If I took a clean computer/laptop and removed the harddrive, lock the BIOS with a password, then did all my work from a live OS like Knoppix, will this help reduce the risk of persistent malware infection? Assuming the computer was free from malware to begin with and that the image used is clean.

Excluding physical access to the machine, what threats are possible for a use case like this?

  • Infecting documents with overflows and dangerous macros. I presume you don't want to start over each time you boot your computer. Applications such as browsers may be vulnerable if they don't get updates as well. If there are breaches into the BIOS then that may still be affected as well. Same for any hardware that doesn't get any firmware updates. Rowhammer. Meltdown / spectre. Actually, you would be vulnerable against anything that doesn't try and update your executables, probably more so. – Maarten Bodewes Feb 1 at 22:53
  • Required understanding: xkcd.com/1200 – Maarten Bodewes Feb 2 at 0:14

Assuming that it's a CD/DVD Knoppix, and not a USB based one, you're basically running a computer with no writable storage at all, so yes, of course it will reduce the risk of persistent malware infection.

At the same time, you cannot update your system [permanently], so you would be somewhat easier to infect than using an up-to-date system.

To counter that, you could 'extend' your boot procedure to include securely updating everything on each bootup (and that would still miss kernel updates), which may take a while. Also, if you never rebooted your system, not having a hard disk would be irrelevant, since it would be enough to infect the current session.

Please note that this setup is not completely risk free. An attacker could place a malicious code providing the persistence in one the devices' firmware (the BIOS password is not helpful here, since that would only deter physical attacks).

Finally, remember that you might have a 'persistent infection' on a diskless machine by periodic reinfection. Suppose we have a setup with multiple diskless machines that boot from a clean state and within 5 minutes have all patches applied (since otherwise they would be vulnerable to eg. CVE-2008-4250). You may find out that you have all these computers infected, and that when you reboot one of them, their partners reinfect it before it manages to update itself.

Of course, if you are not building a kiosk, and expect to work with any kind of persistent data, an infection might be carried on usb sticks, mail attachments, etc. just as could happen to any machine with a hard disk.

  • And internet storage is of course not that much different from a drive, although cloud services may of course also include virus protection (but then again, so do many operating systems). – Maarten Bodewes Feb 2 at 2:43
  • @Ángel: Hi. Thanks for answering. I'm not quite getting the how 'persistent infection' works in the case of the multiple diskless machines setup you mentioned. Are these machines booting from and getting their patches applied over a network? – user942937 Feb 11 at 10:55
  • Also, except for the case of a BIOS infection, will any of the aforementioned infections survive a reboot? – user942937 Feb 11 at 10:55
  • @user942937 the 'periodic reinfection' could survive it, by having compromised machines infecting the cleaned ones just after bootup. – Ángel Feb 14 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.