Can live bootable usb be infected by malware on hard disk?

Question

I have an old hard disk which I think has every kind of malware on it, maybe even MBR malware. It is also possible that there is malware for Linux on it too, because the disk is a dual boot Windows XP - Ubuntu.

I want to completely wipe this disk to use it as secondary hard disk. I tried dban to do it but it gives me an error when I start the wipe. So I'm going to wipe the disk from an Ubuntu live USB with the command dd if=/dev/zero of=/dev/sda. However I'm not sure if there is a possibility that some malware on the hard disk can infect the live version of Ubuntu. I think it is impossible since the PC will boot from the USB and any code on the hard disk won't be executed. Am I right?

Answer 1

Correct. Any kind of malware can't be running if you boot from USB stick. Of course I suppose you are using different PC with different motherboard than that one the HDD was plugged to before. Moreover, I can hardly imagine it would run under linux if it is Windows mallware ;)

Edit: what is strange to me, the error you've got when you tried to DD it under debian...

Answer 2

Previous answers are valid and sufficient for most practical purposes.

From the paranoia of past mistakes made:

1. Bad BIOS threat: Yes, this is a bit extreme, but if you had booted a system with that Malware-laden hard disk you might not want to trust its BIOS too. Make sure you're plugging the old hard disk into a known clean system.
2. Boot menus: Know which MBR you're booting from. I did see a system where MBR from one drive loads the /boot from another. You want your BIOS/EFI loading the MBR from USB directly; not a custom-bootloader on your HDD offering to boot from USB.

That said, if all you do after booting with the USB is to run the dd command you mentioned, you should be good.

Answer 3

As Fis already stated will the system not run code from the HDD. But you should make shure that really every part of the Disk will be wiped since malicious code can be stored in Slack Space. (See here and here).

Furthermore you should not trust every application. In some cases where your disk is not written equaly often the OS wants to optimize the usage and makes your "deletion" useless that way. Please refer to this question on askubuntu to get some examples for save deletion, too.

Answer 4

To add onto the other answers, it may be worthwhile to pull the HDD, boot without it connected, and then use a USB (preferably 3.0+) adapter to reconnect the drive to Ubuntu after booted with the live CD. From there, proceed to dd the drive. This eliminates any possibility of an infected MBR taking over the live CD, unless the BIOS has been infected.

Generally (read: generally, excluding circumstances where wine may be installed), autoexec's are not ran by default that would otherwise be ran by Windows-based OS's.