0

I used

sudo apt-get update
sudo apt-get upgrade

before I read https://www.debian.org/security/2019/dsa-4371

There was I change that my PC got exploited/hacked/virused. So I used

chkrootkit

and deleted all that was infected After that I reinstall all packages with changed debsums

sudo apt-get --reinstall install $(debsums -c 2>&1 | grep -E -o 'from [^ ]* package' | cut -d\  -f2 | sort -u)

Is my PC safe now ? Is it possible to have some virus or stuff like that running on my PC ? How to remove it ?

| improve this question | |
1

The DSA-4371-1 is a vulnerability that requires a man-in-the-middle between APT and a mirror. Of course this can happen, but it's not the only possible source of the infection. Reading the article made you extra cautious, and you ran chkrootkit, which then found something. If you didn't run chkrootkit shortly before, it may well be that those problems have been there longer. First thing is to rule this possibility out.

It's hard to know what has happened on your mirror unless they have published finding malicious content. If you have a snapshot backup of your system from time before 22 Jan 2019, you could test that version again with chkrootkit or similar. If the backup was clear, then this vulnerability in APT is likely the cause for your infection and you can run the system safely after recovering it from the clean backup.

If there's no clean backup, reinstalling the whole system is the only option, no matter how it was infected.

| improve this answer | |
0

The attacker might have installed additional software or modified some user specific startup script (.bashrc) or created a backdoor inside a web application or modified some custom scripts of the user. Given that none of this touches the intentionally installed Debian software or its configuration it is not covered by the method you propose. And chkrootkit will likely not find this either.

Using chkrootkit to remove the found infections and reinstalling infected packages will only bring some part of the system back into a known good state. The other part remains in an unknown state (i.e. potentially malicious or potentially safe) and will stay this way unless you have information how the known good state for the rest should look like. This might be done by comparing it to a recent backup (before infection) or similar methods building on knowledge of the previous good state.

| improve this answer | |
  • is there an article, guide or documentation How to check and remove malware/virus in case attacker might have installed additional software or modified some user specific startup script (.bashrc) or created a backdoor inside a web application or modified some custom scripts of the user ? – user197878 Jan 26 '19 at 20:45
  • only way to be sure there is no more malware/virus is to reinstall ? – user197878 Jan 26 '19 at 20:49
  • 1
    @user197878: See my updated answer. The only way to be really sure that no malicious changes were done to the system is to know what the system should look like - not only for the Debian packages and configuration but for all the other software and other files which might have been installed or created legally by users on the system. – Steffen Ullrich Jan 26 '19 at 20:54
0

If you uninstalled the last upgrade as you showed, there is no problem. After uninstalling it you can download the latest updates with wget or curl tools. Then you can install with dpkg -i.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.