-1

I dabble in Linux from time to time. Oddly enough at one time in the past and just today, I've found my system compromised (that is my perception at least). In my opinion I'm no expert in Linux or even an intermediate user, but I am technically knowledgeable enough to know my way around a computer, especially Windows.

Let me explain whats happened.

Some time ago when I was just getting really serious about learning to use Linux, I was running Fedora from an external drive. I do know that I had never visited any shady websites with that particular installation. What happened next was inexplicable to me as a long-time windows user. I noticed that a file on my desktop moved as if someone had click & dragged it.

I wasn't not paying much attention to it at the time. A day or so later I booted the machine up again and witnessed the same thing happen. To me it was as if someone was "in" my machine, dragging and dropping files from or to my machine from some kind of virtual interface invisible to me.

I nuked that installation with a re-format.

I began to get serious about learning to use Linux just this week. I decided to just run Fedora from within Oracle's VirtualBox. I was partitioning a drive with fdisk (using SUDO instead of SU after adding my account to the sudoer's file) when I noticed that when I looked at all of my partitions I could see my hard disk outside of the VM! I entered another command, and recieved a warning about a AVC denial. As soon as I said "That doesn't look right..." my Windows 10 OS running the VM signaled that Windows defender and my AV solution had been turned off. A bit alarmed, I proceeded to try to get it running again but Windows wouldn't have it. I spent a few hours fixing everything. It got to a point (after shutting down the VM) where whenever I booted and logged in to Windows 10, a BSOD would occur with a "watchdog_violation" of some kind.

This VM needed an update, it had been bothering me for software updates for at least two or three days. As with my Windows experience, getting compromised in a short period of time like that didn't seem likely to me.

I managed to fix it just now and I'm on it running a windows defender scan.

So my question is: how can I prevent someone from compromising my machine in the future? What are some security best practices with Linux and VM's?

I did not use SU, I used SUDO. It was running from within a VM, and I don't know how the connection to the web works in that configuration. I don't know how in the world someone would have managed to get in to my VM and then my outer machine that way.

0

1 Answer 1

1

I do not know anything about windows; I do that that if you are running a verified, by md5 checksum (https://getfedora.org/verify), version of Fedora in a VM that you are more likely to be struck by lightning in the same place three times while winning two powerball lotteries concurrently than to have been comprimised that quickly. Also, the KVM aspect of the compromise would would be surprising also. If someone wanted your files, and they were this skilled, they would rsync your files and then cover their tracks so you would not know they were in your box(en). They would not drag and drop them around your windowing system.

The avc denial message was from SELinux - I can't post more than 2 links, search google for the SELinux FAQ:

How do I find out whether SELinux is denying access for any software?

When SELinux prevents any software from accessing a particular resource, for example when Firefox is denied access to /etc/shadow, it generates a message and logs it in /var/log/audit/audit.log or /var/log/messages if audit service is disabled. If the log contains "avc: denied" that means it is a SELinux policy denial. Note that you would need administrator privileges (root access) on your system to be able to read this log file. An example denial would look like

type=AVC msg=audit(1214965667.121:635): avc: denied { unix_read unix_write } for pid=15524 comm="npviewer.bin" key=59918130 scontext=unconfined_u:unconfined_r:nsplugin_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s

Linux hardening is a vast topic. Here is an article, with tools, that will help you scratch the surface of hardening your boxen and then testing against your configurations. - http://opensourceforu.com/2015/06/the-most-popular-security-assessment-and-server-hardening-tools/

2
  • Thank you. Based on your answer I don't think the machine has been compromised. In fact I've been running it and things have been fine. I'm not going to investigate further; I think its fine.
    – jayftw
    Commented May 15, 2016 at 18:33
  • I guess I'd probably just say this. I reformatted the drive the Fedora was installed on way back when I was fooling around with it (the first time) because seeing those files move around like they did freaked me out. I'm actually a somewhat of a paranoid person, and seeing those files move exactly like someone had clicked and dragged them of their own accord didn't seem right to me. I think some other odd stuff happened after that as well. That is just my explanation for "nuking" that installation. It was a somewhat fresh install at the time so there wasn't much to lose. That is all.
    – jayftw
    Commented May 31, 2016 at 12:53

Not the answer you're looking for? Browse other questions tagged .