1

Found this article on using Live Boot Devices to do sensitive tasks such as online banking. While the article discusses the benefits of avoiding a possibly compromised host OS, it doesn't mention lower-level threats. Given increasing prevalence of sub-OS malware (e.g. BIOS, NIC, etc.), is there still a substantial increase in security from using Live Boot Devices?

My understanding of the issue is that regardless of the OS you're booting to, compromised hardware has the potential to log and exfiltrate your activities. While the susceptibility of your personal machine may be less than public hardware (for instance, a hotel terminal), the security gained from a Live CD seems to be marginal.

Basically: Are Live Boot Devices worth the bother? Is BIOS malware as common/dangerous as I have heard?

Improve this question
2
  • 1
    Dangerous? Yes. But I wouldn't call them common yet.
    – KnightOfNi
    Commented Jul 16, 2014 at 21:21
  • FYI, a compromised NIC won't get any more info than an attacker doing a MITM attack.
    – user42178
    Commented Sep 15, 2014 at 0:15

1 Answer 1

Reset to default
1

There can be security benefits of using something like tails for example

  1. keyboard logger - having an on-screen keyboard can get around this, and recording the monitor feed is impractical (lots of data + processing), but possible

  2. network monitoring/injection - using TOR and ONLY secure connections, you can be pretty secure from snooping, although it depends on what encryption you use. note: this is more secure than the "standard" use a VPN/SSH, as there you have to be careful about any potential metadata leaks such as DNS requests that aren't tunneled properly

  3. hard-drive/memory analysis: if you have something super-secure, you don't want anyone to be able to get it from a left-over paging file or memory remnants, which is why it's important to never write anything to the hard drive, and clear the memory upon shutdown

but really, pretty much all of this is overkill for your typical consumer banking customer with less than 250k in their accounts

not sure about specific bios/nic tracking possibilities, as those typically don't have much to work with - really aside from the hardware keyboard logger, I don't think any of these are likely to be encountered, especially not compared to software exploits in the host OS

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .