Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Let's say I have two different OS on my PC, Windows 10 and Linux. It is well-known that Windows collects a significant amount of information and sends it to Microsoft's servers, but I wonder if it "leaks" into other parts of software/networking on the computer.
Is it possible for someone to enjoy the functionality and entertainment of Windows and privacy of Linux?
Windows will have full hardware device access while it is running.
If the Linux partitions are encrypted the data within them is safe from exposure that way.
However malware infections obtained while running Windows could manipulate the bootloader to produce a fake disk encryption prompt that steals your master encryption key. This is fairly elaborate, but not inconceivable if the motivation is sufficient.
It's a trade-off. If you dual boot, be sure to use full disk encryption on both OSes to prevent them from seeing each other's files.
If you want full separation you are better with separate hardware for each OS.
A great option proposed bt @R.. and @NathanOsman in the comments is the use of a hypervisor to run the more at-risk OS. In practice I run Windows inside VirtualBox, but there's an even deeper solution to this called QubesOS which runs Xen on the hardware and runs apps in AppVMs using windows seamlessly integrated into a shared secure window manager.
A third option (with bare-metal perfomance for Linux, Illumos, and Solaris 10 or under native apps) is OmniOS or SmartOS with lx-branded zones and KVM. There's no QubesOS-equivalent window manager for that approach yet so you'd have to use VNC or Spice to access the screens of the VMs.
Good question.
When not encrypted, they can indeed affect each other. All you have to do is mount the other drives, or partitions. If you have firmware-level malware, it's a trivial task to get your encrypted disk key. Even when encrypted, you can still access data each way; it just won't be useful until you decrypt it.
Without encryption, you don't even need the malware to reside at the firmware-level; the right malware will be able to read everything. Data can leak to and fro.
Most Linux distributions are open source, so finding out how the data is encrypted is a trivial task if you know what you're doing. That doesn't make it much easier to outright decrypt it, though.
Knowing how the full disk encryption work is not equivalent to being able to decrypt it. You still need the master key which is not stored. That's the FDE password that you get prompted for on boot.
Getting the password can be trivial with the correct malware.
Here's how an attack could work (I've removed the ordered list since some steps can be done in different orders):
hibernation files / ram dumps / memory dumps, and analyze these on the user's system, or send them to yourself (depending on the size and network speed, it could take a long time) for offline analyzing purposes. But is this sort of attack easy? Maybe not. It takes a lot of time and effort, unless there are tools I'm unaware of which automate much of the process. Is it possible? Yeah, but implausible. The question is: are you important enough to warrant this kind of attack against you? I doubt it.
Is it possible for someone to enjoy the functionality and entertainment of Windows and privacy of Linux?
Yes. If you're genuinely worried about security, use encryption and two separate computers. If you're not, then dual boot. I'd still recommend encryption either way.
Unless you are mounting your windows partitions in Linux, or your Linux partitions in windows, I don't see much harm that could be done. If you get a virus that likes to screw with disks, MBRs, or partitions, then it might cause some issues, as for data collection, unless it's taking a raw snapshot of the disk, Microsoft can't really steal your Linux info. If you really are paranoid about windows reading your Linux partitions, Linux makes it really easy to encrypt everything.
Yes! Both directly and indirectly. If they are running on the same machine the problem is that an operating system has full access to the hardware (physical or virtual) that it's running on; this includes non-volatile storage such as discs, CMOS and firmware configuration data. Windows (used to) store time in the CMOS relative to the locale of your machine; this means that if you live in a timezone that is not GMT the time that Windows seens is different from what most other operating systems see.
Since the OS has full access to all discs it can do anything to that disc, including, if it has the key, decrypting it! If it doesn't, it can still wipe it, by design or by accident.
An operating system may change the bootloader which means it can change how any other operating system starts -- this could be used to hijack an operating system by wrapping it in a (compatible) hypervisor or just boot it up in a virtual machine which marshals IO properly. I am not aware of any such virtual machine but if you have the systems on two separate discs it won't have to marshal the IO at all.
For machines on the same network, you have the problem that any information coming out of that network is likely to be related to the entire network; you could infer a lot about you if you have direct access to one of the machines and can monitor anything that machine does and then correlate that with information based on the network itself. Even just analyzing your network, without a local spy, you can learn a lot about people.
It might also be possible that your spy-machine actually gets access to the entire data stream of your network; not just the bits that the spy-machine should get, but potentially also the data streams intended for another machine. This data could be analyzed and transmitted to a third party. This is a highly unlikely if you have a proper router/switch, but it's not entirely impossible.
Unless you are explicitly using encrypted communication anyone can listen in -- on your local network or outside it. All of your network data is vulnerable and to avoid any data from being intercepted you must use a good encryption scheme. This is not the norm.
