0

Assuming that a malign user has unlimited resources at his/her disposal to infect a computer running Ubuntu, but he/she is only limited in transferring the malware through an optical disc (CD, DVD, BD etc.). The computer is assumed to be malware free at any level of software and hardware, most importantly the optical disc drive firmware is not altered. If the computer user inserts the malicious disc in his optical drive, can the malware automatically activate without the user's interference?

P.S: In Windows, such infection methods are possible through Autorun, but in Ubuntu, even if auto-running software is enabled, the user gets prompted to execute it.

  • 1
    Just a side note: Autorun is disabled by default ever since Windows XP SP 3 (if memory serves correctly), for exactly this reason. – MechMK1 Jun 27 '19 at 7:24
0

My best guess would be that the disc is carefully crafted (using typical optical disc burning methods) to exploit security holes in the optical drive firmware or the auto-running software of Ubuntu. So yes, having unlimited resources one can achieve what you are describing.

| improve this answer | |
  • 2
    It would require finding a security problem in the handling of the data. There's a chance that this is possible, but it's not certain. This may for instance be an buffer overflow. It also assumes that the OS does anything at all when a disk is inserted. – vidarlo Jun 26 '19 at 23:07
  • @vidarlo Pretty much every modern Linux distribution mounts the disk when it's inserted, which means reading data from it, so that's your attack vector. The rest I'd completely agree with. It's possible, meaning you can't prove it's impossible. But it's certainly not guaranteed such a bug exists. – Steve Sether Nov 23 '19 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.