2

In the past, it was fairly simple to create read only recovery media for a computer: you just made sure to use write once disks. This meant that if you accidentally booted the machine to the normal OS, any malware you are trying to get rid of couldn't infect the recovery media. In times past, you might even receive a premade disk (or a set of them) from the manufacturer.

However, most modern computers don't even have a CD/DVD drive anymore, and the size of recovery media is fast making DVDs impractical for this purpose. USB drives are becoming a more common alternative for storing external recovery media.

However, unlike CDs and DVDs, USB drives do not typically have hardware level protection from writes. (There are some more expensive models that have such a feature.) In fact, USB drives are (or at least used to be) an extremely simple and common way of spreading malware between computers. This makes me concerned that if the machine boots to the normal OS instead of the back up (due to user error, the BIOS not recognizing it's bootable, etc.), the recovery media itself could very easily become infected.

Am I overly concerned, or is my concern legitimate? Even though I by no means regularly contract malware, I prefer to have the peace of mind that comes with a fairly reliable recovery plan.

  • Any help on tagging would be appreciated. – jpmc26 Oct 4 '16 at 0:14
  • I'm not sure if this would work, but I remember SD cards having a switch on them which disable writing. Maybe you can use a USB to SD card converter and try that? (not tried it though) – Lucas Kauffman Oct 4 '16 at 0:48
  • @LucasKauffman My bigger concern there was whether the converter would honor the write switch or rely on the OS to, since write protection on SD cards is purely software implemented. But a possibility to keep in mind. Thanks! – jpmc26 Oct 4 '16 at 1:11
  • A not cheap solution is an isostick. It has a physical switch, and if I remember correctly they said it was a hardware switch. You can plug any size SD card into for storage. It does require FAT32 which requires you to set the split option on your archive software to 3.9gb if backing up directly to it. If just using an ISO for bootability, then the included software will auto split for you. – cybernard Oct 4 '16 at 2:48
  • keep your options open by cloning the backup on a known good computer before recovering. – dandavis Oct 4 '16 at 17:43
2

Your concern is absolutely legitimate.

My disaster recovery plan involves a Linux ISO on a read-only drive which I use to nuke compromised machines from orbit before booting on standard writable media. The machine gets nuked from read-only media (no way for malware to alter it), then is fully powered down, and finally started back up using writable media once the malware is believed to be gone (firmware attacks are excluded).

If for some reason write-once media such as optical discs aren't an option, you could try booting over the network from an up to date machine with a proper firewall configuration (that drops anything other than the required DHCP and TFTP packets).

Another solution is to simply disconnect the hard drive of the machine, boot from whatever writable media you use, and connect the drive once the machine is started off the install media. Assuming the reinstallation image is up to date, there shouldn't be too much risk of malware from the drive somehow compromising the reinstallation system and writing back on the reinstall media.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.