Nadrek (10/8/2012)
GSquared (10/8/2012)
Nadrek, please add to your list, "Download using a disposable machine".Hmm... I'll rate that one just below the two LiveCD ones, both of which should be considerably easier than building a machine (unless you do it once and just keep restoring the image to it).
It is, however, an excellent idea, and doubly so if you want to stick with Windows. Just make sure you've got your AV installed with relatively recent updates prior to plugging in the network cable for the first time.
Exactly.
Not necessary with *nix machines, really. But with Windows, if you need that for whatever reason, it's easy enough.
The whole point is build-once-restore-many.
As for AV on it, it depends on what you want to research. If you're researching virus/malware/rootkit code, then not having AV on it can be part of the point. Restore from image, surf some suspected (or known) to be malicious sites, without deliberately installing/modifying anything, then compare the current state of the O/S and disk with the image state. With the right tools, you can find just about anything that way, no matter how cleverly hidden.
For this passwords-from-malicious-sites-thing, AV is probably not a bad idea. But I operate on the assumption that it's got malware on it as soon as I start using it, regardless of whether AV says so or not, and re-flash from the image at the right point, anyway. So AV isn't really necessary at that point. Don't care if I prevent, because I'm going to cure regardless.
Another concern, of course is BIOS worms. Make sure on your system flash that you don't just do the disks, but also the BIOS. Booting from WORM media (CD/DVD/etc.) won't protect you from BIOS worms, and new ones can frequently bypass AV systems (till they get signatured), so be careful about that if you use that solution.
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon