Linux Malware and Securing Your System - Chris Titus Tech
video description
Date: 2022-03-21
Related videos
Comments and reviews: 10
50414e5453534806
Hi Chris Titus Tech, I want to know whether using echo is supposed to return something or not.
I'm trying to determine whether my machine is infected with drovorub (woodcutter) and find a course of action to remove it, or reformat my machine.
As I type touch testfile and echo the /dev/zero I don't get anything in the terminal, but as a matter of fact, echo doesn't return anything in the terminal for me no matter what it is.
I'll try updating and upgrading all my applications and packages and see if that changes things.
Is /dev/zero supposed to be a folder? It appears like a file reference (That everything in linux is a -file- or an -icon-) and I'm not sure where to find the testfile referenced in the script on your site.
I enabled other security features mentioned in your video and things seem the same, perhaps I am in fact more secure.
My -listening ports- show the same connections, I don't have many connections either. I turn off my internet periodically out of paranoia, that if I disconnect my internet I'll also stop any potential bad actor connections to my machine, and just reconnect when I need to do something.
After I got back from vacation, my machine had missing vectors, now there is an -unknown chip xid- something something. I tried restoring my machine with Timeshift from before vacation, but the problem persisted, although I have not experienced anything strange other than those CLI messages before Linux Mint (with GUI) boots and puts me at the login screen.
I think I may have damaged the machine by turning it off, flipping the power on the power supply on the back of my PC, and unplugging it. Perhaps when plugging the machine back in, and turning on the supply, there was a surge of static, but the operating system boots fine. Timeshift didn't really fix those CLI -soft- errors which have me concerned.
reply
Hi Chris Titus Tech, I want to know whether using echo is supposed to return something or not.
I'm trying to determine whether my machine is infected with drovorub (woodcutter) and find a course of action to remove it, or reformat my machine.
As I type touch testfile and echo the /dev/zero I don't get anything in the terminal, but as a matter of fact, echo doesn't return anything in the terminal for me no matter what it is.
I'll try updating and upgrading all my applications and packages and see if that changes things.
Is /dev/zero supposed to be a folder? It appears like a file reference (That everything in linux is a -file- or an -icon-) and I'm not sure where to find the testfile referenced in the script on your site.
I enabled other security features mentioned in your video and things seem the same, perhaps I am in fact more secure.
My -listening ports- show the same connections, I don't have many connections either. I turn off my internet periodically out of paranoia, that if I disconnect my internet I'll also stop any potential bad actor connections to my machine, and just reconnect when I need to do something.
After I got back from vacation, my machine had missing vectors, now there is an -unknown chip xid- something something. I tried restoring my machine with Timeshift from before vacation, but the problem persisted, although I have not experienced anything strange other than those CLI messages before Linux Mint (with GUI) boots and puts me at the login screen.
I think I may have damaged the machine by turning it off, flipping the power on the power supply on the back of my PC, and unplugging it. Perhaps when plugging the machine back in, and turning on the supply, there was a surge of static, but the operating system boots fine. Timeshift didn't really fix those CLI -soft- errors which have me concerned.
reply
Dustin
Regarding kernel version 3.7 or later...a lot of enterprise retail companies (Walmart, Ahold-Delhaize, etc) use much older kernels, such as 2.6, as they are unable (or unwilling) to update their systems past an ancient distro (something like RHEL 6.5). It's an unfortunate reality within larger organizations for us lowly engineers - one where the company refuses to upgrade because of the old -if it works, why fix it-, and because there isn't really a single conglomerate like Microsoft forcing updates down their throats - thus allowing them to kinda just install it once and leave it alone for all of time and eternity.
reply
Regarding kernel version 3.7 or later...a lot of enterprise retail companies (Walmart, Ahold-Delhaize, etc) use much older kernels, such as 2.6, as they are unable (or unwilling) to update their systems past an ancient distro (something like RHEL 6.5). It's an unfortunate reality within larger organizations for us lowly engineers - one where the company refuses to upgrade because of the old -if it works, why fix it-, and because there isn't really a single conglomerate like Microsoft forcing updates down their throats - thus allowing them to kinda just install it once and leave it alone for all of time and eternity.
reply
itech
Nice info. Really like the - No BLAH BLAH - , technique. Very clear explanations . I use jailbreak and it seems to work to well at times so you have to jump in and tweak some of the profiles a bit to get the desired results . I have also created a gigantic firewall based on experiences with Windows 7 and 8 and 10 . Sorry I mentioned Windows 8 or 10 . The Windows 10 experience caused me to start examining all ports related to malware attacks and create some cool firewall rules for them. After burning the Windows 10 disk in a ceremonial fire , I moved to Linux permanently . Thanks for the share. :O)
reply
Nice info. Really like the - No BLAH BLAH - , technique. Very clear explanations . I use jailbreak and it seems to work to well at times so you have to jump in and tweak some of the profiles a bit to get the desired results . I have also created a gigantic firewall based on experiences with Windows 7 and 8 and 10 . Sorry I mentioned Windows 8 or 10 . The Windows 10 experience caused me to start examining all ports related to malware attacks and create some cool firewall rules for them. After burning the Windows 10 disk in a ceremonial fire , I moved to Linux permanently . Thanks for the share. :O)
reply
Pedro
Look look teh snow boom bommm... Look the snoow... The structures... Look boom bommm arquitecture the shape... Boom bommm
Snow... Formation... Teori.. Electric charger... Like a clowd... Mmmm... Ahhhhhahhhh inmortal jailanden.... Electric robot... Migrate... To new economic... Need you nedd i need.... Death.... Thanks... But.... New.. Cloud.... Is electric... Charger like inmortal... Pease need your respuesta... Yo can use fedex... Mi house...your house.... Bad inglish.. Here... Traer traductor......you are welcome... Thank... But... Bad... Bad... Bad... Conextion... Sorry
reply
Look look teh snow boom bommm... Look the snoow... The structures... Look boom bommm arquitecture the shape... Boom bommm
Snow... Formation... Teori.. Electric charger... Like a clowd... Mmmm... Ahhhhhahhhh inmortal jailanden.... Electric robot... Migrate... To new economic... Need you nedd i need.... Death.... Thanks... But.... New.. Cloud.... Is electric... Charger like inmortal... Pease need your respuesta... Yo can use fedex... Mi house...your house.... Bad inglish.. Here... Traer traductor......you are welcome... Thank... But... Bad... Bad... Bad... Conextion... Sorry
reply
Seth
AFAIK, ufw allow 80 and 443 are only necessary if you are running a web server. The -default allow outgoing- will allow you to initiate connections on those ports to remote websites and receive their responses on the appropriate ports just fine. By including those allow rules, you're opening the ports for outsiders to _initiate_ incoming connections into your box on those ports. (Inconsequential if you don't have anything actually listening on them, but still important to understand.)
reply
AFAIK, ufw allow 80 and 443 are only necessary if you are running a web server. The -default allow outgoing- will allow you to initiate connections on those ports to remote websites and receive their responses on the appropriate ports just fine. By including those allow rules, you're opening the ports for outsiders to _initiate_ incoming connections into your box on those ports. (Inconsequential if you don't have anything actually listening on them, but still important to understand.)
reply
Nino
I find that the best way to avoid drovorub aside from making sure you have latest security updates and everything else is to act on internet like anybody else. Don't do anything that will make you stand out and you won't catch attention from bad guys since you won't be interesting to hackers and they won't attack your pc since you're basicaly nobody. Don't stand out on internet and you'll be safer than somebody who stands out for any reason.
reply
I find that the best way to avoid drovorub aside from making sure you have latest security updates and everything else is to act on internet like anybody else. Don't do anything that will make you stand out and you won't catch attention from bad guys since you won't be interesting to hackers and they won't attack your pc since you're basicaly nobody. Don't stand out on internet and you'll be safer than somebody who stands out for any reason.
reply
Dratchev241
well, YT decided to unsub me at some point so yeah... anyway another tip for SSH is changing the ssh port you use like instead of 22 use 9342, granted yes you have to change it on all of your stuff but how many ssh attackers are going to bother to go through every single port to see if ssh is on 5142 instead of 22. so I change ssh port, then deny 22, and ban all 22 requests and then limit the port I am actually using for ssh
reply
well, YT decided to unsub me at some point so yeah... anyway another tip for SSH is changing the ssh port you use like instead of 22 use 9342, granted yes you have to change it on all of your stuff but how many ssh attackers are going to bother to go through every single port to see if ssh is on 5142 instead of 22. so I change ssh port, then deny 22, and ban all 22 requests and then limit the port I am actually using for ssh
reply
Jose
chrootkit and rkhunter, debian, freebsd, Mac os big sur, beginner advanced C/C++, better openbsd, aix, debian hurd.
Make laboratory in free time with 26 computers.
Will write 13 Unix system V and BSD.
So talking you, I know.
Like learn general medecine.
Dragon 64k with Unix and spectrum 128k.
46/M/Barcelona.
reply
chrootkit and rkhunter, debian, freebsd, Mac os big sur, beginner advanced C/C++, better openbsd, aix, debian hurd.
Make laboratory in free time with 26 computers.
Will write 13 Unix system V and BSD.
So talking you, I know.
Like learn general medecine.
Dragon 64k with Unix and spectrum 128k.
46/M/Barcelona.
reply
Nikolai508
My digital ocean Ubuntu server has fail2ban installed. I get hundreds of login attempts every single day for years. Absolutely insane. They get the usernames wrong nevermind the password and I have it set to 5 attempts so they never get in, but boy are they trying.
reply
My digital ocean Ubuntu server has fail2ban installed. I get hundreds of login attempts every single day for years. Absolutely insane. They get the usernames wrong nevermind the password and I have it set to 5 attempts so they never get in, but boy are they trying.
reply
Mike
Hey Chris. I want to thank you for all your Linux videos and windows videos, especially Linux they've helped me out greatly!
I was wondering if you've ever used firejail? And regardless if you have or haven't, could you do a video on it?
reply
Hey Chris. I want to thank you for all your Linux videos and windows videos, especially Linux they've helped me out greatly!
I was wondering if you've ever used firejail? And regardless if you have or haven't, could you do a video on it?
reply
Add a review, comment
Other channel videos
