0

I was wondering. An operating system is a very important vector in an attack. If someone wants to hack your personal system he needs to know the operating system to know which exploits to use for example.

But if you switch which operating system you use (e.g Debian -> OpenBSD -> Mint -> Arch -> FreeBSD -> ...) every week; do you become harder to attack?

Advantages:

  • The attacker would have to search for exploits each time again
  • Your system would be always up-to-date (newly installed)
  • Most malware would get deleted at each new install
  • If someone wants to infect you, he has to adapt code, compile, and infect you in one week.
  • You're harder to fingerprint
  • ...

Disadvantages:

  • Security- & Anonimity configuration needs to be configured each time again (error prone: e.g configuring Tor wrong)
  • If you switch to a weak protected operating system for a week, you're very vulnerable for that week. Kind of a Russian roulette.
  • Lost of data each time (back-ups from old system can contain previous malware)

I know that when you switch from Linux distro A to distro B you still have the same kernel, but yet A can have vulnerabilities B doesn't have. The kernel is often adapted and not the only software in an operating system.

So, is it a good security practice to switch operating systems often considering the following cases separately:

  1. Just normal use (browsing and downloading stuff)
  2. To stay hidden and anonymous
  3. If you know someone wants to hack your system

Would switching operating systems be more secure in one of these cases? Why (not)? Would it be more/less secure than using an updated LiveOS?

Anything else?

tl;dr Is switching operating systems every week a good security practice?

  • First three problems with reasoning in this question: applying good practices (like regular updates) is not a function of replacing the os with a different one; by periodically replacing the os you are increasing the attack surface; you are considering attackers to be idiots. – techraf Aug 18 '16 at 23:16
5

Absolutely not. Using more operating systems simply makes it more likely that you'll use an insecure system, and the attacker only has to wait until he gets lucky. In your example, you specify FreeBSD. Believe it or not, FreeBSD is really not that secure. It does not even have userland ASLR, which is considered one of the most basic of security requirements. If I was going after you, I would rejoice in the fact that you are jumping between systems. The same applies if you have a 0day exploit for a given system. In your very example, you specify Debian. Due to the Debian kernel configuration being so liberal, it enables an option which activates certain insecure legacy subsystems. I actually do have a 0day for it, but it does not work on the other systems you mentioned, as far as I know.

You say that the attacker would have to search for exploits each time. They don't, they just have to wait until you switch to a system that they can exploit. It's as simple as that.

In general, stick to one system. You are playing Russian Roulette each time you switch. Would you rather pull the trigger once, or many times? I would rather take a chance once, than take a chance over and over.

  • 2
    Vulnerability of a system with many OS = Vulnerability of the most vulnerable OS. – Damien Aug 19 '16 at 9:25
2
  1. Way too hard and stressful for normal use.

  2. Using something that is built to give you anonymity or pseudonymity is a way better approach. Take a look at Whonix. You can switch out the virtual machines easily and independently of each other.

  3. If someone wants to attack you, they probably know you're switching operating systems. Especially if you leak this information to the internet, for example by not keeping your user agent constant. They then can just pick an easy way to attack someone using a certain system, wait until you're using that system, and attack you. Really, that's how you become an easy target.

It is possible to keep malware on your system even if you change your operating system and even if you wipe your HDD before doing so. Malware has been hiding in external devices, in network devices like routers, in graphic cards, in BIOS EEPROMs, and even in the firmware of HDDs. If an attacker finds a way to do any of this, they aren't even limited to stealing or manipulating your data every 8 weeks for 8 weeks but instead it takes 7 weeks and 1 day until you cycle through for example all 8 systems and an attacker will easily find a severe vulnerability allowing them to for example manipulate your BIOS EEPROM in one of them. And then they got you for good.

1

Overkill

What hacker would have to do is do detect the os and check for vulnerabilities or try some custom made exploits from his arsenal.

It would not be a smart move for him to start an attack without checking the os first and just to launch the attacks based on old info gathering (few days or weeks old).

Changing the os will only increase the attack surface so it would be a big help for him. If you have a skilled hacked on your tail changing the os will only add a delay.

To stay hidden and anonymous you can use other means like Tails, Tor and other tools to hide your location.

Consider using a dedicated pc on which you can install a clean os with all the software you need, after this you should not use any accounts/data that can lead to you (like social networks accounts, email accounts or others).

1

Others have pointed out the risks of increasing the attack surface due to increasing the number of possible exploits when switching between systems. On the other hand, assuming you have a certain set of applications you will want to use, these will probably be the same across different systems, which might make it possible to use the same or similar attacks across several of the OS'es you might use.

I'd consider one more thing though: Monitoring.

If you use one specific system, you can make sure you understand it and are able to secure it fairly well. On top of this, you might add some form of monitoring (anything from logging to intrusion detection, or possibly honeypots that can trigger an alarm of some sort when a possible attack occurs).

If you really are worried about being attacked, then you should keep monitoring your system over time and look for trends and possible anomalies. Switching between different systems is at the very least likely to make this more of a hassle.

In short, I'd recommend you choose a system you're comfortable with, secure it as well as you can, and then make sure you keep monitoring it and updating it on a regular basis.

1

Just a complement to other anwsers. Securing a system is a hard job that requires a good knowledge of it. The more systems you use, the harder it will be to have be an expert on all of them, able to know perfectly the correct way to configure them.

In short, the more systems you switch, the higher risk to have a badly configured system you get.

0

Some of the systems you listed are Linux systems, which means they use Linux kernel - that's a unifying factor. Thus , an attacker doesn't have to attack your exact OS version, they can choose from Linux kernel vulnerabilities.

Possible attacks go way beyond just operating systems. Web browsers have tons of vulnerabilities , too. For example , CVE - 2015 - 6792 operates on Google Chrome, which operates on MIDI subsystem.

In addition, it's not always necessary for attacker to break into your system. Attacker could be sniffing your network traffic to get information.

Switching OS every month or week may make it harder for someone to hack you, but not impossible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.