Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.
Sign up to join this community
my question concern an attack with following prerequisites:
1) an home router hacked
2) tails installed on usb stick
3) the attacker has got a 0day on linux netfilter stack
the attacker get in on tails through a 0day on netfilter stack attacking from the router. Could he write files (for example a lkm rootkit) on the usb stick where is installed tails ?
Yes, with a remote kernel exploit it's possible that they could manipulate the contents of the USB drive to infect Tails and persist through reboots. This would be difficult to detect, but easy to remove.
Simply using the "Upgrade" feature of the Tails Installer to upgrade from an ISO or an existing uninfected (and purposefully kept offline) copy of Tails would replace the infected install with a genuine one, while keeping the encrypted persistent storage intact.
To defend against it, booting from DVD might make their task more difficult, or using some kind of forensic "write blocker" that are intended to stop writes to disk occuring while media is forensically examined. While there are reports that some of them are less effective, in theory a well implemented one would work.
