1

I have some allegedly malicious USB drives that I want to test. I have an already installed Ubuntu OS with a guest session and the Ubuntu Live CD. Which environment setup is safer for testing the malicious drive?

Assumptions:

  1. All storage devices will be removed in the Live CD case. In the Ubuntu Guest Session case, there can be other internal drives but not external (internal drives need mounting to be accessed, external drives don't. So the first are not accessible due to root restrictions but the second are).
  2. Network connection is turned off.

NOTE: When I mean safe I do not mean 100% (because that's impossible). A near 100% suffices :-P .

7

In summary: guest account does not offer lots of protection. Use a read-only or throw away system instead (i.e. Live CD or Live USB) but even this does not offer full protection.


In detail:

Considering the case that the bad USB stick might contain a deliberately corrupted file system which causes a kernel exploit (not that unlikely, see CVE-2013-1773) then the underlying system will be compromised, no matter if this is a Ubuntu guest session or a live CD. Only with the guest account the system compromise is permanent while with the live CD its not, since a CD is a read-only medium. This will be different if you use a Live USB stick which is read-write but even then you could just re-install the stick before you use it the next time.

Even if you don't consider a direct kernel exploit through the file system but just want to execute some potentially malicious code as an unprivileged user you have to take in account privilege escalation attacks like this one which can again result in a compromised system. And even if you don't want to execute code but just have a look at the data on the stick you might run into bugs like this one where just looking at a directory using some file explorer causes code execution which of course then can do a privilege escalation attack too.

@kasperd noted in a comment that even with read-only medium the BIOS/UEFI or other firmware on the system (like network or graphics card) could be modified to make an infection more permanent. And to add to this: as long as the network connection is only logically off a malware could enable it again and then attack other devices in the system, for example the router. This is especially true when using a guest account since the connection information for the WLAN are usually stored on the system already. But this is also true when using a Live CD but the WLAN is not protected.

  • 2
    Once the kernel has been exploited the malware could flash the BIOS or the firmware on some of the hardware. Such attacks are rare, but the possibility exists. – kasperd Nov 27 '16 at 11:53
  • @kasperd: good point. I've added it to the answer and expanded it a bit too. – Steffen Ullrich Nov 27 '16 at 12:36
  • Don't most LiveCDs have fixed and well-known root/sudo passwords? – billc.cn Nov 29 '16 at 10:52
  • @SteffenUllrich - What does 'But this is also true when using a Live CD but the WLAN is not protected.' refer to? Why would the WLAN not be protected? The original poster does not ask for a solution to detect and identify potential malware. What options are there? – Motivated Dec 25 '18 at 6:34
  • 1
    @Motivated: "What does 'But this is also true when using a Live CD but the WLAN is not protected.' refer to? " - this refers to the attacker connecting from the LiveCD to the local unprotected WiFi (i.e no WPA or WEP) and attacking other systems this way. "Why would the WLAN not be protected?" - because the owner of the specific network choose so. "The original poster does not ask for a solution to detect and identify potential malware. What options are there?" - please don't ask new questions in a comment. Ask a new and complete question with sufficient context instead. – Steffen Ullrich Dec 25 '18 at 7:44
6

To add to Steffen Ullrich's answer:

Don't use either guest session or live CD/USB without further precautions. Both don't offer enough protection if you're dealing with USB drives which you expect to be malicious.

The live CD still has access to your internal storage devices (hard disks). If the USB drive really is malicious and it can attack a linux system, then it might try to install malware into the boot sector of every hard drive it finds in the system, and the live CD won't protect against such a scenario (assuming that the malware on the USB finds away to gain root permissions).

If you really want to look at shady USB drives, physically disconnect all your hard drives before starting up the live USB/CD and plugging in the malicious USB drive (I'm not sure if this is what you mean with your assumption that "all storage devices will be removed in the Live CD case").

Finally, even that might not be enough if you're dealing with a military-grade cyberweapon, which might attack firmware, but I'm assuming you're not worried about that level of threat.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.