VM Live Mode: Stop Persistent Malware
|VM Live Mode||Host Live Mode||Kicksecure ™ on USB|
This is only available in Kicksecure ™ (and derivatives based on Kicksecure ™). Unavailable in Kicksecure ™ for Qubes.
The primary objective of VM live mode is preventing malware from gaining persistence and having an unchanged system after each reboot. This is also useful for improved storage device privacy as well as experimental changes like testing software.
- Any host operating system: Follow instructions on this wiki page to selectively run Kicksecure ™ virtual machine (VM) in Live Mode.
- Debian hosts: It is possible to boot your existing, installed Debian host operating system into Live Mode by following the Host Live Mode wiki page instructions.
If you are interested in installation of Kicksecure ™ on USB, see Kicksecure ™ on USB.
Booting into live mode will ensure all disk writes to the virtual hard drive are forgotten after shutdown because all writes go to volatile memory (RAM) instead of the hard disk. In other words, after shutdown everything that happened during a previous boot session will not be visible (persist) on the virtual hard drive, including:
- everything that is created / changed / downloaded in the virtual machine (VM);
- any websites visited, files downloaded or documents created; and
- any other modifications of the virtual hard drive or activity history.
This also holds true for malicious changes made by malware, except when:
- read-only hard drive mode is not configured and malware remounted the disk as read-write or broke out of the VM; or
- read-only hard drive mode is configured and malware broke out of the VM. 
Table: VM Live Mode Warnings
|Forensics||By itself, starting a VM in live mode is not amnesic. Many users are unaware that activities performed inside the VM might be stored on the host mass storage device (hard drive, HDD, SSD) in locations that are hard to review (for the majority). Extra steps must be performed on the host operating system to minimize these traces -- see Anti-Forensics Precautions, or better, use Host Live Mode.|
|Malware||To prevent malware from remounting the hard drive as read-write it is strongly recommended to use read-only hard drive mode. This raises the bar as malware would need to break out of the VM to gain persistence.|
Live Mode on Kicksecure ™
From the second start of Kicksecure ™ it is recommended to run it in live mode. This should eliminate any Tor-related, cached data like DNS requests that could leave traces about web activity. However be warned that it may make your Tor behavior distinguishable from regular Tor users:
- Consensus files: These files will be (re-)downloaded more frequently.
- Tor guards: When switching to a new guard after some months have passed. 
1. Shut down the Kicksecure ™ VM.
2. Power on the Kicksecure ™ VM.
3. During the grub boot menu wait until you see the following.
Develop a very basic understand of the following screenshot. Consider the explanation below. Expected time requirement: 1 - 3 minutes.
Figure: Persistent Mode Boot
The following screenshot shows 4 boot options in the boot menu.
Advanced options for Kicksecure GNU/Linux
Kicksecure Live-mode GNU/Linux
Advanced options forKicksecure Live-mode GNU/Linux
The white text color on the blue background further indicates the currently selected boot option. Other boot options currently unselected have light blue text color.
4. Use the arrow key on the keyboard to switch to live mode.
Figure: Live Mode Boot
5. Press enter.
The system is booting into live mode.
Create a new file in your home directory then reboot (assuming you were already booted in the live mode from the boot menu) then restart the VM. You should not see that file anymore.
In the future, running Kicksecure ™ from a Live DVD or Live USB might be supported.
VM Live Mode vs VM Snapshots
Starting with a clean VM snapshot and later reverting to that snapshot should be even safer than VM live mode. That is because snapshots are enforced from outside the VM. In other words, snapshots are enforced by the virtualizer on the VM. Therefore more secure.
It is also worth mentioning that running VM live mode takes up more RAM that is allocated to the guest, since it runs the OS entirely in the memory. That means in some worse cases, it's more likely for VM live mode to run into disk thrashing, where the VM uses up all the allocated memory, and becomes significantly slower. The snapshot approach doesn't have this problem with RAM.
It is difficult to imagine a case currently where the combination of VM live mode in combination with reverting to a clean snapshot would be even safer. Perhaps in case there was a virtualizer bug with snapshots and/or user error forgetting to revert to a snapshot.
Most users can skip this chapter. See livecheck.sh for further script details.
- The meaning of
- The meaning of
If anything in coloumn
RO is set to
0, then it is not blessed read-only hard drive mode.
lsblk without any
snapd installed, Kicksecure, live mode, and read-only hard drive mode enabled.
sudo lsblk --all
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 100G 1 disk └─sda1 8:1 0 100G 1 part /lib/live/mount/medium
lsblk without any
snapd installed, Kicksecure, live mode, and read-only hard drive mode disabled.
sudo lsblk --all
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 100G 0 disk └─sda1 8:1 0 100G 0 part /lib/live/mount/medium
WickrMe installed, Kicksecure ™, persistent mode, and read-only hard drive mode disabled.
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT loop0 7:0 0 62.1M 1 loop /snap/gtk-common-themes/1506 loop1 7:1 0 446M 1 loop /snap/wickrme/352 loop2 7:2 0 55M 1 loop /snap/core18/1754 sda 8:0 0 100G 0 disk └─sda1 8:1 0 100G 0 part /lib/live/mount/medium sr0 11:0 1 1024M 0 rom
- Host Live Mode
- Kicksecure ™ on USB
- VM Live Mode
- VM Live Mode/Immutable Disk Method on VirtualBox
- VM Live Mode/Read Only Mode Hard Drive
- VM Live Mode/ro-mode-init
There are two live mode options available,
grub-live: a new boot menu entry is created which must be selected manually, but it is a better failsafe and hence the recommended option.
ro-mode-init: the boot menu stays the same and the system automatically boots into live mode when it detects a read-only disk, otherwise it boots normally into persistent mode. The advantage of using this approach is that malware running in a VM cannot silently change settings to leave persistent traces.