this post was submitted on 19 Oct 2023
-5 points (36.8% liked)

Linux

48178 readers
854 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

A friend told me they had suddenly open ports in their router, and they suspect a trojan.

So first I would like some way to verify that. I dont trust Windows so I ask the Linux people hahaha.

So its a Windows PC, that has to be wiped of course.

  • plug put from network
  • mount on Linux, copy all personal data
  • overwrite that thing and reinstall maybe a better OS?

So now there are some problems.

  1. The BIOS could be infected, its proprietary and cant just be reflashed (I guess?)
  2. There are maany files that could be tampered with.

So I would like your experience. I have a flash programmer, can you just flash a vendor Bios image? I want to be really sure there is nothing on there anymore.

Can you use ClamAV or something to search files? I would think about a trojan unpacking Word files, inserting a macro and packing again, for example. Or PDFs, or anything else that you would simply keep.

What to do with the Router? If it has opened Ports, may it be infected too?

But before that I would really want to make sure its necessary.

Thanks in advance!

top 7 comments
sorted by: hot top controversial new old
[–] [email protected] 18 points 1 year ago (2 children)

If somebody went to the expense of developing a bios implant to target you and your exact micromodel of computer, just give up. Hand yourself over to Mossad now, and get it all over with.

[–] [email protected] 3 points 1 year ago

Here is an alternative Piped link(s):

just give up.

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[–] [email protected] 1 points 1 year ago

This was fun.

[–] [email protected] 16 points 1 year ago

What does this have to do with Linux?

[–] [email protected] 14 points 1 year ago* (last edited 1 year ago) (1 children)

So first thing, an open port isn't a bad thing most of the time. And a malware infection doesn't need open ports, nor does modern malware try to open ports.

How did they check for these open ports? Did they log in the router and check? Run a scan from an external service?

The most common explanation for unknown open ports on a router in a home network will be a feature called "universal plug and play" or UPnP for short. This allows IOT devices to ask the router for a port to be opened, and by default most home routers will do just that. Devices like security cameras etc often do that so you can access the video from a phone or something. Games also sometimes use UPnP to open ports for multiplayer.

It's considered good security practice to disable UPnP as a lot of devices don't really protect the services they expose through UPnP; but that still doesn't make open ports an indication of malware.

On the subject of games, is there anyone in the house that might try to host a game server? Even something as simple as minecraft doesn't need any additional software and a Google search for how "friends can't connect to Minecraft game" will show instructions on how to set up port forwarding etc.

[–] [email protected] 1 points 1 year ago

Thanks! That makes sense

[–] [email protected] 6 points 1 year ago

Honestly, id just reinstall windows, check the router for port forwarding, change the admin password on the router, and call it a day.

Then, keep an eye on it and see if the situation improves