3

Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that after reinstallation system is still compromised through installation media? Or it is hard to automate and rather subject of targeted attack?

Improve this question

2 Answers 2

Reset to default
1

This question, like many others, falls under the category "yes, it is possible, but not widely seen in practice".

Is there known malware that spreads via Linux distribution installation media?

I didn't find anything exactly like this after performing a quick Google search. So it seems like not much is out there.

Or it is hard to automate and rather subject of targeted attack?

Not really. I have some scripts lying around that make changes to the distribution's installer image, given an ISO file. Once you know how to correctly unpack and pack different installers from their ISOs, it's not too hard to automate whatever changes you want to make. It also wouldn't be too hard to periodically scan for ISO files and infect them when found.

Improve this answer
1

I am not aware of anything that would compromise a installation media while the user is writing it. It's possible to do something like that, but it would be a very focused attack.

An attacker would need to know the installation file and the burning software. There are a lot of ways to create a installation USB media (dd, unetbootin, USB Image Writer, for example), so the attacker would need to monitor all of them, intercept the read or write, and compromise the request.

Possible, but it's easier to change the DNS and direct the user to a rogue download site.

Improve this answer
4
  • 1
    Why can't it just detect media containing boot records and try to put malware there? Is it too much there to keep this kind of attack generic to certain degree?
    – Vladimir Berlev
    Commented Nov 28, 2018 at 18:54
  • It's complicated. If you have root access on a Linux system, compromising the DNS servers is way easier and faster than to monitor every read and write operation.
    – ThoriumBR
    Commented Nov 28, 2018 at 19:11
  • You wouldn't need root access. The malware would just check mounted drives for a folder structure resembling install media for a popular distro (Ubuntu) and attempt to replace some of the binaries on that drive (sudo, or another executable which runs as root), then any system installed via that media would be compromised.
    – Daisetsu
    Commented Nov 28, 2018 at 20:03
  • To create a USB install media, you need root. You don't fdisk as normal user. Nor you dd of=/dev/sdb as well.
    – ThoriumBR
    Commented Nov 28, 2018 at 23:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .