Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is formatting the disk and reinstalling the system from scratch (to Ubuntu) enough to remove any potential hidden software spyware, keyloggers etc.?

Or can something still persist installed in the bios or something like that? What to do then?

To be clear, not concerned about malware. The question is more specific about a machine to which people other than the user had physical access for many hours. So when the user returns cannot be sure nothing changed. So the user makes a fresh install after some weeks. Is that enough to "clean" it?

share|improve this question
3  
Better asked in security.se ? –  Capt.Nemo Sep 16 '11 at 3:40
    
It depends who your adversary is. –  belacqua Sep 16 '11 at 4:05
add comment

3 Answers 3

up vote 3 down vote accepted

Malware cannot usually be installed in the BIOS (it is read only), and also Ubuntu is not very open to malware (it should be the least of your worries, to be honest, and that issue has been covered on this site before).

If you did get malware however, reinstalling (so long as the contents of the affected directory are not preserved) would work. However, you should not even have to go this far, as often times, simply deleting or replacing the affected files should fix it.

Someone having physical access gives them a lot of power over the system, but it highly unlikely for them to put anything in your BIOS, so just a reinstall of the OS should be enough.

share|improve this answer
    
I edited the question to clarify. –  Strapakowsky Sep 16 '11 at 4:46
    
@Roland Taylor: Ubuntu is very vulnerable to malware if the computer can be rebooted. Two minutes will usually be sufficient to disable all real security without the user ever knowing. Ubuntu is fairly secure against remote attacks, however, but that's something else. –  Jo-Erlend Schinstad Sep 16 '11 at 8:42
    
@Jo-ErlendSchinstad from looking at your answer, what exactly merited the comment? –  RolandiXor Sep 16 '11 at 14:03
    
My comment would appear in your responses page and was directed at you, in case you might have any comments back. The other was a pure answer to the main question. –  Jo-Erlend Schinstad Sep 16 '11 at 20:04
    
@Jo-ErlendSchinstad: What I mean is, after reading your answer... I'm left wondering why you posted the comment you did. –  RolandiXor Sep 16 '11 at 21:52
add comment

It is very unlikely that you'll have malware installed in hardware. Actually, you can't do that at all in Linux, which is why we need to use DOS to flash BIOS. It may have been possible for someone to corrupt your BIOS by using MS-DOS or similar, but it isn't likely. If you're really paranoid about it, then you can re-flash your BIOS.

But it is very easy to corrupt an Ubuntu system if you have physical access to the computer, so a reinstall is quite reasonable if you are suspicious. That will remove at least all system-level malware. It is still possible to add a script to be run by a user in order to spy or similar, but that should be fairly easy to find.

share|improve this answer
add comment

Just a few more observations to take into account:

The would-be attacker could also get hold of your (email, banking etc) passwords (or other sensitive/personal data) if you stored them unencrypted on your disk.

It is possible and fairly easy to install and use a hardware keylogger or similar devices, for an example see http://www.keyghost.com/kgpro.htm

If you don't reinstall the Grub code in the first few sectors of the disk, malware could potentially survive there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.