I got a question regarding the read-only feature of the LiveUSB. Being mounted as read-only gives added security since potential intruders can't mess with the system (a reboot takes care of any changes). But since I can re-mount the stick as rw (using the menu, logged in with root privileges), it seems that an attacker might be somehow able to do the same. My question is: how hard / how feasible would that be?

The only risk is, that you are on an unsecured internet connection with ports open, an attacker knows your IP, etc. If an attacker tries to destroy some things on your usb stick, you will notice this pretty fast: the system will hang. If you carry personal data and passords on your stick, well, eh.

Tip: make a personal remaster where you have changed the root and the guest password (in the MCC).
And you are really secure.
And if you are paranoid, start the live cd with: livecd fstab=ro,noauto
.. and your partitions are not mounted.

Yep, I have changed the passwords and setup the firewall in the MCC and there is no personal data on the stick, but wonder if an attacker would somehow gain root privileges, could he re-mount the USB stick as rw? Is there any way to build a remaster (or use a boot code) where that is not possible?

"if an attacker would somehow gain root privileges"

IF that happens, probably yes.

Possible? Maybe.
Feasible? Probably not.
Likely on a live system? IMHO, no.

Don't confuse security with paranoia

But if I can go to the mount LiveUSB mount rw menu and remount the drive as rw after entering the root password, then anyone with root privileges should be able to do the same....right? Obviously, root privileges aren't that easy to get, but if an attacker did manage to obtain them, then I am not convinced that a live system is actually significantly more secure than an installed system - but I am more than happy to be convinced otherwise by someone more knowledgeable...

someone more knowledgeable than me in any case

The problem. Adrian, are your assumption: if an intruder could gain root access?

How do you think that this is technically possible on an secured network? All ports closed? You run no server?

IF --> then a Live CD is pretty secure, no one can write to it.
IF -> a Live USB can (theoretically) be touched, but because it is a statical system, within 10 minutes you have the same system back.

IF you ever see an attacker to gain root access on your secured MCNLive --> let us know. That woulde be very interesting

Well, I was just contemplating a worst-case scenario (hypothetical), and also wondering about the advantage of usb stick over a hdd install in this regard.



Well, if an attacker could remount the LiveUSB drive as rw and make changes then not, and that was basically my question (how feasible that would be - i.e. how easy is it to remount the usb as rw if some form of root access has been gained).

but then you could say exactly the same for a normal HDD installed system...
If i get access to a full hdd system as root, and mae changes in fstab to mount other FS's, change ro to rw, etc, and reboot the system, the effect would be the same.

The live usb stick advantage is; you can recover it within 10 minutes.
But: your assumption is wrong!

A worst case scenario: is a philosophical question.
In a worst case case scenario, we all would be dead, the sun would be exploding the next weeks, the devil would destroy the universe - and we would not have to care about Linux.

that's exactly what I was trying to say...

You forget that I am coming from the dark world of windows where nasty people get admin access all the time through things like mean active X scripts, browser bugs and the like . You guys seem to think that getting root access under Linux is pretty impossible, which is a nice tought. I admit that I tend to be pretty security-oriented in my thinking, a major reason to migrate to Linux .

how do you mount it for writing?
it doesn't allow me to mount saying that "device does not exist" (i'm using MCNL Jordaan)

somora,

in Jordaan the small wizard to remount the partition read-write is not yet included. Jordaan was our first edition ;-)

Manually you would have to do this, open a terminal:



Now you can write to /mnt/liveusb -- it is the first partition on your stick.
You need to do this as root.