5

Well, today I was browsing the internet and I suddenly got redirected to a chinese hosted malware site and firefox started going crazy. I checked the url on virustotal with my phone and it found other reports where it was a malware hosting and browser redirect site. I turned off my router and modem and then turned my computer off and booted a live CD to wipe the drive with gparted.

I have everything backed up and can easily do that without a issue. I figured, why take a chance? I use Linux but browser exploits are still a problem and I don't always use noscript.

When something like that happens what else should I do on a linux computer? Is wiping the drive enough? Is rebooting my network devices a good idea as well or does that not matter? I also know about eternal storage devices being infected but I had nothing plugged in.

Improve this question
4
  • 5
    Are you sure you were affected at all? Websites can do a lot of crazy-looking things in an attempt to get the user to compromise something without using a browser exploit, which are rare for Firefox on Linux, assuming you’re up to date.
    – Ry-
    Oct 2, 2014 at 2:49
  • There was definitely hijacking and re-direct stuff going on.
    – malquinn99
    Oct 2, 2014 at 2:56
  • 6
    This is quite an over-reaction. Unless your OS and browser are not up to date and Firefox is still in crazy mode after a restart, I wouldn't be bothered.
    – Question Overflow
    Oct 2, 2014 at 2:57
  • 6
    @malquinn99: That sounds like a compromised website, not browser.
    – Ry-
    Oct 2, 2014 at 3:03

4 Answers 4

Reset to default
1

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but it's the only way to be sure you won't have repercussions from this later.

Improve this answer
2
  • I burn a live CD every now and then and then have a USB drive I put the latest release on so it won't infect the USB drive by any chance when wiping the drive. I need to make a new email account anyway so I might as well change all my account passwords and I didn't even think of changing my login password, thanks for the tips.
    – malquinn99
    Oct 2, 2014 at 2:48
  • I'm fresh off of writing an incident response playbook for a user's laptop being compromised, so it was all at the front of my mind. :)
    – theterribletrivium
    Oct 2, 2014 at 3:18
1

Completely formatting your system is a good step to take if that is a feasible option for you. But there are chances of a Rogue DNS on your network which directs all the non-ssl traffic to a predefined address. That might effect other systems on your network. Make sure that you check your DNS entries too. If you are not sure about them, use Google's DNS - 8.8.8.8 and 8.8.4.4.

Improve this answer
1

Your browser may have been hooked with some JS. A bit like what's used in BeEF.
Did you click on any prompts or anything inside the page prior to the redirect?
If you turned everything off immediately you might be safe but definitely clear your browser cache, remove any saved passwords from firefox and change all of them. Possibly uninstall/reinstall firefox too.

Improve this answer
-1

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such attacks.

Improve this answer
1
  • Without disagreeing with anything you've said, I'm not sure that there really was a successful exploit and a need to do anything besides restart the browser.
    – Neil Smithline
    Sep 27, 2015 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .