Hacker News Reader

Comment by lifeguard | Hacker News Reader

Ahhh, but what system can you trust to burn the linux boot CD on?

Not to mention by the time you burned it it would be well out of date (security patches). If you're going to go that route you'd be better off buying a USB stick with a write-lock (Kanguru sells some).

The usual move is to argue but I have seen un-patched Windows servers rooted in under 30 min on the public Internet. I made several recommendations to modify their SOP...

Kanguru has some really nice thumb drives. I own two and would recommend them to anyone. Keep in mind, you can also store private keys on them.

> you can also store private keys on them

As regular files (e.g. `cp ~/.gnupg/secring.gpg /media/kanguru/`) or can you somehow import them such as with a smart card?

I carry multiple devices at the moment but it would be nice to consolidate.

Only as regular files, but with the write lock you can be sure that they don't get deleted.

Yeah but if you go this far, how could you ever trust the bank's security?

Are you saying this software can inject malicious code into a disk image and/or falsify the integrity report if you look at the md5 checksum of said image?

No. But it is also hard to trust a frozen OS. How often should one refresh the ISO?

Even if your OS is out of date:

1 - Malware should be purged on shut down

2 - Only specific sites are accessed, e.g. banking domains, minimizing the risk of picking something up through e-mail or careless browsing.

3 - Obviously you shouldn't be running a server.

4 - You should still practice safe browsing, being aware of packet injection via public WiFi.

If you are being specifically targeted, that is another issue.

Also, you shouldn't even be using md5 anyways. It's essentially broken and has serious vulnerabilities. Use sha2 or sha3.

That's what I get for being specific. >.<

My point was that it's unlikely that you're dealing with malware so sophisticated that it can successfully corrupt any given OS disk image and/or fake-out a checksum verification on same -- and if it can, you're probably screwed anyway.

> That's what I get for being specific.

That's one little thing about HN -- most people are so literal, completely missing the point.

I'm sure that it's not (yet) possible to do that, although that would be a huge breakthrough. Imagine malware that could detect what (OS) is on the ISO image and inject itself into the files inside the ISO stealthily... all at run-time when you click the "burn this ISO to this CD" button.

Yeah, we'd just be screwed at that point.

Reply on news.ycombinator.com