3

Hypothetically let's say I have reason to believe my operating system is compromised with spyware, and there's no way to remove or disable it. But I have an advantage insofar that I know the IP addresses the spyware is sending my info to, so I can mitigate the damage by using my router's firewall.

But then I want to take the computer traveling, which means it won't be under my external firewall whenever I connect to WiFi abroad and what not. Is there a way to virtualize a hardware firewall so that I can be confident that the spyware's TCP/IP packets are nullified? (I can't just install a software firewall within the OS because I don't know if the spyware would have some way of compromising it; say, via a rootkit or something similar.)

EDIT:

I guess the hypothetical was too specific, so I'll try to be more clear. I'm looking for a way to nullify (with certainty) TCP/IP packets being transmitted from an OS that may be compromised. So one way to do that is to use an external firewall like a router, but suppose you can't use that because you're traveling. The only solution I can think of is to put the entire OS in a virtual machine and then use the host OS's firewall, but is there any other possible solutions?

  • How would you be sure, on an already compromised machine, that you're indeed setting up virtualization software and installing a firewall OS inside it, and not simply having the malware pretend to do all that while in reality doing nothing? – André Borie Jul 25 '16 at 21:51
  • 2
    Hypothetically, I'd say you're crazy. :-) – Bryan Field Jul 25 '16 at 21:54
  • Add wireless capabilities to your external firewall and bring it with you on your travels. :) – user2320464 Jul 25 '16 at 22:01
  • Would it be possible to make some kind of USB router so my compromised computer can't connect without it? – lightspectra Jul 25 '16 at 22:22
  • But suppose you have no Ethernet port, and it's some kind of private router like at a hotel. Is there some kind of portable or virtual solution, short of running the whole OS in a virtual machine? – lightspectra Jul 26 '16 at 1:03
0

I guess you already know this, but you are in a precarious situation. Other malware you are not familiar with may have already be installed remotely.

To answer your question, certainly it is possible. Linux operating systems are commonly used as router/firewalls, and they can be run within a VM.

However, it may be simpler to customize the Windows Firewall, as that can be configured with filters on outbound connections by IP address. (not just listen sockets as is the default configuration)

Both of those run within the compromised machine so they could be bypassed.

The best solution (short of removing the malware which you should be doing) is to have a separated firewall device which you connect to with a direct cable connection. You should disconnect or power off the WiFi connection ability of your laptop.

Be sure to configure your Firewall to use a white-list (only allow known good IPs) and not a black-list (I think these are the only bad IPs so I'll block them) because you never know if it might try a different IP at some point. Sometimes malware is set for a delayed install.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.