Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have dual-boot with windows 7 and ubuntu.

  • /dev/sda1 ext4 (/boot)

  • /dev/sda2 ntfs (windows partition)

  • /dev/sda5 ext4 (root encrypted)

I don't have any concern of adversaries gaining physical access to my laptop and installing keylogger on unencrypted /boot partition.

But my concern is that if my windows 7 is compromised by adversary could they(Without Physical access):

  1. Enable windows to recognise ext4 boot partition and install keylogger there to record paraphrase on next ubuntu boot.
  2. Read paraphrase collected by keylogger on next windows boot.
  3. use that paraphrase to unlock linux root partition from windows, and replace original kernel.

Or am I being paranoid?

I m linux newbie, and very concerned about privacy. Please help.

share|improve this question
    
Such software would be large and easily discoverable by scanners. But your concerns are justified. So do not use your Administrator account in Windows when unnecessary and take all precautions known to you to keep Windows free of viruses. –  Danatela Sep 24 '13 at 8:11
    
Thnx first sentence does give a lot of relief. I do take a lot of precaution, My concern isn't random viruses, rather it's have my ISP's connection software. I spotted some strange behaviour in its software. But even if they were determined enough to get the paraphrase through infected bootloader, they will have to decrypt whole Linux partition to spot kernel and replace it with infected one. That would definitely require lot of storage, processor and bandwidth. Should be detectable by antivirus and firewall, I hope. –  linux-newbie Sep 25 '13 at 12:05

2 Answers 2

up vote 0 down vote accepted

Yes, in theory an attacker can install a modified kernel with a keylogger to your /boot partition.

If you are worried about this you might want to run Windows in a virtual machine rather than dual boot.

share|improve this answer
    
Unfortunately running windows in virtual environment is not an option for me. I was rather looking for ways to secure /boot against modification from windows. Or checking for changes in /boot partition on every Linux startup. I tried md5sum and sha512sum of whole /dev/sda1 but that doesn't work. Because values are different on every boot, no matter what. md5sum and sha512sum of only bootloader files doesn't seem practical because it may detect infected bootloader, but what if somebody is using a keylogger separate from bootloader. –  linux-newbie Sep 25 '13 at 12:16

You should be able to put Grub and your unencrypted /boot partition on a USB key; the key can't be tampered with when it's not plugged. Set your bios to ask where to boot from. You're still trusting the bios and your hardware to not log your keys of course, but it can't be helped.

Messing with boot disks isn't a newbie-friendly occupation however, because mistakes can be hard to recover from.

share|improve this answer
    
But Even with /boot partition on USB, I have to attach the USB to boot, which makes USB accessible to potentially infected windows. Or am I getting something wrong?? –  linux-newbie Sep 25 '13 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.