0

Assuming that a malign user has unlimited resources at his/her disposal to infect a computer running Ubuntu, but he/she is only limited in transferring the malware through an optical disc (CD, DVD, BD etc.). The computer is assumed to be malware free at any level of software and hardware, most importantly the optical disc drive firmware is not altered. If the computer user inserts the malicious disc in his optical drive, can the malware automatically activate without the user's interference?

P.S: In Windows, such infection methods are possible through Autorun, but in Ubuntu, even if auto-running software is enabled, the user gets prompted to execute it.

Improve this question
1
  • 1
    Just a side note: Autorun is disabled by default ever since Windows XP SP 3 (if memory serves correctly), for exactly this reason.
    – user163495
    Commented Jun 27, 2019 at 7:24

1 Answer 1

Reset to default
0

My best guess would be that the disc is carefully crafted (using typical optical disc burning methods) to exploit security holes in the optical drive firmware or the auto-running software of Ubuntu. So yes, having unlimited resources one can achieve what you are describing.

Improve this answer
2
  • 2
    It would require finding a security problem in the handling of the data. There's a chance that this is possible, but it's not certain. This may for instance be an buffer overflow. It also assumes that the OS does anything at all when a disk is inserted.
    – vidarlo
    Commented Jun 26, 2019 at 23:07
  • @vidarlo Pretty much every modern Linux distribution mounts the disk when it's inserted, which means reading data from it, so that's your attack vector. The rest I'd completely agree with. It's possible, meaning you can't prove it's impossible. But it's certainly not guaranteed such a bug exists.
    – Steve Sether
    Commented Nov 23, 2019 at 23:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .