Linux

So, I got malware that seemed to create an hidden proxy or VPN or something when I was online, without me having to install anything. I was on Fedora using Firefox in private mode with Ublock Origin and some script blocker. Ghostery, or Privacy Badger, or something. Fedora has it's firewall enabled and blocking inbound connections, and SELinux was running. It would occasionally report small things like VLC or Clam AV wanting access to something.

It took me a little bit to realize something was wrong.

I realized it after Google started demanding repeated captcha attempts for everything, I started seeing unsuccessful attempts to sign into my Microsoft account from around the world, and some websites started blocking my IP for abuse. A few times, the blocking page (usually Cloudflare) showed that my public IP was over 240.0.0.0, in the unassigned block. My modem logs showed my machine making outbound connections to these random or impossible IPs at times that roughly lined up with my connection issues.

But if I simply hit refresh on those pages when they blocked me, the websites suddenly returned my correct residential IP address and started working again. I was slow to catch on. Hell, I hadn't even used my Microsoft account for years, and I assumed Fedora with SELinux would alert me if anything strange was going on. It didn't. My machine started acting weird, but I couldn't place my finger on exactly how. I tried tools like Clam AV, or any number of intrusion detection solutions to assuage my growing paranoia. Problem is that they require some knowledge and you have to set them up before things go wrong.

Besides a terminal tool to unhide running processes, which inconsistently returned zero to dozens of unknown short-lived programs with increasingly high PIDs, nothing was detected. I later ran that unhide tool on a live USB of Fedora, and it did the same thing, so I assumed it was a false positive.

Ultimately, it was my fault, I know. I just went on a shady website to watch a TV show. Stupid, but not uncommon. My android phone also started acting strangely around the same time. I assume because I visited the same site to finish some season in bed using Firefox mobile. It's been replaced entirely now.

But the point is that SELinux didn't stop anything, I didn't have to explicitly download or install anything to my machine, and it was some kind of drive-by infection that somehow added my machine to a kind of botnet, I think. Hard to tell just from the various logs I gathered from my machine and modem.

I don't know what it was doing, but when I finally put all the pieces together, I completely wiped the drive in that machine, including a long dd operation on the drives with /dev/random. Still not sure what I'm going to do with it.

I'm also not sure if the infection was limited to Firefox itself, or if my entire machine was compromised. I may never know for sure.

While I was being stupid, I wasn't being completely reckless and just running untrusted code from strange places. I watched TV in Firefox's embedded video player. All it took was going to a website that I found by other people recommending it on social media. I should have known better, but I'm human.

If I can't even visit a webpage without getting invisible botnet malware that escapes professionally configured tools like SELinux on Fedora, then how are complete newbies, or kids, or grandparents, or "know just enough to be dangerous nerds" (like me) supposed to be safe?

I agree that the user is the single biggest point of failure in security, and should be mindful. But when you're not installing random Github packages, or turning off your firewall, or enabling SSH, and your machine can still get so easily pwned, what then?

That's the value of anti-virus software. Yeah, it's not perfect, but neither is your list of rules to follow. There is no single perfect approach, and people are lazy, impulsive, and sometimes drunkenly want to watch Breaking Bad. I don't know what the solution is, but outright denying everyday antivirus seems... unwise, I guess?

Even if if takes a month for the vendor to be able to detect it, that's still protection for anyone who comes after. It doesn't have to be perfect to make a positive difference.

And, no: For anyone curious, I'm not going into more detail about the website.

Additionally setting up a firewall is pretty important.