0

My windows defender detected this trojan: win32/credentialaccess!rfn and I tried to remove it.

I use dual boot with Ubuntu:

  1. can this also effect ubuntu?
  2. If i reset my windows completely can it come again
1
1

I can't say what any individual malware (Trojan or otherwise) might do - nobody can, without analyzing it - but the answer to can it is "Yes unless it lacks permissions". However, it probably didn't, even if it could have.

To modify a dual-boot Ubuntu install from Windows, you'd need one of these to be true:

  1. You have the relevant file system driver installed on Windows (Linux, including Ubuntu, almost always uses different file systems than the ones Windows prefers, but both have optional drivers for the other) and have the Ubuntu file system mounted (for example as drive "L:" for Linux). Then the question would be "what permissions are required to access the mapped file system"; if the malware has them, it can do that.
  2. The malware installs the relevant file system driver, and then mounts the Ubuntu file system and accesses it. This requires Administrator permissions on Windows, since you're installing a kernel-mode driver, but it the malware has those privileges it can do anything it wants to the machine.
  3. The malware opens the Ubuntu partition(s) directly as (a) block device(s) - effectively accessing your entire Linux installation as one or more giant files - and tampers with their bits without bothering to go through the abstraction of a mounted file system. This (opening a disk partition directly) also requires Administrator permissions, although once the "Direct Access Storage Device" HANDLE is open, a process can use it to make arbitrary changes without worrying about file system security on that storage device (because it bypasses any file system entirely).
  4. The malware could modify some lower-level component of the system that is used by both OSes, such as the bootloader (one bootloader typically chains to the other, so there is at least one place that could affect both systems), the BIOS/UEFI (system firmware that is present on the motherboard), CPU microcode (firmware present in modern CPUs that controls their behavior), or firmware for other devices such as the hard disk/SSD (practically every hardware component of a modern PC has its own tiny processor running its own firmware, and that firmware controls how the component operates). In all cases this would require Administrator rights, and in some cases there may be additional protections (such as requiring the computer be rebooted a special way or the firmware needing to be signed by a trusted publisher).

So, does this mean your Ubuntu install is totally hosed if that malware did, in fact, have Administrator privileges? Probably not. Most Windows malware wouldn't know to look for a Linux file system, and wouldn't know what to do with one if it found one. It might notice a mounted file system and access it, but the impact is likely to be limited (for example, it is unlikely to know where Linux software stores its credentials, and thus if it's trying to steal them it wouldn't find any). You shouldn't count on that, but the actual risk is low unless this malware was written by somebody who was specifically targeting machines like yours, or the malware is in general known to be damage Linux systems too. It also might just make the Ubuntu installation unusable, perhaps by accident, if it does something like overwrite some part of the bootloader and prevent loading Linux.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.