A thought experiment. If I had physical access to a PC that was switched off, but I didn't know the password, could I boot into a live linux image and install software on the windows box? Software like netcat for example

migrated from security.stackexchange.com Sep 4 '15 at 13:30

This question came from our site for information security professionals.

  • This question looks off-topic here. It may acceptable on the Unix and Linux stackexchange (with the tag dual boot), but I'm not sure. – jknappen Sep 4 '15 at 9:57
  • I disagree with the migration as its a physical security question, if someone had physical access to a switched off computer, (cleaner for example) could they install a backdoor in windows without having to boot into the windows OS – Adam Sep 5 '15 at 13:06

You have write access to the machine's hard disk, so you can add and modify files at will.

Running an actual installer would be tough, but decompiling the installer and then manually doing all of its work (copying files and editing the registry) is possible. Another option is to run the installer on a clean VM, compare the before and after state of it (which will list all modifications made by the installer) and then "replaying" these modifications on your target system is also possible.

From a security perspective though, malware usually doesn't come with an installer, it's either a single .exe that you put somewhere hidden and then add the corresponding registry entry to make it run at boot, or you completely replace critical system files with your own (malicious) ones.


You wouldn't be able to install anything, as the windows machine would be off. You could possibly mount the windows partition and copy a executable, script or anything else harmful on to the windows partition though.

Preventing something like this would be quite trivial and would only require bios encryption, password protection to prevent you booting to the live instance of linux and encryption of the windows partition.

  • 2
    "Preventing something like this would be quite trivial..." Not really. A BIOS password might help, but they're famously not hard to bypass. Encrypting the hard disk works, though. There isn't really another way. – Justin King-Lacroix Sep 4 '15 at 9:28
  • @JustinKing-Lacroix FDE can be defeated, see "evil maid" attacks. – André Borie Sep 4 '15 at 9:29
  • True. There's actually a fun rabbit hole to climb down on that front -- preventing evil maid attacks is possible, but painful. – Justin King-Lacroix Sep 4 '15 at 9:30
  • Okay maybe I shouldnt have said and/'or' encrypt the partition. Edited to just say 'and' now. Password protecting the bios is an extra layer of security, and is still a good idea. And it is quite trivial to encrypt the partition, you do not have to be a security or IT professional to do that, anyone with basic IT skill can. – TheJulyPlot Sep 4 '15 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.