5

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other reports where it was a malware hosting and browser redirect site. I turned off my router and modem and then turned my computer off and booted a live CD to wipe the drive with gparted.

I have everything backed up and can easily do that without a issue. I figured, why take a chance? I use Linux but browser exploits are still a problem and I don't always use noscript.

When something like that happens what else should I do on a linux computer? Is wiping the drive enough? Is rebooting my network devices a good idea as well or does that not matter? I also know about eternal storage devices being infected but I had nothing plugged in.

  • 5
    Are you sure you were affected at all? Websites can do a lot of crazy-looking things in an attempt to get the user to compromise something without using a browser exploit, which are rare for Firefox on Linux, assuming you’re up to date. – Ry- Oct 2 '14 at 2:49
  • There was definitely hijacking and re-direct stuff going on. – malquinn99 Oct 2 '14 at 2:56
  • 6
    This is quite an over-reaction. Unless your OS and browser are not up to date and Firefox is still in crazy mode after a restart, I wouldn't be bothered. – Question Overflow Oct 2 '14 at 2:57
  • 6
    @malquinn99: That sounds like a compromised website, not browser. – Ry- Oct 2 '14 at 3:03
1

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but it's the only way to be sure you won't have repercussions from this later.

  • I burn a live CD every now and then and then have a USB drive I put the latest release on so it won't infect the USB drive by any chance when wiping the drive. I need to make a new email account anyway so I might as well change all my account passwords and I didn't even think of changing my login password, thanks for the tips. – malquinn99 Oct 2 '14 at 2:48
  • I'm fresh off of writing an incident response playbook for a user's laptop being compromised, so it was all at the front of my mind. :) – theterribletrivium Oct 2 '14 at 3:18
1

Completely formatting your system is a good step to take if that is a feasible option for you. But there are chances of a Rogue DNS on your network which directs all the non-ssl traffic to a predefined address. That might effect other systems on your network. Make sure that you check your DNS entries too. If you are not sure about them, use Google's DNS - 8.8.8.8 and 8.8.4.4.

1

Your browser may have been hooked with some JS. A bit like what's used in BeEF.
Did you click on any prompts or anything inside the page prior to the redirect?
If you turned everything off immediately you might be safe but definitely clear your browser cache, remove any saved passwords from firefox and change all of them. Possibly uninstall/reinstall firefox too.

-1

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such attacks.

  • Without disagreeing with anything you've said, I'm not sure that there really was a successful exploit and a need to do anything besides restart the browser. – Neil Smithline Sep 27 '15 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.