5

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon stopped responding to commands. The screen did some odd things - coloured boxes of pixels where I would normally see text, etc. After a short time, the machine rebooted itself.

I was able to repeat the same behaviour with more than one browser, and more than one window manager (it is running under linux). Note that I visited the url but did not explicitly download any files, etc.

I checked the logs after a reboot, and it shows that the X server suffered a segmentation fault.

If that had happened in everyday application use, I would just assume that the application had a bug. However, because a website was clearly the catalyst, I wondered whether malware may be involved.

It seems plausible to me that malware has nothing to do with it. A quick web search indicates that a segmentation fault on X is a problem that has occurred before, and is broadly consistent with the other things I saw. (How a website could cause that, I don't know, but it does look like the simplest explanation.)

But I realise that if malware is the cause, I wouldn't know the difference. Is there any sensible way to corroborate that this was not caused by malware? [I realise that in theory that could never be ruled out entirely.] [I would also like to understand - how can a website crash the X server - but that might belong on a different part of SE. I'd be happy to move the question elsewhere if that seems appropriate, as I wasn't sure where best to post]

  • 1
    Run memdump and PE explorer before accessing that site, it should give you the clue about what are the processes forked after accessing that site. – P4cK3tHuNt3R Mar 28 '16 at 11:29
  • What would you expect to see before/after? – SauceCode Mar 28 '16 at 14:13
  • Just run the browser without loading that webpage and follow the above mentioned step. Do repeat the process when you are loading the webpage. – P4cK3tHuNt3R Mar 29 '16 at 8:29
  • try submitting the website URL to urlquery.net and see if anything stands out – julian Dec 8 '17 at 1:26
  • Did you submit it in Virus-Total ? Apart from getting results from other AV vendors it does URL sand-boxing as well . If it is actually suspicious and leading to crash it should detect that. – Ashutosh Raina Jul 19 at 4:47
-3

This is why there has to be consistent log histories of the machine. The crashes could be due to some other reason but you can only safely assume the cause after several instances of crashes. Also you might like to try a non Occam's razor like answer where if an encrypted tunnel VPN out from the local network rules out the case that it is only particular to that tuple of the website, the local network, and your browser.

  • 1
    I don't understand what you are recommending the OP should try. – Neil Smithline Mar 28 '16 at 3:26
  • I don't understand either. – SauceCode Mar 28 '16 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.