Say you boot into Linux from a brand new Live USB. The USB is write protected. The memory stick has never been exposed to the Web in its life. You surf all day on Firefox building your library of bookmarks. You backup your bookmarks to a .json file and send it to your Gmail account. You close down the computer and erase ram. Nothing is saved to the stick.

Five minutes later you cold boot into Linux with your USB still in write protect mode, open Firefox, go online to Gmail and download the bookmarks file. The moment the file has finished downloading you go offline. You restore the .json file to Firefox then set your USB to write mode. You save the new configuration to the USB, close down and remove your memory stick.

What are the chances this stick is now infected with malware, keyloggers et al using this routine? Is there a better way to keep the USB uninfected?

  • It would be far easier to simply use Firefox's sync functionality. This would allow you to store your bookmarks in the cloud and have Firefox simply import them whenever you start the thumb drive. It's effectively the same as what you are doing now, but with less steps. – AJ Henderson Jul 19 '13 at 15:06

So, clearly any processes that are running while the USB is not write protected could have an effect on its contents.

However, given that you are booting from a known-good state, I would say this window is microscopic, it is unlikely in the extreme that a persistent infection could occur. If all you do is open firefox and download your attachment, and not visit any other pages in particular, and the machine has no open internet-facing ports, I'd say you're as good as you can be.

It is quite easy to tell however. Make another known-good copy of the USB, put them both in a known-good, isolated machine, and make a filesystem comparison. The only files that should show differences are the ones related to the firefox configuration, and maybe a few system logs in /var.

  • Tkx lynks. Re filesystem comparison is there an app for that? – Edwardo Jul 13 '13 at 15:42
  • thegeekstuff.com/2008/12/… > Tripwire – Edwardo Jul 13 '13 at 16:56
  • @Edwardo yeah there are a number of things you can do. The easiest would be to use unix tools like find, md5sum and diff. – lynks Jul 13 '13 at 22:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.