3

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really trust Windows security wise(which will be used for gaming). So I figured a solution to having 3 different drives, 1 for Windows and 2 more for my linux OSs. Security wise all three systems will be encrypted using TrueCrypt and the other drives disconnected when one system is in use. But that still leaves one attack vector... the hardware itself.

Can using one system and then booting into a second system with the same hardware but the previous systems drive removed be an attack vector? And if yes what are some possible ways to prevent it?

  • As a side note, you may want to consider using virtual servers for work as needed. For pen testing they can be a great way to quickly scale up your processing power! – Matthew Peters Apr 15 '14 at 17:30
2

If a machine is hijack by an hostile entity, then the attacker can gain full access to the hardware -- including every drive which is currently plugged in the machine. If the Linux drives are encrypted with a key that the Windows system never sees (which means that if you want to copy files from the Linux to the Windows, you have to do it from Linux, not from Windows), then such an attacker should not be able to read your Linux files. However, he can still do some considerable disruption.

Moreover, a boot disk is never completely encrypted, since at least the decryption code will be stored "as is". An industrious attacker, who gained control of your Windows machine, may plant some hostile code in the boot sector of the Linux system, so that it grabs a copy of your TrueCrypt passphrase the next time you boot Linux. Of course we are talking about a competent attacker here, but such people exist.

Apart from disks, the BIOS is commonly a re-flashable chip, and thus may serve as vector for hostile code. BIOS virus exist. Other pieces of hardware also have firmware, to be executed by the main CPU or even hardware-specific CPU, and such firmware may also be infected (this has been demonstrated in lab conditions, not sure it was spotted "in the wild"). If a machine is compromised, the compromise can go deep... But then, the attacker is really good, and really hates you, personally.

A "complete" solution would be virtualization -- the VM layer offers only virtual hardware to the potentially infected OS, keeping the rest of the machine clean. However, this is relative to how well the hypervisor can contain hostile code; hypervisor bugs occur (not often, but still...). A bigger problem will be that games will need some rather direct access to your GPU. It may not work at all, or imply heavy overhead; it may also provide an escape route for the attacker. After all, the GPU can run code and has privileged access to the main memory bus.

In practice, isolating the Windows OS in a VM will not provide absolute security, but it ought to block the not-so-good attackers (e.g. mindless malware), and may slow down the best attackers. I am not sure about the compatibility of games with virtualized GPU, though.

A much cheaper alternative, which does nothing about BIOS/firmware hacks but will protect your disks, is to make you Linux disks external. Just unplug them before booting Windows. If they are not in the machine at all, they will remain safe.

  • I'm actually looking for disks/disk bays that can take a switch on them to shut the disks down when not in use, if I don't find one I might look into cutting some power cables and trying to make one myself. – user36976 Apr 15 '14 at 17:41
  • Also... don't BIOS viruses have to be motherboard specific? – user36976 Apr 15 '14 at 17:48
  • 2
    A virus which infects hardware (e.g. the motherboard) must do things which are specific to that hardware. That does not mean that it does not happen... only that it will entail more work for the virus writer. – Tom Leek Apr 15 '14 at 17:50
  • Flashing the BIOS tho requires a full system reboot and at that point it would be totally obvious something is very very wrong – user36976 Apr 15 '14 at 17:53
  • 1
    Actually flashing the BIOS does not require a reboot; it just is that the BIOS reflashing utilities prefer it when there is no running OS at that time (to avoid untimely accesses), and the post-flash reboot is to make sure that the new BIOS code is used. However, the hardware itself has no notion of a "reboot" and warm-flashing is possible -- not recommended, but virus writers don't like to play safe anyway (especially with your hardware). – Tom Leek Apr 15 '14 at 17:55
0

So the quick answer to the jest of your question is yes, having multiple OS's partitioned separately is technically safer. However, you are not immune by any means! There are countless attacks and viruses/malware aimed at the firmware/bios/etc of the computer itself -well beyond/before your OS starts up. Additionally, even with FDE (full disk encryption) malware can still access that drive you are operating in and thus potentially infect the boot level of the hardware itself.

You are far better protected than the average user but if you want the most protection, use an 'empty space firewall' where you physically separate the two systems.

Here are some examples of hardware attacks:

0

It is better to do pen-test stuff in a separate computer and have maximum security to protect it. A hacker can gain access to all hard drives that is connected to the OS you use to pen test.

  • As mentioned in the question and in the comments of the other answers all OSs will be encrypted and the drives possibly removed when one is running. – user36976 Apr 19 '14 at 17:09
0

Yes, there are potential weak links: BIOS, cache, memory, router(firmware), and? As always, separate/dedicated computers are considered better/safer. Also, consumer grade routers are potentially the worst threat now and enterprise router solutions are expensive. That said, if you still want to use one PC though, you can make things easier by installing physical switches to power internal drives on or off. I have seen such switches for sale, and some people make their own (search Google). Also look into PC-BSD (FreeBSD). With that you can run an OS inside a 'jail'. A jail is much like a VM but faster. You can copy/delete/move jails as need be. Not all hardware works with FreeBSD though, but much does (easy to check at their site). That said, a VM is still often considered safer than a jail alone. But you can run an OS in a VM in a jail... Other than that, for extra security, at least having a dedicated PC for gaming is a good idea if you need the speed, as a VM will slow it down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.