Is my PC safe after DSA-4371?

Question

I used

sudo apt-get update
sudo apt-get upgrade

before I read https://www.debian.org/security/2019/dsa-4371

There was I change that my PC got exploited/hacked/virused. So I used

chkrootkit

and deleted all that was infected After that I reinstall all packages with changed debsums

sudo apt-get --reinstall install $(debsums -c 2>&1 | grep -E -o 'from [^ ]* package' | cut -d\  -f2 | sort -u)

Is my PC safe now ? Is it possible to have some virus or stuff like that running on my PC ? How to remove it ?

Answer 1

The DSA-4371-1 is a vulnerability that requires a man-in-the-middle between APT and a mirror. Of course this can happen, but it's not the only possible source of the infection. Reading the article made you extra cautious, and you ran chkrootkit, which then found something. If you didn't run chkrootkit shortly before, it may well be that those problems have been there longer. First thing is to rule this possibility out.

It's hard to know what has happened on your mirror unless they have published finding malicious content. If you have a snapshot backup of your system from time before 22 Jan 2019, you could test that version again with chkrootkit or similar. If the backup was clear, then this vulnerability in APT is likely the cause for your infection and you can run the system safely after recovering it from the clean backup.

If there's no clean backup, reinstalling the whole system is the only option, no matter how it was infected.

Answer 2

The attacker might have installed additional software or modified some user specific startup script (.bashrc) or created a backdoor inside a web application or modified some custom scripts of the user. Given that none of this touches the intentionally installed Debian software or its configuration it is not covered by the method you propose. And chkrootkit will likely not find this either.

Using chkrootkit to remove the found infections and reinstalling infected packages will only bring some part of the system back into a known good state. The other part remains in an unknown state (i.e. potentially malicious or potentially safe) and will stay this way unless you have information how the known good state for the rest should look like. This might be done by comparing it to a recent backup (before infection) or similar methods building on knowledge of the previous good state.