1

If i have a RAT on my computer, obviously, they have control over the computer when I am in win 10 os, for ie. But what about if after the RAT has infected the host os, I use a LIVECD.

QUESTION: When using the livecd, while the host system is RAT infected, can they still see everything I am doing?

QUESTION: While in TAILS, if I open an email that is created to auto-execute with a RAT (or I click a link, etc), and the RAT downloads onto my livecd, could a very sophisticated (3-letter agency) RAT getting onto my HOST OS?

I definitely have a RAT on my computer; opening and closing tabs, etc. I opened an email that auto-executed. NOt first time.

Thanks!!

2 Answers 2

1

It depends on what layer the PC is infected and what component is infected by the malware.

If the malware lives in userspace or kernelspace on the operating system or is a bootkit installed into the bootsector of the operating systems primary hard drive, then it will be unable to interfere with any other operating systems that are booted on the system.

If it has infected firmware on a device then it may be able to perform malicious activities, depending on which bit of firmware and what the device can do will determine how compromised it is. For example, if the USB drive (e.g. BadUSB) or your CD/DVD reader device was infected, then it would be possible for that device to subvert the normal Tails boot process and inject malicious code during the boot process which would be very difficult to detect from inside the operating system and have complete control over it.

These lower level infection methods are problematic because they're hard to detect and they're hard to remove once detected. Research group LegbaCore created a proof of concept tool called "LightEater" which uses a remote exploit to gain code execution and then subvert the BIOS of the targeted system, once in the BIOS they are able to take total control of any operating system that is booted on the device, and invisibly operate it entirely outside of the view of the user, a demonstration of using it to steal cryptographic keys from Tails is available here.

You should also consider that creating a "livecd" from inside an infected operating system is a version of the "trusting trust" attack. If your operating system is untrustworthy, any media that you create with it could be subverted.

If a three letter agency was very interested in you and you were using a livecd with some read-only medium and you were exploited (by email, or whatever means) then they could potentially infect your computer, as mentioned if they attack the firmware of your livecd reader then they can make it read data that they control.

Also if you are running Tails from a livecd and you have your host operating systems boot drive plugged in then similarly they could infect it that way. There are ways to protect against this, by using secure boot with a TPM for example, but they're currently not very well supported or user friendly and still have loopholes that might allow attackers to subvert them.

Ultimately however, before you go down the paranoia rabbithole: it sounds like the malware you're describing, if it is indeed malware, is poorly written or is being operated by imbeciles (I.E. you detected because it was doing obvious things, it's not very well hidden, etc.). Unless you have reason to believe that intimidation is their intent then it seems unlikely to be a "three-letter agency" or any advanced attackers, it's probably only infected userspace or kernelspace, at worst a bootkit. A clean Tails install will protect you from all of those. I would still urge you to proceed with caution, if you do use Tails then never put in the Tails boot media while any other operating system is running (shut it down then insert the Tails media) and if possible create the Tails boot media from a trusted friend or colleague's computer system, or if that's not available then some random computer system that is available to you that would make it difficult to target you through.

0

livecd is 100% safe and the only way in your case: it lacks the persistense mutability for running OS: after every reboot it's starting brand new. Unless you have a very sophisticated virus/malware that resides on BIOS/firmware of your PC components like Rakshasta - it's wiped out with every reboot dry clean, even if infected the running instance. Plug your old Windows HDD after fully booting your live image via USB2SATA cable and physically unplug it before the reboot. It will make sure that no byte will be present during the reboot process.

About infecting host os from livecd - use a reading-only CD/DVD ROM device :) It's just that simple - you can not physically infect the live image if it's physically immutable(reading=only drives laser can not write a thing on medium inserted, it's a physically different laser).

UPDATE for answers for your further questions.

About Rakshasa: you should see the video, where it's creator explains it in details, the article seemed to give you just partial understanding. If you will reflash your BIOS - it's possible to re-infect it from another hardware firmware container that has been infected, it's not that simple. It has full and unrestricted access to everything - it "owns the box". It can even mine bitcoins on your GPU if it wants to and has a code for it.

1+2. To mitigate this risk use single-board ARM computers without BIOS and firmwared components and without ARM TrustZone "feature". Nowdays there're some decent ARM SBC's that are comparable/equally-useful as a regular netbook or even a simple PC/laptop. Also - using Linux in advanced way - you have a good choice for isolating potentially harmful parts. Also keep in mind that FreeBSD is making it's way to ARM, so if it's available for your platform - try it!

About rendering RAT useless using read-only drive: yes, it is rendered useless. Even if they will re-infect you - press reset and you're completely clean! Unless they have planted a Rakshasta-like tool. But if you will be using ARM SBC - even Rakshasta will be useless.

"Plug your old Windows HDD" means that you remove your HDD with infected Windows installation from connection with your PC via SATA and plug it to USB2SATA cable - to be able to use it to get the information you need from your old HDD. If you don't need it(for example, you have a backup) - just unplug HDD from your PC completely, for safety reasons.

The boot/reboot sequence is - in details :

  • PC is powered off, medium is inside your read-only drive. Unplug the USB2SATA cable with your old HDD(if you're using it)
  • Boot your PC with livecd. No volatile/modifiable/persistent volumes are presenting at your PC now, so it's a 100% clean boot.(not taking Rakshasta case into account)
  • If you need old hdd to get the info from it - plug it in and mount it with noexec option, i.e. executing a byte from it is prohibited by Cleanly booted OS kernel instance
  • Unplug your old HDD with USB2SATA when you're about to reboot - before making the reboot
  • Reboot your system by power-cycling it on/off with PSU off as well, i.e. the motherboard must loose all power for 1+ minutes. Why it's so complicated? Why not unplug HDD and just use reboot-like OS command ? Well, the reset contact lane is not always properly propargated to every RAM and MCU chip in system and, for example, sometimes some data can safely survive the "soft-reboot" in GPU memory, for example. So powering it off completely will assure you in fully cleaning and restarting all the MCU chips in the system and all RAM chips will be cleaned for sure.

IF you're suspecting Rakshasta case - reflashing truely everything on most of modern motherboards requires not just BIOS chip reprogramming, but also - using JTAG programmer - all the other smart parts of the motherboard. Also keep in mind that some remote management features are vendor-hardcoded backdoors, like an Intel's one.

UPDATE #2 for your addidional questions

Facts checklist:

  1. yes
  2. yes - in case of ARM SBC, in clear motherboard case there's still a risk of re-infecting your hardware
  3. The purpose is to make sure that infected medium will not be present at reboot, so no code can boot from it ahead of livecd clean kernel.
  4. yes, all hardware with all the subcomponents: some devices like a motherboard can have 2 or more firmwares running at the different parts/MCU's
  5. yes
  6. yes. every power cycle will wipe out all the RAM, livecd is immutable, so the only possible risk is infecting a running instance, but there's no physical way to make the infection survive the restart
  7. no, it can be running inside a container like macromedia flash. To write into RAM(a temporary memory, it's not persistent) any code needs to be just executed, no matter the way
  8. yes, proper power cycle is powering the RAM chips off, and even if they are cooled(in case of cold boot attack) - one minute of power off will 100% clear the RAM chip even cooled to a superconductive state :)
  9. if your cdrom is read-only - it won't be able to write to the media anyway, it should not be executed(and activated by doing so). That's the reason of noexec option in mounting your old HDD - execution from this media will be blocked by kernel
  10. you're letting OS to powr it off correctly, no "pull a plug" call, of cause. After it's off by itself - unpower it physically. Im' using this thing to do the powercycle correctly and in a convinient way. Let the OS power the system down, turn the switch OFF, wait a minute, turn the switch ON - and proceed to booting

Questions:

  1. No, it's just an on-flight reflash, if it's supported by your platform.
  2. Some of them do have a flashable from the PC USB port MCU's, others have a dedicated JTAG pins not connected anywhere, just waiting for an external programmer to be attached only physically to it, so you better check.
  3. yes
  4. full wiping out of the memory contents and making sure that your old infected medium(HDD) is not reachable by bootloading process At all
  5. No, laptop is just a form-factor
  6. A laptop case is a HUGE for an ARM SBC - you can place 2-8 of them inside if you wish :) All SBC's have their SoC's named, so take a look and see is there're a TrustZone in it. It's a hardware-only feature, so if it's missing - it's physically impossible to emulate it. Other chips are usually displayed as well on a big top photo, so you can check them too. If you need a particular board advice - just ask ;)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .