my question concern an attack with following prerequisites:

1) an home router hacked

2) tails installed on usb stick

3) the attacker has got a 0day on linux netfilter stack

the attacker get in on tails through a 0day on netfilter stack attacking from the router. Could he write files (for example a lkm rootkit) on the usb stick where is installed tails ?

1 Answer 1


Yes, with a remote kernel exploit it's possible that they could manipulate the contents of the USB drive to infect Tails and persist through reboots. This would be difficult to detect, but easy to remove.

Simply using the "Upgrade" feature of the Tails Installer to upgrade from an ISO or an existing uninfected (and purposefully kept offline) copy of Tails would replace the infected install with a genuine one, while keeping the encrypted persistent storage intact.

To defend against it, booting from DVD might make their task more difficult, or using some kind of forensic "write blocker" that are intended to stop writes to disk occuring while media is forensically examined. While there are reports that some of them are less effective, in theory a well implemented one would work.

  • what do u think about usb stick with write protection like kanguru flash blu ?
    – MysticDog
    Dec 28, 2017 at 11:16
  • I can't speak to any specific brands or products, sorry.
    – cacahuatl
    Dec 28, 2017 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .