0

Following a previous question (here), I've been considering more extended measures to certified (not entirely though) the safety of my computer. For the sake of clarity, the compromised status of these drives would potentially come from a SSH break-in via root user. The answer provided in the previous question is very good and pretty clear in stating the weak possibility of a break-in, but I'm not well versed in information security and I'm really surprised with these botnet attempts. Hence, I'm considering to cleanup my system to have some peace of mind. I'm particularly concerned because a SSH root access seems much more serious than a rootkit/malware infection from a compromised application downloaded from the internet.

The measures that I discuss here cover software rootkit/malware and will leave hardware rootkit/malware for a separate question.

NOTE: As explained in the previous question, this computer has been refitted given current needs. In this case I've installed Win10 together with Ubuntu in the SSD, so the partitions are totally different from the previous OS installation. As well-known, Win10 has created new partitions as well as Ubuntu (/, /home/, and /swap), then maybe this new configuration already took care of getting rid of the software rootkit/malware. However, I possibly need to sanitize this SSD entirely against any presence of malicious intervention at GPT level since I'm not sure Win10 would reformat the GPT at the installation process.

Given my hardware configuration, I have to deal with two disk volumes:

  1. bootable SSD:

In view of the possibility of rootkit/malware at the GPT/MBR/VBR , I'm considering to erase this SSD to reformat it and fresh install the OSes. Regarding some answers (link,link,link although related to Mac) I'm not sure which way to follow for cleanup. I don't have any sensitive data in this SSD, so I could simple format it at a level enough to get rid of a potential software rootkit/malware. Wiping it by writing zeroes seems too much given the potential effect on the lifespan of this SSD, thus I'm looking for the less harmful way to erase this SSD. After some research I see that ATA secure erase via hdparm may be a possibility (link,link,link).

Is this ATA secure erase via hdparm enough to achieve this sanitation or is it way too much/less?

I consider it because I need to sanitize this SSD against a (possible) malicious intervention and not wipe/nuke the entire disk by writing zeroes to prevent data access. As I understand, ATA secure erase will erase the disk by changing the encryption key to avoid access to the previous data, but I don't clear understand if it would eliminate the presence of a software rootkit/malware in new OSes installations.

  1. non-bootable RAID10 volume:

My hardware configuration includes four HDDs in RAID10 via Motherboard hardware RAID. Although they are not bootable and the RAID volume is mounted apart of the SSD, I'm not sure I should erase/wipe them as well. This RAID10 volume is used as a storage backup unit which contains important data in a single ext4 partition; I could erase it if necessary, but it would save me a lot of trouble.

I'm not versed on rootkits, but I would presume it could spread to this RAID volume as a survival measure. Also, I'm not sure how it could spread back to the "clean" kernel/OS since this volume is not bootable and (to my understanding) would not contain any system executables. OTOH, one could wrongly execute a compromised executable from this volume that would enable the rootkit/malware to spread over the system, but I plan to scan this volume with clamav (or other app) as soon as I have a new Linux OS installed.

In case this RAID volume is not safe, should I format the partition? or should I wipe it by writing zeroes (one or more passes) to sanitize it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.