If I have a keylogger on Windows 10, can it affect me when I boot into Ubuntu on the same computer.

  • 7
    Is it a hardware keylogger? – Oriol Mar 19 '16 at 23:55
  • Note that it's pretty trivial to write a keylogger for Ubuntu. Try to install xinput, open a terminal and launch it as xinput text <id-keyboard> then open a different terminal and try to do something with sudo. Observe how the the events are intercepted when you are typing your password. – Bakuriu Mar 20 '16 at 19:22
  • Theoretically it could. It most likely doesn't. – user253751 Mar 20 '16 at 23:23

No: when you boot into Ubuntu, programs stored on the Windows 10 partition cannot be run and cannot log what you are doing on Ubuntu.

Windows also can not store files on an Ubuntu system since it does not recognize ext4 filesystems.

So for a virus/keylogger/whatever to infest Ubuntu, it would need to magically move itself to something you can open in Ubuntu. You need to activate that something by making it executable, clicking it in Ubuntu to run it and it would need to have valid instructions for an Ubuntu system to be able to run.

Not going to happen any time soon.

A possible method (but it is a stretch): from Windows you get infected by UEFI malware; when Ubuntu is booted it copies some software over to your Ubuntu system and executes itself. (that is assuming something can be copied over from an UEFI partition to another partition).

| improve this answer | |
  • 4
    Theoretically, in could install itself in Ubuntu's start up folder. – PyRulez Mar 20 '16 at 1:24
  • 4
    it could if you don't have encryption on. – PyRulez Mar 20 '16 at 2:14
  • 8
    Malware can include code to read/write ext4 / xfs / btrfs if it wants to, so it can try to infest the Linux side of dual boot systems. It's not like a few hundred extra kB of code will make a piece of malware harder to hide. – Peter Cordes Mar 20 '16 at 4:08
  • 3
    Note that a hardware keylogger that's between the keyboard and the computer will still work just fine no matter what. – Schilcote Mar 20 '16 at 16:33
  • 3
    If the malware has read access to the hard drive, then it can do whatever it likes. It is only limited by the author's skill and imagination. "Windows does not support ext" is almost meaningless in this context as that doesn't prevent the malware supporting it (not to mention other attack vectors e.g. infecting your hardware's firmware). – Jon Bentley Mar 20 '16 at 21:29

As some comments have already stated, it's absolutely possible that a malware can jump between different operating systems on dual boot. There are only two barriers the malware must overcome:

  1. It must bring its own ext3/4 driver to handle the file system used by Ubuntu
  2. It must run with high privileges in order to access the required APIs

Everything else is just a question of the attackers intentions and skill. I don't know any case where "COTS" class malware did this. But when you look at some "weapon" class of malware you'll see modules to persist in BIOS or even the firmware of your hard drive. You will also see that it's highly modular so that every kind of functionality can be added at any time. So if the attacker thinks its necessary, there will be a module for it.

However if you are using full disk encryption (not only /home) it's much harder to jump over.

Otherwise the attacker could just modify existing binaries or scripts which are executed by default by the system.

| improve this answer | |
  • Many dual boot users may install software in windows allowing them to read ext partitions. Malware could also merely detect if this is installed and use it if available. A reduced attack vector than including its own, but certainly easier to implement. – AntonChanning Mar 25 '16 at 13:41

Windows 10 can only track you when it is booted. As privacy-invading as Microsoft is, they can't legally (I hope), make it so something is injected into Ubuntu to track you there too. Unless Windows is booted, it is completely inactive, tracking features and all.

| improve this answer | |
  • ? What does this have to do with a keylogger.. I would downvote if I could – im so confused Mar 21 '16 at 17:04
  • Ah dude, it's no secret that Microsoft Windows 10 has an integrated keylogger, that is forcefully enabled... I too thought OP was asking about Windows 10's keylogger, since he didn't mention otherwise. – Gregory Opera Mar 22 '16 at 19:21

I think it's safe to say, no. If it's a program on the windows OS it would be extremely un-likely it would function on Ubuntu. If it's a hardware key-logger then it would work regardless of any OS running.

Just make sure there aren't any strange devices plugged into your computer.

| improve this answer | |

Depending on if the "malware" was coded to look for dual boot configs which many rarely do as it adds many, MANY more lines of code and is an overall headache, but i wouldnt put it past microsoft to do so.... if it can check for dual boot systems it would most likely remain in the bootsector, reason for the bootsector would be to detect the presence of a grub loader, which, id suggest poking around there with EXTREME caution, and it would be worth seeing if you could modify the "malware" so that it was unusable, but still showed as though it remained on your system.

| improve this answer | |
  • it could nestle itself into uefi but that should invalidate the sign would it not? Not sure though. – Rinzwind Mar 19 '16 at 23:10
  • Not too crazy familiar with bootsectors, but if they designed the OS with it already in, then probably not. – user327198 Mar 19 '16 at 23:11
  • Yeah that is true. Well... I have no windows so i am safe _O- – Rinzwind Mar 19 '16 at 23:13
  • Lol, i still run win7, i mean bootsector virus' have been around for many decades. Refined technologies or methods would make it run seamlessly along side the bios even if they decided to inject it later. Either way, im switching everything over to linux, just having some issues with my ubuntu right now, debating on an arch distro...... cant decide -.- – user327198 Mar 19 '16 at 23:15
  • 1
    This is highly unlikely. If malware was going to attack the other OS in a dual boot system, it wouldn't just modify the boot loader that ultimately loads Linux (GRUB stage 2), let alone just the boot sector or earlier GRUB stages. Once Linux (the kernel) is loaded, it takes over. For a modified GRUB to infect Linux at boot time, it would have to make a complicated modification to the kernel and/or the initrd as they were being loaded. But they're compressed, and decompress themselves on the fly. Easier for win malware to use an ext4 library and write to the root FS. – Peter Cordes Mar 20 '16 at 4:17

No. If you install keylogger in windows it doesn't effect on ubuntu. Because ubuntu didn't support exe excution without wine virtual enviorment. So don't worry.

| improve this answer | |
  • Microsoft Windows 10 has a built-in keylogger (that is permanently enabled for most users!) and as a number of other people have already pointed out, it's theoretically possible for keylogers to operate cross-operating system... Albeit unlikely. – Gregory Opera Mar 22 '16 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.