0

I have movies other files. I would like to be able to open use safely without risk of infecting the host OS. So they would be opened from an external hard drive with the internal hard disk removed. I've done some research into this, and the live OS has access to the internal hard drive and external.

I want to know if people think this seems like it would be reasonably safe.

This information I found on that.

Use a live CD with a Linux distro to access the untrusted USB Most popular Linux distributions can be booted directly from USB devices. Download one, boot into it from your USB, and now safely read the contents of the other untrusted USB drive you just found. As a USB booted Live OS would use only your RAM, nothing malicious would ever get into your hard disk. But to be on a safer side, disconnect all your hard drives before you try this.

Technically, a virtual machine is the least safe way available to access a random suspicious USB device. Like any software, virtual machines are vulnerable too.

I had been thinking about buying a read-only DVD-r or CD-R might provide more protection or a write protected USB stick. Then I found this explanation of live OS

A LiveUSB installs a read-only image (like the one you would get on a DVD), but creates and sets aside one additional partition for the storage of data. Since the read-only image is compressed, it can take up little space and the rest of the USB stick can be used for persistent data. This is necessary because a non-persistent LiveUSB works by first creating a RAMdisk, then loading the whole OS into this volatile virtual disk. Upon shutdown, your data would be lost. A persistent LiveUSB works the same way except that /home is mapped to the USB partition set aside for data. The whole OS still loads into RAM, but your data is on the separate partition in your USB stick.

So because it says it installs as a read-only image I'm not sure a CD-R or DVD-r or write protected USB would make a difference?

Obviously any potential malware would have access to the external USB drive it's running from as well.

Improve this question
13
  • 2
    Even with live systems you can persist files on the USB normally. Fwiw I recently went through a class on analyzing malicious documents and we ran live examples in a vm. VirtualBox worked just fine and you can get pre-built windows vms from Microsoft developer.microsoft.com/en-us/microsoft-edge/tools/vms just make sure your host machine is fully patched, virtual box is fully patched and fully patch the vm you download. Also you probably want to kill the network connection to your vm. You'll be fine
    – DotNetRussell
    Commented Jul 15, 2018 at 13:37
  • 1
    My concern was if i used a normal regular usb for the live os, maybe it can write some permanent changes to the live os itself? maybe not since that person suggested it's installed as a read only image. That's why i had thought maybe a write protected dvd cd or usb may be needed.
    – Alister
    Commented Jul 15, 2018 at 13:44
  • You can write to live USB. I do it all the time.
    – DotNetRussell
    Commented Jul 15, 2018 at 13:45
  • I would rather use the live usb if possible, running a vm on my use case might not be preferred, they may of been suggesting a vm has more possibility of an exploit then a live os however slim the chance may be. I think the main risk of a persistent file been written to the external hard drive would be a mbr rootkit if you turn the computer on with that usb plugged in it will infect the host drives mbr i believe. I do wonder if malware could get persistence on a live usb itself also.
    – Alister
    Commented Jul 15, 2018 at 13:48
  • 1
    @Alister A "live" system can write to internal HDDs, external HDDs, USB drives, and everything else, without any problems. Not just the MBR but everything there is not safe.
    – deviantfan
    Commented Jul 15, 2018 at 14:16

1 Answer 1

Reset to default
1

"Technically", live CDs are far more dangerous as a platform for malware analysis than a VM, because the live OS is still interacting with the hardware directly.

Harddisk infection aside, running in a live environment usually means full network access to the OS, so I sure hope the malware doesn't spread laterally. Malware analysis VMs are configured to limit network access, and even sometimes make use of emulated/simulated traffic to allow the malware to 'interact' with remote servers without actually having network access(e.g. FakeNet).

I don't know why someone who does malware analysis is telling you to use a live OS, but I'd be highly skeptical of their experience. The only reasons for using bare-metal have to do with bypassing unknown VM-evasion techniques, and should only be employed by organizations with the know-how and need to reverse-engineer those evasion techniques... so they can then be incorporated into the virtual detonation environments.

If you're truly worried about vm-escaping malware... double-up your VMs, e.g.

Windows host => HyperV => Ubuntu guest/host => VirtualBox => Windows7 guest

This is obviously paranoid overkill, but it's still preferable to a live OS where you don't have perfect control over hardware/networking/etc. I've seen malware on Windows that actually disables and re-enables network adapters once it has admin access, if it's unable to communicate with its C2 servers, configures proxy settings, etc.

Improve this answer
11
  • 2
    Nesting on VMs actually reduces security by forcing VT-x to switch to a very hacky mode used to support multiple nested machines... This can greatly reduce security.
    – forest
    Commented Jul 20, 2018 at 22:18
  • I actually wonder if that is still true? I can't find anything recent saying it reduces security, and in fact it's touted by Xen and Microsoft as a feature they support. wiki.xenproject.org/wiki/Nested_Virtualization_in_Xen thenewstack.io/azure-ahead-nested-virtualization
    – Angelo Schilling
    Commented Jul 20, 2018 at 23:57
  • 1
    It increases complexity without really increasing security. You can get a superior increase in security by using, say QEMU/KVM with sandboxing enabled without enabling complex hacks.
    – forest
    Commented Jul 20, 2018 at 23:58
  • it increases security from the standpoint of vm-escaping malware; I've never once heard of vm-escaping malware not being platform-specific. can you argue it reduces it from a business-operations standpoint because of reduced stability? sure. That's wholly different, though.
    – Angelo Schilling
    Commented Jul 21, 2018 at 0:00
  • 1
    Nesting VMs arguably reduces security from VM escapes as now there is more attack surface area to hit which can allow bypassing every "layer" in a single go. Something silly like nesting VMs is like chaining proxies. It's not a well thought-out mitigation to a specific threat. It's a knee-jerk reaction that assumes that more layers = more security. VT-x is complex, and there is no guarantee that a vulnerability can only break out of one VM at a time. The ones that can usually exploit emulated drivers (meaning userspace sandboxing is a solution, e.g. with QEMU)
    – forest
    Commented Jul 21, 2018 at 0:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .