0

I had some suspicious pdf files on my linux computer. I opened it in firefox and Evince pdf reader and I forgot to use VM or any other sandbox. Is it possible the pdf to be infected with any kind of spyware and they infected my linux machine?

After that I downloaded a new linux iso and burned it on usb with unetbootin. Is possible for that virus to infect my new linux installation and my new machine to be with any spyware/trojan?

How can I scan my linux machine for spyware? I had all latest updates and installed and my linux was regularly updated.

5

Is this attack vector possible?

I would say it is possible because there is no 100% secure software. In this specific case you are using Evince which is using the poppler PDF library which had several security problems in the past and there is the chance that there are some unknown vulnerabilities either in evince or in poppler or the libc library etc. And while you probably did this as an unprivileged user there were privilege escalation attacks in the past in Linux and there will be probably more in the future. And once the attacker has access to the kernel space there is not much which will protect against full permanent system compromise, which might also include your downloads, downloaded keys for verification of downloads etc.

But a VM would not have fully protected you too because there were bugs in the past in XEN, VirtualBox, KVM/QEMU etc, i.e. every virtualization software.

How can I scan my linux machine for spyware?

While I think that this attack is possible in theory I very much doubt that it can be easily done. Which means that this attack could only be done by a very knowledgeable attacker who will probably also be able to bypass any spyware scans, because such scans only employ some heuristics and can be tricked.

If you feel that your system is compromised in such a deep way you must be very paranoid. But if you deal with secrets some government or criminal organisations are very much interested in this paranoia might be justified. In this situation your only choice would probably be to throw away your existing system and get a new one. But remember, that the new system might also be compromised already by the vendor or gets compromised during delivery or that that data you restore from backup might already be compromised from earlier infection or that your router might be infected etc.

There is no such thing as 100% security and you have to find out for yourself how valuable your data or systems might be and how probable it is for you to be a victim of very targeted and expensive attacks. And if you just opened the typical PDF malware which uses bugs in Acrobat Reader then you are probably safe because it is highly unlikely that these attacks work against Evince too.

I had all last updates and installed and my linux was everytime updated.

While it helps to have the latest updates you should understand that updates are often done because security problems where found. And often these security issues are used in exploits before the update gets released, i.e. often the update is only done because some new exploits where found in the wild which used previously unknown bugs. Thus having the updates only fixes against the problems which are already known and fixed and not against the unknown or unfixed problems.

  • I reinstalled the OS but image was burned with same (maybe infected) PC. Is infection still theoretical possible? – user104972 Mar 19 '16 at 15:56
  • @mariomako: Yes it is still theoretically possible, like with a compromised download, hacked BIOS/UEFI.... Lots of possibilities but probably unlikely unless you are dealing with attacks specifically targeted at you by an advanced adversary. – Steffen Ullrich Mar 19 '16 at 16:00
  • Is there way to secure that computer? Create other bootable usb from other safe computer or anything else? – user104972 Mar 19 '16 at 16:17
  • @mariomako: I think "no such thing as 100% security" and " your only choice would probably be to throw away your existing system and get a new one" already provide an answer to this. But also note that I consider such attack possible but highly unlikely against the average user. – Steffen Ullrich Mar 19 '16 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy