26

Some people recommend the use of a Linux live CD for online banking, but doesn't that make you more vulnerable to network attacks since it's not updated?

I tried installing updates and it required me to reboot to complete the process, and doing so would obviously fail.

  • 1
    Rebooting is really only to update the kernel, so most software will get patched just fine. – multithr3at3d Apr 25 '16 at 17:23
  • 3
    The use of live CD is to remove the harddisk as potential threat (e.g. keyloggers). By using a live CD the virus isn't able to execute. However the attacker could create viruses that affect the firmware of the computer thus making the use of live CD useless. – Bakuriu Apr 25 '16 at 19:36
17

Potentially, yes. That said, many distributions (e.g. Debian, Ubuntu) run package versions which are extremely out of date (years) with few backported security patches, and most people do just fine. You're also usually only exposed on the network you're immediately connected to, so if you're only using a trusted LAN then it's not so much of a concern.

Personally, if I were particularly paranoid, I'd get hold of a cheap Android tablet and lock it down, and use that as a dedicated banking device. This allows for updates and means you're running a much smaller attack footprint, with less likelihood for compromise (you're not doing general purpose browsing on it) so there's less to worry about.

  • Comments are not for extended discussion; this conversation has been moved to chat. – schroeder Apr 25 '16 at 23:09
  • 1
    I want to point out that choosing an "Android Tablet" is Polynomial's personal choice. Other alternatives has been discussed in the extended discussion of this answer. – lepe Apr 27 '16 at 2:10
7

There is a potential risk in using old versions, but in many cases this risk is less significant than the risk of using reasonably patched system which has all sorts of dubious software installed, and may possibly contain malware. There are of course distributions dedicated for use as a live OS dedicated for doing such things as banking. They are hardened by design and are more secure than most other solutions (e.g. a generic Ubuntu live DVD).

Probably even better thing to do would be installing a Linux distro on a thumb drive and using it solely for banking. Having it installed on writable media allows for updating it (one can even add an update/upgrade command to the boot scripts). This would provide you with a live OS that is fully updated and patched. Keep in mind though that since it allows writing, it can be infected with malware just like your normal OS, and therefore you should not use it for anything but banking.

  • What Live CD distributions are hardened by design? – Motivated Dec 25 '18 at 6:36
  • @Motivated Tails is a hardened live distro by design. You can use Unsafe Browser to access internet w/o going through tor. (You don't want to do e-banking over tor.) – Alex Vong May 13 '19 at 12:55
3

If you used a LiveCD and never/rarely went out of your way to get a new one, yes it would eventually contain old and buggy software. However, the point of the LiveCD is that there is nothing saved in a nonvolatile way, so even if you do manage to luck out on your "risky click of the day" and the browser downloads some malware, all you have to do is hit the power button and it's gone. Also, given that it's not customizes at all and is only as expensive as a blank cd/dvd, you can easily toss it and get a new version.

RCE exploits (i.e. a bug that allows a remote attacker to execute code and gain control of your system, over the network, at will) are so exceedingly rare that even if you don't refresh your LiveCD more than once a year, you are still quite certain to be safe.

But fear not! If you do lose sleep over the thought of out of date LiveCDs, there is a quite popular process to do the exact same thing (install a limited feature, secure OS) on a thumbdrive which can then be updated on the fly. If you want to take it a step further (and spend a small amount of money) you can even purchase a pre-made one specifically optimized for this purpose (this is not a product endorsement): http://www.zeusgard.com/

  • "There is nothing non-volatile" surely? – richzilla Apr 26 '16 at 7:58
  • indeed, I was reaching for non-volatile, as in saved for later use after a reboot. thanks! – Jeff Meden Apr 26 '16 at 12:37
  • Remember that a Live CD can still access local drives (if mounted), which could potentially infect or damage files. Specially if you run applications as root inside a Live CD. – lepe Apr 27 '16 at 2:14
  • @JeffMeden - The link to Zeus Gard doesn't appear to be valid any longer. What other options are there? – Motivated Dec 25 '18 at 6:38
  • @lepe - Do you mean so suggest that if the local drives are not mounted, the risk is non-existent? – Motivated Dec 25 '18 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.