is a dual boot secure?

[SArepairman]

If I wanted to dual boot windows and linux on the same hard drive, is it possible to somehow modify the linux files from within windows to compromise the linux installations security?

[AndyC_772]

If you mean 'is there such a thing as an ext3/4 file system for windows', then yes, there is.

[Phaedrus]

If I wanted to dual boot windows and linux on the same hard drive, is it possible to somehow modify the linux files from within windows to compromise the linux installations security?

Yes. And vice versa. I've used a Linux LiveCD to remove Windows malware infections. Only way to prevent another OS from tampering with your files is to encrypt the drive.

[German_EE]

I would say yes. I run Windows 7 / Linux Mint on my notebook and MS Windows does not even see the Linux partitions, it reports them as empty or unformatted drives.

[jwm_]

You can improve things by encrypting the linux partition with LUKS,  at most the windows could just erase the data, but not maliciuously read or modify it. You would need to enter a password on startup though, if you only care about casual mischief and not maliciousness you can hardcode a password, it would be possible to read/modify it from windows but someone would have to put a bit of work into it.

[Mechanical Menace]

If someone else can sit at your computer and boot it up it's not secure.

If your computer is connected to a network it's not secure.

Especially given time.

At best no one's worked it out yet, at worst they have and it's not public knowledge.

EDIT:

Just realised how negative that sounds lol. One thing you can do is manage risk. Luckily almost all information is only really worth keeping secret so long and most isn't worth the effort anyhows.

[linux-works]

if windows has admin privs, it can write random stuff to any disk partition.  so its not safe, if you really get technical.

I dual boot and don't worry about it, though.  I limit what my win7 system does, avoid almost all web browsing and never install weird stuff to it.  if I need to browse the web, I do that under linux where its 1000% safer, overall.

[cosmos]

If you have serious security issues you might also want to have a look at the HW platform itself as an entry point. There are back doors into most PCs that does not even require the PC to be running (needs power to start though).
When someone with the right certificate can start your PC from remote and "restore" the disk to running order then that someone can do what he wants to all your disks.
How paranoid this should make you I guess depends on your aversion for three letter acronyms and your conspiracy alert level.
this sums it up nicely http://hardware.slashdot.org/comments.pl?sid=4608409&cid=45813563

[SArepairman]

ah, but can you be sure there is no backdoor that scans for some code that resets all your bios settings?

or like, is it measurable, perhaps a LDO powering the network interface is actually turned off?

[tautech]

I always in Bios disable Wake on Lan, USB and everything else I can.
In Win also disable remote assistance.
No good making things too easy for the A holes.

Gee thanks SArepairman.....removed 3/4 of your post after I replied.

[SArepairman]

oh dude it was a mistake, i thought I was posting a new post but I hit edit 

for clarity, basically I asked if the computer must be turned off for a remote "reprogramming" to happen, and leaving the lan unplugged before the OS is booted and unplugging the lan before the OS is turned off is a reasonable countermeasure.

I also wondered if there could be a "turn off" packet that can be sent which turns your computer off if you left it on running a operating system while you are away from the computer in order to allow to be reprogrammed if it is turned on (I imagine this could be useful if you wanna do a global change to a entire office building and you don't wanna hunt down someones workstation that was not turned off.)

[SArepairman]

how do you think something like that propagates?

the NIC writes a little barebones alphabet boy OS onto some free hard drive space ?

I CANT BELIEVE THERE IS NO PHYSICAL INTERLOCK!

[Mechanical Menace]

"

ah, but can you be sure there is no backdoor that scans for some code that resets all your bios settings?

Nope, you also can't be sure your firmware doesn't have backdoors and doesn't patch any kernel loaded to include it...

for clarity, basically I asked if the computer must be turned off for a remote "reprogramming" to happen, and leaving the lan unplugged before the OS is booted and unplugging the lan before the OS is turned off is a reasonable countermeasure.

Doing something remotely would be easier when an OS is running, and EVERY OS that supports networking is vulnerable to this sort of attack.

I also wondered if there could be a "turn off" packet that can be sent which turns your computer off if you left it on running a operating system while you are away from the computer

init 6" on a lot of *nix's

That really is dependent on the OS...

how do you think something like that propagates?

the NIC writes a little barebones alphabet boy OS onto some free hard drive space ?

I wouldn't try to take advantage of netboot to implement any sort of takeover of a desktop computer, it's too visible. The easiest way to propagate any sort of attack is to convince people to run it themselves. This is how the vast majority of malware gets on PCs, and no OS or security setup can protect you from that without making the computer useless.

I CANT BELIEVE THERE IS NO PHYSICAL INTERLOCK!

Why would you need one? Just follow standard practice. Don't run servers you don't need, don't open ports on your networks firewall you aren't using. Keep your BIOS/EFI/all firmwares, OS's and apps updated regularly, at least every time there's a security patch. And never, ever, install anything you don't trust.

The only thing that will keep you setup more secure than following those steps is putting it in a room with no doors, power supply, and network access.

[janoc]

If I wanted to dual boot windows and linux on the same hard drive, is it possible to somehow modify the linux files from within windows to compromise the linux installations security?

Depends on your definition of "secure".

If secure as in information security, not getting your data stolen, etc. then no - as others have explained.

If secure as in a common Windows malware not infecting your Linux files, then you are likely safe, because malware that understands a Linux filesystem and executables is very rare. Not impossible to find, but probably not worth worrying about. Of course, if you get a virus that scrambles/deletes the content of your harddrive blindly, it could mess your Linux files up as well.

I am dual-booting Windows and Linux for many years having both on the same and on separate drives and never had a problem with some Windows malware trampling over my Linux files. However, I didn't really have Windows malware in ages neither.

Dual boot is not a security feature - don't rely on it for that. If you practice a good computer "hygiene", such as having an up to date antivirus, have a firewall configured, use up-to-date, patched system and applications, have up to date backups, you will be OK, dual boot or no dual boot.

[SArepairman]

well the idea of this netboot attack is very interesting regardless, even if they are rare state level things, they are the most interesting concept in this thread by far.

[SArepairman]

"

ah, but can you be sure there is no backdoor that scans for some code that resets all your bios settings?

Nope, you also can't be sure your firmware doesn't have backdoors and doesn't patch any kernel loaded to include it...

for clarity, basically I asked if the computer must be turned off for a remote "reprogramming" to happen, and leaving the lan unplugged before the OS is booted and unplugging the lan before the OS is turned off is a reasonable countermeasure.

Doing something remotely would be easier when an OS is running, and EVERY OS that supports networking is vulnerable to this sort of attack.

Can you give me a more technical explanation of how this works?

Won't the OS interfere with remote access by the BIOS?

Like, I thought the OS running will have control of where to access the hard drive and memory. If something else tries to control this while its running wont the OS crash??

how is it easier???

[NiHaoMike]

Dual boot is so 1998... Nowadays, virtualization is usually the better choice.

[SArepairman]

i like video games with good graphics

[Mechanical Menace]

Can you give me a more technical explanation of how this works?

Won't the OS interfere with remote access by the BIOS?

Like, I thought the OS running will have control of where to access the hard drive and memory. If something else tries to control this while its running wont the OS crash??

how is it easier???

Ok, so say I have an exploit that gives me root or admin rights on a machine, or I've persuade a user to grant my programme them, the OS will let that programme access anything. I can access all your hardware directly*, and if needs be even ignoring the drivers for the hardware. But the OS is still controlling what gets access to what hardware when. My code isn't running in kernel mode/ring 0, the kernel (by necessity) just gives root/admin processes as much access as they want.


*and with a little work (amount depends on the OS) even bypass all memory protection and start patching the kernel, though that would be more likely to cause problems than patching it when it's loaded.

[alank2]

Dual boot is so 1998... Nowadays, virtualization is usually the better choice.

This is so true.

I wrote a piece of software that would allow you to boot up to 256 OS's on a single hard drive.  It does it by maintaining its own partition table that it will put into place and then boot the OS.  So you have a choice of which partitions you want present when you boot a particular OS.  You can use this to keep OS's separate from each other - it will wrap areas that are not used in a "protection partition" and remove their boot sector so OS's do not try to mount them.  It feels like it was a million years ago when I wrote this, but if you are interested:

http://www.sadevelopment.com/more_pbm.htm

Good luck,

Alan

[linux-works]

Dual boot is so 1998... Nowadays, virtualization is usually the better choice.

VMs can also be a huge hassle to network properly.  they tend to want to run internal vswitches, they tend to want to run NAT and they tend to want to make it harder to allow incoming connections, like servers and baremetal machines do.

some GUIs for vm tech makes it less hard, but others make it a huge PITA to setup networking the way you want.

and if you have an existing windows install, its damned near impossible to move it over to your vm.  linux allows this easily but windows has always been 'node locked' and unless you can hack windows pretty well, transferring your apps and data and config to a new machine is far from trivial.

for quickie things, I'll launch a vm that I did a full separate install to (sigh) but I still prefer to stay inside a real o/s if I'm going to be doing anything more than doing a short edit on a word doc.

[janoc]

Dual boot is so 1998... Nowadays, virtualization is usually the better choice.

Except dual booting and virtualization serve different purposes.

Virtualized OS is never going to function equally well as when it is running native on the HW. If you need only one odd application from the other os, by all means, virtualize. But you will suffer a lot if you need full performance from your peripherals, graphics, etc.

[janoc]

Dual boot is so 1998... Nowadays, virtualization is usually the better choice.

This is so true.

I wrote a piece of software that would allow you to boot up to 256 OS's on a single hard drive.  It does it by maintaining its own partition table that it will put into place and then boot the OS.  So you have a choice of which partitions you want present when you boot a particular OS.  You can use this to keep OS's separate from each other - it will wrap areas that are not used in a "protection partition" and remove their boot sector so OS's do not try to mount them.  It feels like it was a million years ago when I wrote this, but if you are interested:

http://www.sadevelopment.com/more_pbm.htm

Good luck,

Alan

Alan, but that is not virtualization, but a hack to dual/multiboot your machine 

Similar programs have been around for ages, e.g. System Commander.

[Galenbo]

... is it possible to somehow modify the linux files from within windows to compromise the linux installations security?

Yes, Format is possible. Pretty unsecure.

[SArepairman]

Can you give me a more technical explanation of how this works?

Won't the OS interfere with remote access by the BIOS?

Like, I thought the OS running will have control of where to access the hard drive and memory. If something else tries to control this while its running wont the OS crash??

how is it easier???

Ok, so say I have an exploit that gives me root or admin rights on a machine, or I've persuade a user to grant my programme them, the OS will let that programme access anything. I can access all your hardware directly*, and if needs be even ignoring the drivers for the hardware. But the OS is still controlling what gets access to what hardware when. My code isn't running in kernel mode/ring 0, the kernel (by necessity) just gives root/admin processes as much access as they want.


*and with a little work (amount depends on the OS) even bypass all memory protection and start patching the kernel, though that would be more likely to cause problems than patching it when it's loaded.

OK, Can you clarify?

Can you explain to me how a netboot attack works when the computer is off vs how it does when it is on?

Like, a chain of events...

I'm guessing its starting here (for a powered off net boot attack):
1) Computer power supply is providing standby power to BIOS
2) Computer is chilling, ignoring everything that comes in on the LAN connection (except for a few unique "triggers")
3) unique trigger comes along the LAN cable, causes computer to power on and...

can you be specific though, like describing what happens in various hardware sub systems during this chain of events?

is it just the bios? or does it start from NIC firmware? is there a diff using a plugin NIC card (pci, etc)