[SOLVED] Clearing suspicion of malware having been installed

[Darkyyo]

This is a bit of a relatively silly issue, but I am unable to log in to any of my sensitive accounts until it is resolved. I'm fairly new to Linux, and while I know that isn't an excuse for not knowing better about e-security, I've just realized I've clicked on a phishing link a few days ago. I'll admit: the urgency got to me. However, I didn't even get to the "login-details-harvesting" stage; a blank/broken page was all that was displayed. This leads me to believe the link was repurposed to be infectious as people spread the word of its original nature, and that I was thus still affected.

Again, I'm not completely sure. I did notice a slight increase in my CPU usage a minute after, but this is no longer the case and could've been a placebo (OpenJDK running at the time does this sometimes). Someone who touched on this issue jokingly called it a RAT link, which may not be too far from the truth. I mean, I am well aware malware for the community targeted needs to bypass both written and visual forms of authentication to be effective.

I did what seemed best: I ran a full ClamAV scan (which gave me this reportedly false positive) and changed the most sensitive passwords input while unaware of being a possible victim, from a separate device. Local semi-professional advice tells me I should also look into closing any suspicious/unnecessary ports and startup processes, though I'm not too sure about how I'd correctly go on to do so. I'm even thinking of reinstalling just in case, but that already seems like too much work, and so far, no damage has been done.

I know of Linux's superior security and that this may be an overreaction, but I just want to act responsibly: learn how one usually contains or eliminates a possible/perceived threat in this OS — preferably without having to reinstall it.

[alamahant]

Maybe have wireshark or tcpdump run all day and check if there is any suspicious traffic.
Right now in the EU there is mayhem going on about pegasus and predator malawares.
But i think they target more ios and android.
There is another horrible kind of attack called zero-click.
No need for you to click on a link.
I wouldn/t worry too much.
Which browser were you using?
Maybe delete its .config and .cache?
Just a naive thought.
I think best is tcpdump way.
Just have it run without your using your machine.
For a day or two.
Have you seen this
https://noscript.net/
_________________

[Darkyyo]

I was using Firefox.

Yes, I've used NoScript for some time. However, I had disabled using said extension long before this incident due to recurrent inconvenience.

Are there any particular factors that would define these "suspicious" packets I am to look for?

[szatox]

Do you do any backups?
Perhaps it would be possible to compare the current state of your system with a known safe copy?

You don't have to immediately restore it, just check which files are new/modified to filter out the vast majority of stuff that's obviously OK, then you should be able to drop files you created from the remaining list, and some gentoo files, maybe a few other categories of safe stuff, and you might and up with only a handful of files which require their content to be inspected.

Now what backup was intended to do, but it is something that backup makes possible.

[alamahant]

[Darkyyo]

szatox,

I unfortunately did not generate any backups beforehand, though I definitely will after this is resolved. Perhaps there are any other naturally generated logs that I could look at for reference?

Examining my network's traffic seems like a solid measure for now.

[NeddySeagoon]

Darkyyo,

There no no may to be sure of the absence of something.
Look at SETI. We have done a lot of searching but found nothing.
Absence of evidence is not evidence of absence.

You only safe course of action is a clean reinstall. You can't even trust your data post 'possible infection', so that has to be restored from a backup.

If you don't need that level of assurance, the advice here is good.

I had something get into a KVM a few months ago. It was trying to connect to several IP addresses in China using ports that my firewall does not permit.
I do check logs from time to time.
That KVM was recreated and the original shut down for a later investigation. I'll probably just delete it when I need the HDD space.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[alamahant]

Also you might wish to run

[psycho]

[Hu]

File mtime is only advisory. touch can easily make a file appear much older than it really is, so using mtime to find files that were modified by a hypothetical intruder is not reliable. A clever intruder would restore the mtime of any files that it needed to change.

[axl]

I guess you could try an equery k \* (part of gentoolkit) which will verify which files have changed since they were last installed. Maybe modified time can be faked, but its more unlikely an intruder would actually go to the trouble of faking the installation signatures as well. Each distro is different and gentoo is not exactly popular. This will _NOT_ tell you if files were added to the system, but at least you can see if something was modified, which is better than nothing.

[steve_v]

It certainly won't catch everything, but FWIW opensnitch (pentoo overlay) is quite functional these days and can be set to alert, block, and/or log outgoing connection attempts from new processes or to new hosts.
There are many other utilities, such as rkhunter, tripwire, lynis, auditd etc. that will scan for known rootkit behaviour, detect modified system files, watch for listening ports, etc.
The catch is that all of these work best when set up before something suspicious goes down.


As for clamav, you might as well ignore it. Last I checked pretty much all it's signatures are for windows malware, and it's primary use is protecting downstream windows endpoints - e.g. scanning email.

Otherwise, yeah. The only way to be properly sure is to nuke it from orbit. This is one of the reasons we have backups.
That said, the chances of you catching a drive-by from a web browser are small, and smaller still that it somehow managed to escalate to root and impact anything beyond your user account.
_________________
Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy.

[axl]

I thought of another thing. You can't trust netstat, because it could be patched and/or modified, but you certainly can nmap the system to see if it has some open ports that shouldn't be open. Only don't do it from the same system, but use one you can trust.

[C5ace]

I had a couple of years ago an attack through wine that filled up the disk with many small files. The guy wanted $500.00 paid with Bitcoins to let me restore my old Windows games and other stuff. He was not impressed when I emailed him to f...k off.

To be save I ran dd on the disk, partitioned, formatted and restored my backup. This took about 15 minuted keyboard time. Now Windows programs only run in VirtualBox.
_________________
Observation after 30 years working with computers:
All software has known and unknown bugs and vulnerabilities. Especially software written in complex, unstable and object oriented languages such as perl, python, C++, C#, Rust and the likes.

[axl]

[Leonardo.b]

For the future, consider to set up a sandbox for your web browser.

[C5ace]

[axl]

[C5ace]

[Darkyyo]

My apologies for not continuing the flow of the thread sooner. Having read all suggestions, I suppose I shall abide by the consensus: that of reinstalling being the only way of being completely sure.

[Leonardo.b]

Opening a file is dangerous when the program opening it has exploitable bugs.

For example, a recent thread about a LibreOffice security bug:
https://forums.gentoo.org/viewtopic-t-1158299-highlight-libreoffice.html

A very simple exploit using ldd + a little social engenieering:
https://catonmat.net/ldd-arbitrary-code-execution

Even vim may be subject to security bugs:
https://ubuntu.com/security/notices/USN-5247-1

I don't think cat is vulnerable to anything though.