1

I have an old hard disk which I think has every kind of malware on it, maybe even MBR malware. It is also possible that there is malware for Linux on it too, because the disk is a dual boot Windows XP - Ubuntu.

I want to completely wipe this disk to use it as secondary hard disk. I tried dban to do it but it gives me an error when I start the wipe. So I'm going to wipe the disk from an Ubuntu live USB with the command dd if=/dev/zero of=/dev/sda. However I'm not sure if there is a possibility that some malware on the hard disk can infect the live version of Ubuntu. I think it is impossible since the PC will boot from the USB and any code on the hard disk won't be executed. Am I right?

1

Correct. Any kind of malware can't be running if you boot from USB stick. Of course I suppose you are using different PC with different motherboard than that one the HDD was plugged to before. Moreover, I can hardly imagine it would run under linux if it is Windows mallware ;)

Edit: what is strange to me, the error you've got when you tried to DD it under debian...

  • Thank you for the answer! No not debian, DBAN, the utility for wipe hard drives! – zack May 29 '17 at 12:30
  • Oh, sorry, I can't read. – Fis May 29 '17 at 12:31
  • No problem. And yes, I am using a different motherboard from than that one the HDD was plugged before! – zack May 29 '17 at 12:37
1

Previous answers are valid and sufficient for most practical purposes.

From the paranoia of past mistakes made:

  1. Bad BIOS threat: Yes, this is a bit extreme, but if you had booted a system with that Malware-laden hard disk you might not want to trust its BIOS too. Make sure you're plugging the old hard disk into a known clean system.
  2. Boot menus: Know which MBR you're booting from. I did see a system where MBR from one drive loads the /boot from another. You want your BIOS/EFI loading the MBR from USB directly; not a custom-bootloader on your HDD offering to boot from USB.

That said, if all you do after booting with the USB is to run the dd command you mentioned, you should be good.

  • I've just finished to wipe the hard disk with the DD command. Yes i know that there are BIOS viruses, but i'm pretty sure this is not my situation. Before booting PC from USB, I've set boot option 1 as USB device and i've disabled all others boot options, should this be sufficent to be sure that the BIOS had loaded the MBR from the USB and not from the hdd? – zack May 29 '17 at 19:52
  • Yes, it should be sufficient. :) – Sas3 May 30 '17 at 2:46
0

As Fis already stated will the system not run code from the HDD. But you should make shure that really every part of the Disk will be wiped since malicious code can be stored in Slack Space. (See here and here).

Furthermore you should not trust every application. In some cases where your disk is not written equaly often the OS wants to optimize the usage and makes your "deletion" useless that way. Please refer to this question on askubuntu to get some examples for save deletion, too.

  • Ok thank you! From what i've understood, the DD command should wipe every part of an hard drive. – zack May 29 '17 at 19:55
0

To add onto the other answers, it may be worthwhile to pull the HDD, boot without it connected, and then use a USB (preferably 3.0+) adapter to reconnect the drive to Ubuntu after booted with the live CD. From there, proceed to dd the drive. This eliminates any possibility of an infected MBR taking over the live CD, unless the BIOS has been infected.

Generally (read: generally, excluding circumstances where wine may be installed), autoexec's are not ran by default that would otherwise be ran by Windows-based OS's.

  • Thank you for the advice, but i've just finished to wipe hard drive, do you think are there any risks to boot the live USB with the hdd connected to the PC? – zack May 29 '17 at 19:58
  • @zack My only concern would be the Windows MBR potentially "assisting" you with the boot to your live USB/CD. – 1234567 May 29 '17 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.