2

I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, how to detect it ?

2

Of course it can. I presume you didn't make your USB stick irreversibly read-only in hardware (can be done, but it's rather fiddly, and in case of using the read-only switch, it can of course be easily moved back in write position, if your drive even has one), so what you got back on your stick could be anything, unless you check that the complete contents of your drive match the ones you gave away.

The easiest way out is probably by formatting the drive and reloading it with a new copy that you hold and nobody could tamper with, or downloading it again from a trusted source. Alternatively, you could calculate checksum of all the files on the drive, and compare them and the rest of file metadata (like timestamps) with those you calculated and noted previously, or the ones you find online where you downloaded the files from, to check for evidence of them being tampered with.

  • how to do checksum of live usb ? – aks Mar 9 '14 at 11:26
  • Simplest would be calculating checksum of the entire image of your drive (extract it into a new image if you have to) and then comparing it to the checksum of the downloadable ISO image. See the link in the answer for tools you can use to do that. – TildalWave Mar 9 '14 at 11:39
  • are you sure the checksum of iso created from usb will be same as that of the orifinal iso file used to make live usb ? i mean should this be expected in case of no tampering ? – aks Mar 9 '14 at 12:24
  • If the image wasn't mounted in write mode (and why would it, if all it was used for was to boot from it?), then yes, they should be the same. – TildalWave Mar 9 '14 at 12:29
  • i think creating iso image will copy all the bits, so checksum will depend on the size of the usb, so how can it be same ? – aks Mar 9 '14 at 12:33
0

Two questions:

  1. Yes, it is possible

  2. To detect it, one of simplier way is to compare whole content with another USB live stick, holding same version.

Checksums are present on top level of standard Live (debian based) distros. So you could compare this files on both fresh key and the one you got back. Than you could use this file to check whole directories.

Detailed explanation:

As this question stand for Ubuntu 13.10, I've downloaded this version (32bits, for more portability on usb key, but I think 64bit version will present approx same filesystem architecture.) on my desktop. (I prefer Debian GNU/Linux, but it's not the matter).

Well, now:

$ sudo mount -o loop,ro Download/ubuntu-13.10-desktop-i386.iso /media/cdrom
$ cd /media/cdrom
$ ls -ltr
total 2538
-r--r--r-- 1 root root 2560216 Oct 15 14:51 wubi.exe
-r--r--r-- 1 root root     134 Oct 16 21:14 autorun.inf
lr-xr-xr-x 1 root root       1 Oct 16 21:16 ubuntu -> .
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 preseed
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 pool
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 pics
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 dists
-r--r--r-- 1 root root     227 Oct 16 21:16 README.diskdefines
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 casper
dr-xr-xr-x 1 root root   18432 Oct 16 21:16 isolinux
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 install
dr-xr-xr-x 1 root root    2048 Oct 16 21:16 boot
-r--r--r-- 1 root root    3653 Oct 16 21:16 md5sum.txt

There is a file named md5sum.txt dated on October 16.

This file could not differ between two different key holding same ISO (ubuntu-13.10-desktop-i386 => 32bits) !!

$ md5sum md5sum.txt 
5765805c23215de23f7775d84a79e140  md5sum.txt

This is the md5 sum of this file. Have to be the same on each burned usb key!

If this match, you could simply make the verification:

$ md5sum -c < md5sum.txt && echo All OK.
./pics/red-upperleft.png: OK
./pics/red-lowerleft.png: OK
...
./install/README.sbm: OK
All OK.

Message All OK. are displayed only if md5sum end without error.

  • how to do checksum ? iso created from usb will be of different size and hence different vchecksum – aks Mar 9 '14 at 18:53
  • If checksums differ, detection is done: The two keys are not same! :-/ From there, you could try to search for differences and try to explain what/why ( maybe who ;) – F. Hauri Mar 9 '14 at 22:57
  • if u burn same iso to two different usb of different sizes and then do the checksum on the 2 usb , u will get different checksum – user2917687 Mar 10 '14 at 8:41
  • @user2917687 Yes! But you may have to check files, not whole partition! (depending on how iso are copied to usb, partition may present same checksums too) – F. Hauri Mar 10 '14 at 8:47
  • @user2917687 have a look at my edit. – F. Hauri Mar 10 '14 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.