I have a Ubuntu 13.10 live usb. I gave it to somebody so that he can install ubuntu. Now I have received it back. I was wondering if it is possible to infect a live usb with spyware or virus ? If yes, how to detect it ?
Of course it can. I presume you didn't make your USB stick irreversibly read-only in hardware (can be done, but it's rather fiddly, and in case of using the read-only switch, it can of course be easily moved back in write position, if your drive even has one), so what you got back on your stick could be anything, unless you check that the complete contents of your drive match the ones you gave away.
The easiest way out is probably by formatting the drive and reloading it with a new copy that you hold and nobody could tamper with, or downloading it again from a trusted source. Alternatively, you could calculate checksum of all the files on the drive, and compare them and the rest of file metadata (like timestamps) with those you calculated and noted previously, or the ones you find online where you downloaded the files from, to check for evidence of them being tampered with.
Yes, it is possible
To detect it, one of simplier way is to compare whole content with another USB live stick, holding same version.
Checksums are present on top level of standard Live (debian based) distros. So you could compare this files on both fresh key and the one you got back. Than you could use this file to check whole directories.
As this question stand for
Ubuntu 13.10, I've downloaded this version (32bits, for more portability on usb key, but I think 64bit version will present approx same filesystem architecture.) on my desktop. (I prefer Debian GNU/Linux, but it's not the matter).
$ sudo mount -o loop,ro Download/ubuntu-13.10-desktop-i386.iso /media/cdrom $ cd /media/cdrom $ ls -ltr total 2538 -r--r--r-- 1 root root 2560216 Oct 15 14:51 wubi.exe -r--r--r-- 1 root root 134 Oct 16 21:14 autorun.inf lr-xr-xr-x 1 root root 1 Oct 16 21:16 ubuntu -> . dr-xr-xr-x 1 root root 2048 Oct 16 21:16 preseed dr-xr-xr-x 1 root root 2048 Oct 16 21:16 pool dr-xr-xr-x 1 root root 2048 Oct 16 21:16 pics dr-xr-xr-x 1 root root 2048 Oct 16 21:16 dists -r--r--r-- 1 root root 227 Oct 16 21:16 README.diskdefines dr-xr-xr-x 1 root root 2048 Oct 16 21:16 casper dr-xr-xr-x 1 root root 18432 Oct 16 21:16 isolinux dr-xr-xr-x 1 root root 2048 Oct 16 21:16 install dr-xr-xr-x 1 root root 2048 Oct 16 21:16 boot -r--r--r-- 1 root root 3653 Oct 16 21:16 md5sum.txt
There is a file named
md5sum.txt dated on October 16.
This file could not differ between two different key holding same ISO (ubuntu-13.10-desktop-i386 => 32bits) !!
$ md5sum md5sum.txt 5765805c23215de23f7775d84a79e140 md5sum.txt
This is the md5 sum of this file. Have to be the same on each burned usb key!
If this match, you could simply make the verification:
$ md5sum -c < md5sum.txt && echo All OK. ./pics/red-upperleft.png: OK ./pics/red-lowerleft.png: OK ... ./install/README.sbm: OK All OK.
All OK. are displayed only if
md5sum end without error.