1

If we buy for instance a laptop with an OS pre-installed e.g. Ubuntu and but the original seller was not reputable and there are doubts with the preinstall.
My question is: if we use the laptop to download Ubuntu and create a USB bootable iso to wipe out and re-install the OS, is this process safe if we assume the installed OS we currently use for this process is compromised?

1 Answer 1

2

Theoretically speaking, it's not safe. If I'm downloading another OS from the compromised install, then there could be code installed that patches an exploit into the image being downloaded or written to the drive. If you want to check it with a hash sum program, then the program could be patched to report a false hash on the patched files. If you build the hash program from source, then the compiler could be patched to add the fake reporting to the hash sum program, and also to the compiler and to the kernel itself. For any way you can think of checking the integrity of the download from within the system itself, there is a way to make the computer fake the response to you.

In practice, all of these steps would require a rather high level of sophistication and targeting. The attacker would either have to know for sure what OS you're going to download, so that the patch can target it accurately, or else make the patch very generic across thousands of OSes that you may want to download. Patching the hash programs is similarly difficult, and patching the compiler is perhaps even more so, because then the compiler would have to know to add the bad behavior to everything it touches -- and checking whether two programs are the same is a non-decidable computational problem.

If you're not a particularly valuable target, (especially if the attack is targeted at any buyer of the laptop and not yourself specifically), then any potential system compromise would probably be used for low-stakes credential stealing or botnets, which would get wiped out by a system reinstall and would not have the means to survive one.

If you want to be particularly paranoid, you could use the compromised system to download an extremely obscure OS and version, write that to a flash drive, then install that OS onto the system drive, then use this new system (which could be compromised, but it is unlikely) to download a new OS image, then flash and install that. You can also use checksums at every step of the process, perhaps checksumming random parts of the file to compare them to a known good one (though if you have access to a computer with a known-good file version, you should just use that one instead of going through all this).


Another option that has even more paranoia and a spy-thriller vibe involves finding a super-small Linux distro (for example, Tiny Core Linux's Core will give you a busybox shell, a DHCP client and a few other things for 18MB, even less if you get one of the older versions), downloading it on your phone, then manually typing it into the computer. Then you know the data you input is safe, and the malware that would try to mess with the data wouldn't see the entire file at once, and even if it does there's not enough space for it to hide its work.

The current download has 17870848 bytes, which is double that in hex digits. At my top typing speed of 250CPM, this comes out to 2382 hours, or just over three months of non-stop typing. At a wage of $7.25/hour, this would cost a bit over $17k. With that sort of money, you could just buy a new computer from a reputable supplier and not have to worry about this particular supply chain attack.

Or just buy a pre-made Debian installation medium. Similar offers are available for other distros.

4
  • What is an example of extremely obscure OS and version?
    – Jim
    Feb 4 at 19:41
  • @Jim That's mostly up for you to pick -- it is basically something that the theoretical replacement exploit wouldn't think to include, or wouldn't have the ability to. If I were doing it, I'd go on distrowatch.com and pick whichever one I've never heard of. The idea being that if I haven't heard of it, then the hackers probably wouldn't have either.
    – Danya02
    Feb 4 at 20:00
  • What if I have already a USB bootable with Ubuntu and boot from there. Can plugging the USB corrupt it at the boot process? Is that possible?
    – Jim
    Feb 4 at 20:57
  • @Jim If you plug it in to a running system, then it could theoretically be -- the same very theoretical possibility as if it gets downloaded on the system. If you only boot from the BIOS/UEFI, then a compromised OS won't get a chance to intervene, but a compromised firmware might: this already exists, though it usually targets Windows and is developed by APT-level agents and is, again, something I wouldn't be worried about in my day-to-day operations.
    – Danya02
    Feb 4 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .