture, Rakshasa, capable of infecting more than a hundred of different motherboards”. The proof-of-concept (not publicly released) infects many BIOSes and common peripherals including network chips. It's only a matter of time until such firmware infection frameworks appear in the wild. The NSA has been reported to favor planting spyware in the BIOS.

share|improve this answer
7  
The reason Firmware exploitation isn't common is that firmware is hardware-configuration specific. Malware authors don't want to spend that much time developing an exploit which targets that small of a minority of users. –  Billy ONeal Sep 16 '11 at 15:44

Depends on what you consider to be "a clean install".

Besides what D.W. mentioned, some stuff could remain in for example "System Volume Information" and/or recycler directories (system restore and recycle bin directories) on any additional partitions you might have. That could easily reactivate on a fresh Windows installation but it most probably won't work on Ubuntu. Anyway, if all these other partitions do not get desinfected, it means there still might be some malware somewhere in these directories - probably not doing anything, just waiting for better days, for Windows to get reinstalled ]:-> but still there.. What I would suggest you do after installing Ubuntu is installing clamav, updating it and rescaning everything you have..

If you really do format everything, there are still the points D.W. made.

share|improve this answer

In addition to hiding your code amongst various and sundry peripherals, an old technique that is making a comeback is the boot sector virus. Torpig/Sinowal/Anserin is the most recent example of judicious use of this technique. In short, once infected the virus will load some bootstrapping code into the MBR. If this technique is used, one can expect the code loaded into the MBR to do the following:

  1. Check to see if the virus is present
  2. If not, then download and re-infect

The only way to reliably clean something like this up to clean up the MBR. Either through re-partitioning, or using a tool like fixmbr. As such, simply doing a reinstall, and sometimes a format/reinstall, is not enough.

share|improve this answer
1  
Reformatting the entire disk should remove this from the MBR, shouldn't it? Am I missing something? –  D.W. Sep 16 '11 at 22:56
2  
Reformatting, no, repartitioning, yes. By default fdisk doesn't fiddling with the MBR unless it has to, or you specifically tell it to. –  Scott Pack Sep 18 '11 at 16:07
    
Thanks for the explanation, Scott. Can you help me understand better? If I reformat and install a new operating system, I would expect the MBR to get overwritten. (I would expect the OS installer to install the bootloader onto the MBR, and potentially to write a new partition table. For instance, on Linux I believe grub-install overwrites the MBR, and grub-install is run by the standard OS install process. I would expect something similar from the Windows install process.) Is my expectation inaccurate? –  D.W. Sep 18 '11 at 23:49

Malicious code inside BIOS/firmware it's possible, but many more realistic threats are often overlooked. Two examples off the top of my head:

OS Repos/Images: They may be compromised, so you are essentially reinstalling a backdoored OS or Software every time you reimage your systems.

Out of band management: HP's ILO, Dell's IDRAC or IPMI. Even reinstalling your system, whoever has compromised it may already know that there is out of band management with console access available.

share|improve this answer

It is my habit to zero the boot sector and update (or just reflash) the BIOS in such cases as well, just to guard against particularly resilient persistence. It's unnecessary almost all the time, as usually viruses persist either in the network or in the OS, but if you want to be sure you should take precautions against other types of persistence too.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.