1

I'm aware of bootkits and booting a device causes it, so if i'm reinstalling the OS and the stick i'm reinstalling from is compromised will it cause infection during installation itself?

The hard drive i'm installing to is set up as GPT i no MBR is definitely effected by a bootkit, i'm assuming the only way to avoid that would be a live cd for install as long as the long as the .iso itself isn't compromised or it isn't compromised while burning the dvd/cd.

Or a brand new clean USB tho plugging such a device into a compromised system to set it up for OS installation would likely just compromise it.

I'm assuming as long as the .iso isn't compromised burning it to dvd from a potentially infected machine should end without it been able to function as a bootkit would?

Thanks.

1 Answer 1

0

You don't need to go overboard... Any USB installation drive created on a clean computer is enough, you don't need to buy a new USB drive just for this.

Even a computer infected with a bootkit will not load this bootkit unless booted from the infected device. If you boot from another device, the bootkit is just data sitting on the disk.

There's BIOS infection too, but those are so rare that unless you are a journalist on an oppressive regime, or a person of special interest that an attacker would pour hundreds of thousands of dollars to compromise, you don't need to worry about. So don't worry about.

6
  • Not sure about that, you would have to delete the MBR and Partition table ect to remove the bootkit, simply setting it up as installation drive on a clean pc wouldn't fix that would it?
    – Alister
    Mar 12, 2020 at 2:02
  • Assume i have a compromised pc, no clean pc to fix this. Plugging any usb into a pc you have booted from "compromised" could infect any usb. Is burning a clean .iso from this compromised machine a way to guarantee no risk of bootkits on the DVD drive? my concern is my USB i'm reinstalling my pc from is infected there's no clean pc to work with. Simply setting it up for an os installation isn't going to remove a bootkit from the drive, and if i boot a live os from another compromised usb to delete the mbr then use my pc to set it back up can lead to infection again, maybe even from the live usb
    – Alister
    Mar 12, 2020 at 2:10
  • Even an infected computer is somehow safe. Unless you got a malware that actively looks for installation media and infects it (I never saw anything like this), you would be safe. If you run Windows, create a Linux install disk, boot from it, create a Windows install disk from the Linux live environment.
    – ThoriumBR
    Mar 12, 2020 at 12:51
  • wasn't that virus that made Iran's centrifuges go hay-wire transmitted via USB stick? I think that's at least one that infected removable media...
    – pcalkins
    Mar 12, 2020 at 20:35
  • Yes, Stuxnet. But it was made specifically to attack that installation. It costed a fortune, was made from a government to attack another government, and I would consider it a cyberweapon, not a malware. Not OP's case, not even close.
    – ThoriumBR
    Mar 12, 2020 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.