Security :: Cmos - Disabled Hard Drives Still Be Accessed By Malware ?
Jul 23, 2009
I was thinking of physically removing the hard drive and use the computer only with a liveCD for security. But is disabling the hard drive in the cmos just as secure, or does software exist that can still access the hard drive?
I installed Ubuntu 7.10 on my desktop a month ago before I left my apartment for winter break. It worked beautifully for the week I used it, but now the computer won't boot. I'm using the ubuntu live cd right now to type this. I can't install it over my last hdd because apparently both of my hdds aren't bootable. I unplugged the computer for the month I was gone and the BIOS date reset to 2004. I'm not sure if that affected anything, whether I need to replace the CMOS battery? The computer was built in 2004 so I'm thinking the battery might be old. Basically the computer functions on the live cd, just won't boot from either hdd.
Recently I noted that when transferring files between my HDs the CPU usage increases up to 80~ 100%. After the transfer ends, the cpu goes back to normal. The system monitor reports no process consuming those cycles, yet there is something eating up The CPU.
Doing some research I concluded it was probably something related to DMA and UDMA. which is weird because all my drives report they have UDMA6 enabled in the BIOS, and in windows I don't have that problem.
Running hdparm -d gives me the following error: /dev/sda3: HDIO_GET_DMA failed: Inappropriate ioctl for device for every partition on every device, though this does not actually tell if DMA is on or off I suspect it is off. I checked if this was a suse exclusive problem, and to my surprise, debian and aptosid, behave exactly the same. The only reason I didnt note before is cause I had never transfered so many files before, (about 250GB) and the small transfers I did were over quite quick.
I'd like to make emphasis on:
1.The problem is the same regardless if I transfer 5GB or 150. 2. In windows my cpu does not go above 10% at any time during the transfer.
I have 3 sata HDs. All my OS's are in sda (120GB) I use sdb (250GB) and sdc (500GB) as data and media storage. ALl drives are Western Digital with less than 2 years of usage, and pass all smart tests with flying colors.
CPu AMD x2 5400 @ 2.8GHz 4GB DDR2 800MHZ Mother board A780G M2+ SE
I have seen the light and will convert to Linux. I have booted this laptop from a CD with Ubuntu. The hard drive has been seized by a fake Window XP restore trojan(?), which sends all kinds of error messages and shows there are no files on the drive and no access to it. Using Ubuntu I can see everything is there.
Is there a way I can use Ubuntu and something like Malwarebytes to kill the malware on the drive? Then I believe I could back it up before I reformat it and bring it into the Linux world.
I realize that FF 3.6 was referred to near the end of this thread? Most Ubuntu based distros (Mint, Gosalia, Ubuntu, Xubuntu) are shipped with FF 3.5.8, are there any reported problems with this version of FF? Mint does offer Opera, I really don't care about installing Wine to gain access to IE6, you open the browser, there are two critical updates that shows, but on three occasions, I left the desktop for an hour, and the two updates still never applied. I have installed Clam AV, is there a malware scanner for Mint, too? I do want to be secure, but don't wish to run two AV's, have four separate malware scanners, and scan every piece of everything the way you must do in Windows. With Windows, you spend more time scanning than browsing. I don't want to have to do this with Mint, too.
Can a virus survive a reformat, running bootrec /fixmbr (both from the install CD), and then installing Ubuntu? Reformat meaning from the windows disk recovery console, using the format command for all partitions. Likewise, would a virus be capable of surviving just the first two steps alone without installing Ubuntu, just re-installing windows?
If one were to have an MBR virus on Windows or Linux, how abouts would you find or remove it without doing an entire disk wipe? And before someone goes "Linux is immune" take into consideration vulnerabilities on the user end.
I was on funnyjunk.com yesterday, looking at funny pictures. I clicked the next button, and a page popped up displaying that the website had malware hosted by hit.d1.net, however when I had Windows XP the MacAffee Siteadvisor Displayed that there was no malware. Is this Real or Fake? Just wondering if it is one of those fake spyware alerts, like from windows.
A forum that I visit with Firefox has a message that says the following: Quote: I've detected a bestlifeusa.ru script that tries to run of this server, I've reported this, but I'm pretty sure most of you get this one too, I was just protected so I'm fine - you may not be so lucky, so I'm asking you guys to get your system checked immediately.
If you use firefox - install the No Script extention after you have cleaned your system for all worms, viruses and spyware. And make sure that the bestlifeusa.ru script can't execute on your system from this site. If you don't have any "anti script" "no script" "script stopping" system installed with your browser, you will likely not notice this script, I suspect it's a spy-script that spies on you - and you most certainly have it! I think the measures recommended might be Windows oriented.
is it possible for malware to survive a full reformat (ie... dd /dev/zero,urandom,zero?I'm for some reason worried that my android based phone, PS3, XBox 360, Routers, and/or TV can somehow be infected with malware as they were hooked up to my network..Is this possible? And does Factory Resetting or Hard Resetting clear all data on the device and reset it entirely? If so, how does that work? Is there a specific storage chip on the device that cannot be written to and only read for when a hard reset is requested?
I'm aware that this sounds outlandish but I've got a severe paranoia for some reason and would like peer advice on how to resolve this and get some peace of mind.
So I downloaded a movie from megaupload and a pop up came up with [URL]....that bounced me to[URL]..but that webpage did not display. Normally, on Windows, I would have an anti-virus that would likely give me some sense of good or bad websites. On Ubuntu, I am not quite sure. Do I need a malware scanner for the firefox browser? I have the standard package from the 10.04 distro with the latest updates...
today is my second week using ubuntu , my question is how can i insert malware block list on ubuntu? as my regular win user i always put the list in dirrectory x: winblows system32 drivers etc hosts[URL]
In Ubuntu 10.04 LTS, I have downloaded and installed texlive (2011). They have issued the following warnings:
1. "To the best of our knowledge, the core TEX programs themselves are (and always have been) extremely robust. However, the contributed programs in TEX Live may not reach the same level, despite everyone�s best efforts. As always, you should be careful when running programs on untrusted input; for maximum safety, use a new subdirectory."
What does this exactly mean? The installed program has already created own directories and subdirectories (e.g. /usr/local/texlive/2011/bin/i386-linux). Am I supposed to create a new subdirectory in home to write files and run latex program? Exactly how do I know that the downloaded and installed program is not malicious?
2. "Finally, TEX (and its companion programs) are able to write files when processing documents, a feature that can also be abused in a wide variety of ways. Again, processing unknown documents in a new subdirectory is the safest bet."
what is implied by "a feature that can also be abused in a wide variety of ways".
I have been using the new ocr app 'cuneiform' that has appeared in the Lucid repo.It is command line and works very well.However, the rest of the household would like to use it and desire a gui front-end.Mepis has this and it is called YAGF. Works well.We are told to install only from trusted sources.how can I check the integrity of this .deb and freedom from malware before installing it?
Alright running a ubuntu based webserver. The app will be accepting user uploaded files from my client's clients. My client will then need to download an access the files. I'm looking for a solution to scan for windows malware at the time of upload so I never expose her machine directly to her client's uploads.
I browse with Firefox and I had been running a pretty vanilla install of Ubuntu 10.4 (with a few things like tomcat and mysql) I supposed the repos kept everything (like java) up to date.
Some time ago I replaced OpenJDK with SunJDK. java -version is "1.6.0_24" which java is /usr/bin/java
Yesterday, for the first time, I downloaded and ran an Avast! scan. It complains of "Malware-gen" in several class files in what I think is the java cache. Does anyone know how this could be?
second time clamav detects the malware on laptop underubuntu:winnow.compromised.ts.jsexploit.5.UNOFFICIALwinnow.spam.ts.domains.158.UNOFFICIALgspace.js: winnow.malware.cm.miscspam.387929.UNOFFICIALwhat does this mean, is it serious and what is the origin of this infection?
Originally Posted by smokerSuch things can happen on linux. But try googling for actual occurrences.Greetings SmokerWith no prejudice sir: I've got a personal list of at least 75 such occurrences, just this year alone in Linux-OS's... If the Blacks wants to mess-up your OS, they do it as easy as microstuf could nuke any target Windows-98 OS today... Linux is web-page secure, only... You may think Linux is impervious to hack-attack, but it's definitely Not!.. It's just that you haven't been extremely noisy on the internet about how humanity should change its bad-attitudes towards Life and Love, before it's too late... In and from your "safe little box" you are 99.99% safe from the Blacks, IF your are silent and compliant to "North American peasant control policy".. but start doing a little "Al Gore and Greenpeace style bitching noise", and very quickly you'll discover just how unprotected your Linux powered PC really is... Ask Greenpeace and Al Gore about the max-attacks to their computer systems... I had to reinstall the OS about a hundred times this year.. Seems the big money world didn't like that I published, that "to save humanity from its impending early extinction, Money needs be extincted and replaced with something conducive to life and living and love".. They Freaked!, and slammed my PC's repeatedly, hard... Sure, Linux is reasonably secure, but it ain't perfect.
Malware Potentially Implicated in 2008 Fatal Plane Crash in SpainQuote:Investigators looking into the crash of Spanair Flight 5022 at Madrid International Airport on August 20, 2008, killing 154, found that the airline's central computer system used to monitor technical problems in its fleet was infected with malware, according to this news report. The central computer system should have warned the airline that Flight 5022, an MD-82 aircraft, was having repeat mechanical problems.[URL]
I am building a home server that will host a multitude of files; from mp3s to ebooks to FEA software and files. I don't know if RAID is the right thing for me. This server will have all the files that I have accumulated over the years and if the drive fails than I will be S.O.L. I have seen discussions where someone has RAID 1 setup but they don't have their drives internally (to the case), they bought 2 separate external hard drives with eSata to minimize an electrical failure to the drives. (I guess this is a good idea)I have also read about having one drive then using a second to rsync data every week. I planned on purchasing 2 enterprise hard drives of 500 MB to 1 GB but I don't have any experience with how I should handle my data
I have Fedora 14 installed on my main internal drive. I have one Fedora 14 and one Fedora 15 installed on two separate USB drives.When I boot into any of these drives, I can't access any of the other hard drives from the other drivesll I can, but just the boot partitions.Is there any way of mounting the other partitions so I can access the information?---------- Post added at 12:42 PM ---------- Previous post was at 09:34 AM ----------I guess even an explanation on why I can't view them would be good too.
Have Opensuse disabled support for Iomega external parport zip drives? I can mount the zip drive under Debian Lenny running the 2.6.26 kernel without any problems. Under Opensuse 10.3 (installed) and Opensuse 11.2 (liveCD) I can't access the drive. Opensuse doesn't recognize it.
All of which is odd. When I installed 10.3, the zip was seen an configured in fstab as /dev/sdc4 mounted at /media/zip. It worked fine for a while, then quit. Now, /dev/sdc4 doesn't exist. Kde control center says (hardware - partitions) says is there but not mounted. Hwinfo doesn't show it; modprobe imm does nothing.
I'm at a loss for ways and means to get Opensuse to recognize my zip drive.
I have a SATA drive that worked fine. Then I installed two more hard drives into my system. When these hard drives are installed, if I try to access the SATA drive in Linux, it will start lightly clicking and then the drive will become unavailable. If I power on the machine without the other two hard drives then it works fine. What could be causing this to happen? I don't think it's heat because the two hard drives are far away from the SATA drive.
how to automount USB devices read-only for security in RHEL5? I'm looking for the generic solution for any USB device, so I'm not looking to hardcode something into /etc/fstab.I've hunted around and I can't find a clear answer and my various attempts have failed. I've looked at /etc/auto.misc, UDEV, and HAL. Here's where I'm at which isn't working.I have RHEL5 and from what I can tell HALD manages the automounting. HAL seems to have 2 primary directories:
/etc/hal/fdi -and- /usr/share/hal/fdi
The difference between the two is unclear to me.Based on some examples, I created the following file:
No matter what I call this file or where I put it, any USB device still mounts RW. How do I fix this? Am I correct that HAL is the right place? Looking through dmesg, it sure looks like HAL controls this, but maybe I'm wrong? I've also made various attempts to solve this with UDEV and /etc/auto.misc, so if it is one of those, I clearly don't know the correct thing to do there.
I have a Centos 5.5 system with 2* 250 gig sata physical drives, sda and sdb. Each drive has a linux raid boot partition and a Linux raid LVM partition. Both pairs of partitions are set up with raid 1 mirroring. I want to add more data capacity - and I propose to add a second pair of physical drives - this time 1.5 terabyte drives presumably sdc and sdd. I assume I can just plug in the new hardware - reboot the system and set up the new partitions, raid arrays and LVMs on the live system. My first question:
1) Is there any danger - that adding these drives to arbitrary sata ports on the motherboard will cause the re-enumeration of the "sdx" series in such a way that the system will get confused about where to find the existing raid components and/or the boot or root file-systems? If anyone can point me to a tutorial on how the enumeration of the "sdx" sequence works and how the system finds the raid arrays and root file-system at boot time
2) I intend to use the majority of the new raid array as an LVM "Data Volume" to isolate "data" from "system" files for backup and maintenance purposes. Is there any merit in creating "alternate" boot partitions and "alternate" root file-systems on the new drives so that the system can be backed up there periodically? The intent here is to boot from the newer partition in the event of a corruption or other failure of the current boot or root file-system. If this is a good idea - how would the system know where to find the root file-system if the original one gets corrupted. i.e. At boot time - how does the system know what root file-system to use and where to find it?
3) If I create new LVM /raid partitions on the new drives - should the new LVM be part of the same "volgroup" - or would it be better to make it a separate "volgroup"? What are the issues to consider in making that decision?
There seems to be much disagreement between distros regarding how ipv6 is disabled, even between different versions of the same distro. Rather than just follow instructions for disabling ipv6 for a given distro, I would like to also test that ipv6 is not used any more. Any software or executable that relies on ipv6, that I can use to confirm that ipv6 has been successfully disabled?
If root is disabled by default, how is it possible that someone managed to SSH into my computer using root? I never enable/set password for root, it's always left as the default as per a fresh install and I always use sudo for any admin tasks.Auth.logFirst there are a whole load of failed attempts then...
Code: Nov 8 11:07:32 Morris-Desktop sshd[3601]: Failed password for root from 94.243.50.53 port 4360 ssh2
I recently purchased 3 new WD cavier green 500gb drives with the intent of building a raid5 array and running linux. Admittedly I purchased without doing enough research and now I have serious doubts about running an os on raid5 with the onboard controller.So now I am thinking I should run one drive as an OS drive and mirror the other two. I don't have a fourth drive unless someone can convince my wife I need a fourth after already buying 3....
Is it possible to have multiple distributions where ALL distros save their docs to the raid dives? That way I can wipe/install the os and keep my files? I seem to recall that I can be done, just need someone to point the compass.
IMDB gives me a "recently viewed" list of pages I viewed recently (and a few of them were months ago, since I don't go there too often) at the bottom of every page I view. My cookies are enabled for session-only, have adblock plus, my ip changes every day, how are they doing that? How can I prevent it? What other websites are using the same trick? At this page [URL] there's a link there that says "Clear entire history", but I want to disable them from being able to track me like that, if they can track me, so can others.
I am surprised (from the searches I carried out on the net) that no one seems to have considered this danger so far as I can see...I'm a little concerned about the implications on security for algorithms that opaquely shift data blocks around on disks to even-out surface wear rates.In the good old days, if I wanted to wipe a file that documented my struggle to give up frosted strawberry donuts (for example) I knew where that file started on the disk and how long it was and could thus instruct the OS to wipe it with complete confidence.
Nowadays, however, with increasingly sophisticated use being made of W-L techniques and fancy, journaling file systems that separate meta-data from file content and whatnot and so forth, how can I still be sure that when I try to overwrite a personal and private file, that i AM actually doing precisely THAT, and not just nuking some virtual image of the thing which in reality remains preserved elsewhere on the disk?