0

Yesterday, I went on a dark creepy site whose js freezed my system/firefox (Ubuntu 14.04 up to date, Firefox 37.0.1 up to date). Now I tried, from the same system, to find any malware with:

sudo chkrootkit

and

sudo rkhunter --check

showing nothing but the default false-positives.

I know it is recommended to do this from a liveCD or liveUSB making it hard for the malware to hide. I have a liveUSB SystemRescueCD but I am not aware of how to accomplish this. I pretty sure I will need to mount the "infected-device" to check it but every tutorial I found just mentioned to do the commands which I have posted above from a LiveUSB. Not how, and I am pretty sure chkrootkit and rkhunter can not check a file system without having it mounted.

However now I am at my maybe infected system with the LiveUSB plugged in but not mounted. (I disabled automount due several reasons)

Could it be that my LiveUSB is now also infected even when it is not mounted? I know the malware could write to the device even without mounting it but this would totally destroy the filesystem on the USB. Where can I look up a mount-history in case the malware did it unbeknown of me? I know, for that he would need my user password but who says that the malware did not log my keyboard when executing an sudo command?

  • You seem to be jumping to a lot of conclusion from what you have posted. I am not seeing where you are getting the idea that your USB has been infected, or why you think you are infected at all, other than firefox crashed once. – cremefraiche Apr 11 '15 at 19:21
  • @cremefraiche the side was de.slideshare.net (do not access, possible malware!) and i went to it second time and it crashed again. After that i disabled js and did browse again on that side and no crash! Taking a closer look on the source code showed many js-sections some inlined and extremely long. The topic was netkiller linux which worries me. Maybe you know that side? – Mike Apr 11 '15 at 19:28
  • 1
    Just a thing: Don't worry! – Helio Apr 11 '15 at 19:29
  • @Helio Why not? – Mike Apr 11 '15 at 19:30
  • 1
    "Can someone please tell me how to check from LiveUSB if my system has been infected? " You are now asking a different question than your original post. Please pick one question and stick to it. After scanning the URL you provided on multiple link-checkers, the link appears to be clean. (Which means it at least does not have known malware signatures, so, it is free of most malware out there). Please do not immediately jump to the 'i've been hacked' conclusion every time your browser crashes. As far as Helio saying it is difficult to infect via Java, that is flat out wrong. – cremefraiche Apr 11 '15 at 20:10
1

To answer the actual question:

Yes, a software can write to a device directly but contrary to your assumption this doesn't destroy a file system since software also can read directly from the file system. If the software does everything right it would just be like reading and writing the usual (indirect) way. Remember that it just had to do what your system does all the time. Plus, the software wouldn't have to care about any privileges managed by the file system.

However – and here comes the good message – to read or write directly requires read/write access to the device files, for example /dev/sdb. This access is only granted to the super user.

You can try this yourself by entering

dd if=/dev/sda bs=32 count=1

into a terminal. /dev/sda is your first hard drive, replace it with whatever your USB stick is (probably /dev/sdb) if you want to test it for it and not your hard drive.

You will get

dd: failed to open ‘/dev/sda’: Permission denied

as output.

If you did this with sudo or as root it would write the fist 32 byte of your hard drive / your USB stick to the console.

However, you should be aware of the fact that normal users can in fact mount devices. So no direct access to the device is necessary and a malicious software can read and write using the normal (indirect) way.

You can test this yourself by entering the command

mount /dev/sdb1 /some/directory/already/in/place

where /dev/sdb1 is the first partition of your USB stick.

  • Thank you. But if one, maybe me, got infected by malware. It can't be a big deal to log the keyboard and that way getting the sudo pwd of my user... Moreover it also must be possible to log bank account information.. I am really afraid of this two possibilities – Mike Apr 12 '15 at 7:39
  • However, you should be aware of the fact that normal users can in fact mount devices. Also it can not be true for ubuntu 14.04 AS i need root privileges to mount a block device, of course for an already existing directory – Mike Apr 13 '15 at 22:14

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.