4

I know that Linux is virus proof, but just to be sure...Suppose someone writes a script, trojan, etc... and put it on a flash disk or CD. then I insert that flash in my system without clicking on any file in the flash disk. Is it possible that the malware execute or copy itself to my system without clicking on any file(like windows)?

If this is possible, how to prevent from it?

I ask this because someone was trying to make me insert a flash disk some while ago!

Also, is there a way to search for such scripts(for example a script that captures screen and emails them) in system?

  • 7
    It's a fallacy to think Linux is secure from malware. It's just not as attractive a target in times in which most malware caters the financial interests of its creators. Also, malware executed in only your user context can still steal your data. It need not have a foothold system-wide (i.e. superuser). – 0xC0000022L Apr 5 '13 at 11:53
  • 1
    This might be a candidate for relocation to security.stackexchange.com ... But yes, it is in theory possible. If there is an coding error in the kernel, or if you mount the drive and there is a coding error in the mount utility, or if there is a coding error in the file server, or a coding error in the filesystem navigator... – root Apr 5 '13 at 13:55
  • 1
    tl;dr? Yes. It is possible. One way you can prevent it is by using antivirus software (e.g. ClamAV), but AV software can only do so much. Common sense is the most valuable tool; if you don't trust a website or person, don't let them download any of their content onto your machine- and 'downloading' includes just visiting a website. – root Apr 5 '13 at 13:59
  • Do you still have that disk? When you insert such a flash thing, the kernel starts some action like trying to discover the filesystem, number of sectors, free sectors and such. If someone reads the kernel source and discovers a flaw, he could setup a flash drive to infect your system with no click(tm). – ott-- Apr 5 '13 at 21:22
  • @ott-- No. I haven't the disk – John Apr 7 '13 at 8:25
5

You could be vulnerable if using a GUI with softwares that supports/implements "auto execute" feature, as explained by Jon Larimer at Shmoocon (2011). There is an interesting paper/vid about his research here:

http://blogs.iss.net/archive/Shmoocon2011.html

  • 2
    +1 - In the never-ending quest to make Linux more user-friendly things like "You inserted a USB stick. I see an autorun file. Let me execute this for you!" will become more common, and wven if the system asks the user first many people just click OK to make the dialog box go away -- as always the user is the weakest link in the security chain. – voretaq7 Apr 5 '13 at 16:55
3

In principle a doctored filesystem could subvert the kernel's filesystem handling code and take it over when the system tries to mount it. But filesystems are probably the most heavily audited code in the kernel, so this is a very remote possibility. So the answer is "no".

A GUI file manager could perhaps be subverted when checking "file types" or creating thumbnails from the contents of files. Again, code to handle images and such is routinely subject to data from untrusted sources, so this is also heavily audited. Very unlikely.

  • 2
    In 2006, during the month of kernel bugs, denial-of-service flaws were found in ext2, ext3, and iso9660, all of which were not particularly new at the time. (Well, maybe ext3.) Very remote chance? Yes. Being used in an untargeted attack? Even more remote. But "the answer is 'no'"? I'd disagree. – Ulrich Schwarz Apr 5 '13 at 13:44
  • 1
    I'm afraid it's just a question of time when someone comes and says: "When a removable storage is detected and automatically mounted, it should be checked for presence of runme.sh and run it if it is found," followed by: "Hey, what a good idea! And make it a default, please!" Possibly running it as the owner of the file. – peterph Apr 5 '13 at 14:19
  • @peterph, this grand idea was tried by Windows already... – vonbrand Apr 5 '13 at 14:37
  • 1
    @UlrichSchwarz, if you read my answer, you see that it isn't "no" in the sense of math.stackexchange.com, but in a practical sense. And your comment talks about DoS bugs, a very far cry from "take over the system" type bugs. – vonbrand Apr 5 '13 at 14:39
  • @vonbrand many similar grand ideas from Windows are implemented by some Linux distributions. – peterph Apr 5 '13 at 16:07
-4

yes there are many ways to do this. The best prevention is to make sure that you never leave your computer unlocked

  • 2
    Locking the computer won't prevent inserting a flash disk. “There are many ways” doesn't answer anything. – Gilles Apr 5 '13 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.