0

I want to set up an SBC, e.g. Raspberry Pi, Banana Pi, to work as close as possible to a computer running a Live Distro. I'm intending to use this to inspect suspicious or infected storage drives and view their contents. I'm not necessarily looking to do forensics on them (although if I did, I assume I can just apply these principles to a Kali installation). I'm aware that the Raspberry Pi is capable of botting from USB, so booting a Live CD should be possible, but I don't want to restrict my options to just the Raspberry Pi, so I want I'm considering the normal set up with these computers with the operating system on an SD card.

If I were to:

  • mount all filesystems as read-only
  • create and autologin to a non-root,non-privileged user
  • remove root privileges from privileged users/delete privileged users
  • completely disallow root login

Can I be confident that no malware compromising the system can make any permanent changes to it?

3

Can I be confident that no malware compromising the system can make any permanent changes to it?

No, you cannot. If malware was capable to compromise the system so that it is running as root, you cannot be sure about what happens to your USB.

The only way to be sure is to exclude modification on the hardware level. For instance, if you use CD-R or DVD-R, you can be sure they will not be modified.

Some SD cards have a physical switch to disable writing. As @Robert said: SD card only indicates that the SD card reader should not write. But there is no guarantee that the reader will follow that.

In all other cases you cannot be sure.

1
  • The SD card physical switch would be an option but it has to be mentioned that not the SD-card enforces the write protection but the SD-card reader. So the reader have to check and enforce the write protection state.
    – Robert
    Jan 14 at 11:09
0

Some SBCs including the latest RPi version also come with an onboard EEPROM for storing parts of the boot code. In theory malware could also change this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.