Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I took a clean computer/laptop and removed the harddrive, lock the BIOS with a password, then did all my work from a live OS like Knoppix, will this help reduce the risk of persistent malware infection? Assuming the computer was free from malware to begin with and that the image used is clean.
Excluding physical access to the machine, what threats are possible for a use case like this?
Assuming that it's a CD/DVD Knoppix, and not a USB based one, you're basically running a computer with no writable storage at all, so yes, of course it will reduce the risk of persistent malware infection.
At the same time, you cannot update your system [permanently], so you would be somewhat easier to infect than using an up-to-date system.
To counter that, you could 'extend' your boot procedure to include securely updating everything on each bootup (and that would still miss kernel updates), which may take a while. Also, if you never rebooted your system, not having a hard disk would be irrelevant, since it would be enough to infect the current session.
Please note that this setup is not completely risk free. An attacker could place a malicious code providing the persistence in one the devices' firmware (the BIOS password is not helpful here, since that would only deter physical attacks).
Finally, remember that you might have a 'persistent infection' on a diskless machine by periodic reinfection. Suppose we have a setup with multiple diskless machines that boot from a clean state and within 5 minutes have all patches applied (since otherwise they would be vulnerable to eg. CVE-2008-4250). You may find out that you have all these computers infected, and that when you reboot one of them, their partners reinfect it before it manages to update itself.
Of course, if you are not building a kiosk, and expect to work with any kind of persistent data, an infection might be carried on usb sticks, mail attachments, etc. just as could happen to any machine with a hard disk.
