Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I had asked this question on ITSecurity @ Stack Exchange also. There may not be may linux distro users in ITSec, but obviously there are many here. So, I think that it might be appropriate to put that question here also. Please tell me if you disagree.

Original question at - http://security.stackexchange.com/questions/33017/using-linux-to-combat-windows-flash-drive-malware

Question is -

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and extensions). Most of those strange files had malware like names. I changed the properties of these files so that linux would allow me to delete them. It worked and now the drive seems to be fully clean.

If a windows malware in a flash drive can hide itself from windows, can it also hide itself from linux ? If not, then cleaning windows malware on a flash drive becomes easy. Are there any dangers/problems in this strategy ?

share|improve this question
1  
Out of curiosity, is there a reason you wouldn't just wipe the drive completely if it's infected? Using either a Linux computer or a non-Windows computer, I mean. it's possible other files are infected too :P –  Thomas W. Mar 26 '13 at 0:16
    
@TheLordofTime - Some files are necessary and must be accessed. The only copies of those files are on the flash drive. –  FirstName LastName Mar 26 '13 at 7:22
1  
Protip: Keep multiple backups. And scan those files before trying to use them ANYWHERE, since they could also be infected. –  Thomas W. Mar 26 '13 at 14:27
add comment

2 Answers 2

I don't think that there are any dangers with this method. The reason why malware cannot hide when on linux (Ubuntu) because Windows and linux are different. Linux cannot run exe files without applications that allows it to run. Most malware has an autorun type thing that allows to hide the files but since linux cannot read exe files at all the files are not hidden.

I hope this helps.

share|improve this answer
    
Exactly, Linux can't run Windows programs by default, and even if you install something like WINE, most possible damage a Windows Program can make is to your WINE install and not your Linux OS. Linux also will show most files that are hidden in Windows because Linux and Windows use different methods for hiding files from casual users. Basically I often use Linux to check and clean Windows files and Drives since there's little chance of a malicious Windows file to be harmful for Linux. –  japzone Mar 26 '13 at 0:58
    
Also I think there has only been 1 virus in linux which was bliss I think and that was in 1997! –  Goku Mar 26 '13 at 14:10
1  
Mainly because Desktop Linux is less than 10% of the world's Consumer PC market so as such, it's not an appealing target for Hackers and Scammers to spend their "valuable" time on. –  japzone Mar 26 '13 at 15:39
    
Another thing is that in order to make important changes to your computer, i.e. install a new program etc, you need to do it as a root user. The fact that you have to enter your password each time a root shell needs to be run is a good security measure. –  Nil Apr 20 '13 at 2:29
add comment

While saying exes won't autorun or autorun.inf won't get triggered on linux out of the box is true, saying this makes linux auto-mounting completely safe and all malware inert is not exactly the case.

Say, for example, any number of file format bugs is triggered when your file browser renders a "preview" or thumbnail. You didn't have to actually execute anything, but if it successfully triggers, then you have execution in the context of the current user.

Safer, yes. Immune, no. That being said, I don't believe Linux targeted attacks of this type have been seen in the wild.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.