I tried to fix a rootkit virus on my laptop by using Windows Defender offline, and it wound up bricking the computer. So now I need to install Windows. I plan to use this opportunity to swap out the hdd for a sdd too.
But a question: I have no need for any local storage as I had a NAS where all the pictures, videos, documents reside. Why can’t you buy a drive with say Windows, Flash, Internet Explorer, Office, Java etc installed that is read only to completely eliminate any possibility of getting a virus. Or why not have an option, say a hardware jumper, to disable writing after you have the operating system stuff installed. I know about the Internet cache but I could do without it if it would mean I wouldn’t get viruses anymore.
One problem would be Windows need to write to the hard drive. Things like the virtual memory, web cookies, log files, updates, and a bunch of other stuff depending on the version of Windows.
I don’t know about Windows, but in Linux you can set filesystems to mount read-only. If some things need to be written, like an internet cache, you could probably put them in a ramdisk.
Plan A would not work, because I’d want different preinstalled software than you do, and besides, we’d never be able to update it.
But Plan B – a jumper to disable the writing, so that you could temporarily allow writing when you needed to – is a great idea. The only catch I can think of offhand would be a need for another drive for stuff like temp files. But that shouldn’t be too difficult. In theory, anyway. In practice, the big problem would be telling all those software programs to place those temp files elsewhere - too many of them use the same C: drive folders where the main software is installed.
The idea has an elegance that is attractive. For a home computer dealing with office/facebook/e-mail/youtube and things like that it could be workable.
I think, however, that you’d need a Linux setup. Doing that in Windows (or MacOS) would be unwieldly.
The problem with this idea is it doesn’t really solve anything.
It might prevent root kit infections, but it wouldn’t prevent anything in user space. Since most malware (these days) is interested in user-specifc data (like password harvesting), a user-space infection is pretty bad. Especially since most users run with admin privileges.
A system that only lets you update/write to the hard drive with explicit permission? Sounds like UAC. What did most people do? Learn to ignore it. OSX also does something similar, and users similarly type in the admin password to any seemingly legit operation.
At home, convenience trumps security almost all the time. Nobody wants to jump through even more hoops to browse the internet and word process.
And most users can’t tell whether a program is safe. It doesn’t matter if you solve the problem at the OS level or the filesystem level; it’s a social issue and not a technological one.
And you also wouldn’t be able to update Windows or modify it in any significant way (registry entries, bringing back the start menu, group policy, etc.). You can lock down the system tightly to the point that it just becomes a kiosk, but then you just end up with something as functional (or not) as a Chromebook or a Windows Guest account, which people tend to abhor using at home.
Corporations already often do this with disk reimaging software or other “total lock down”/deep freeze like solutions. Locking it down at the file system level offers very marginal benefits over doing it at some other level, and it really isn’t the root of the issue.
The problem isn’t file system lockdown vs OS lockdown, it’s security vs convenience.
I’ve used Enhanced Write Filter to do basically exactly what you are asking for. It was used to protect a delivered system from modification, but you could easily add it to your primary partition on a home PC. I’ve only done it with Windows XP (Embedded), not Win7.
File-Based Write Filter is similar, but may only work on Windows Embedded OS although I’ve seen a few sites claiming it works in XP Pro as well. Not sure about Win7.
I’ve gotten plenty of viruses from never clicking on anything, I have no idea how but it happens to me all the time, so the idea that UAC actually does anything seems dubious to me. It seems like a good idea in practice but viruses evidently bypass it somehow.
Cookies would be a problem (maybe save them on a flash drive) but once I have all my programs installed, why update them if it’s physically impossible for them to ever be compromised
If malware can run live in memory without ever writing anything to permanent storage, would that be OK? Not everyone turns a computer completely off every time they’re done using it. Many laptops use “sleep” mode, which preserves memory contents…meaning live malware remains resident.
That includes surviving reboots. If they hook system restart vectors in the OS or otherwise provide themselves high-level priveledges, the only real recourse would be a complete power-off and power-back-on before doing anything sensitive (to kill resident keylogger malware, for instance).
It’s an inadequate solution. It’s no better than other inadequate solutions (like booting a live CD or a virtual machine that you restore from a known-clean non-writeable snapshot), in the sense that it doesn’t prevent resident malware from taking root for as long as the OS instance runs. And it’s inconvenient enough to make normal users never use it.
And it interferes with a good mitigation: patching the OS and critical vulnerable software tools to avoid being infected in the first place. You’ll freeze your system in a state of vulnerability that will allow an infection to run rampant for as long as you have the computer powered up, and allow you to potentially be re-infected as soon as you turn the computer on.
Malware on the disk is not the problem. Malware executing in memory is.
It’s not perfect, but nothing short of a physical/mechanical switch is either. UAC only protects key system files, not everything. And – no offense – users often think they’re safer than they are. You may have accidentally opened something, or gone to some rogue webpage, etc., without being consciously aware of it.
Because that means you will never be able to prevent attacks in the first place. Nothing might get written to disk, but malware could still exist in memory (as gnoitall explained) and you would never be able to patch the holes that let them in because you can’t update your own system. In this case you would be 100% safe against known attacks and completely helpless against future unknowns. You’ve merely changed the problem, not fixed it.
I should point out that Android phones already work similarly; applications can’t do anything until you explicitly grant them permission. You can use the stock phone without adding any apps and it’ll likely never run into any major security issues.
But what do most users end up doing? Install apps willy-nilly and grant them all sorts of permissions without understanding what it means.
Even if you made the disk write-only, a simple dialog asking “We need to temporary save our HD graphics to your disk, but we won’t access anything else, promise, really!” would probably be enough to get users to click OK.
I could do that with DOS and pre-IDE HDD. There was a “write” wire in the connector, and I could just cut/disconnect the wire.
I don’t know what the wires were in an ATA (IDE/PATA) connection, and it would not work for Win XP/2K without modificstion anyway. I never had the energy to do a File Filter modification to XP to make it possible.
Without the File Filter modification, I think it would be possible to move system32 and Program files to a locked drive, but I never had the energy for that either. Much as I dislike unix-inspired user interfaces and API, I wouldn’t use Windows if I had a real need for a locked drive.
its good view to stop viruses to enter you data or corrupt your programs. it is actually, impossible to do this because every program which you try to run is creating temporary files in the installed or separate folder. therefore, in my view, it can’t be possible…
Such a jumper is (or at least was) a standard option on SCSI hard drives. You can still get SCSI drives today, though they’re not popular in the consumer market and aren’t supported at all by some vendors (such as Apple).
How do people even get viruses? Are you like… actually allowing ads or something? Haven’t had a virus since win98 days, and even those were my own fault… like how virtually all (barring espionage) virus infections are the user’s fault.
You did not just win a free ipad, you’re doing it horribly wrong if you can even SEE that ad saying you did, videos do not end in .exe, and anything more than Windows Defender is a waste of memory.