Malware Popup

Forums › Linux › Malware Popup

pctek

807 posts

Ultimate Geek
+1 received by user: 157
Inactive user

#230563 1-Mar-2018 18:35

Running Linux, and Firejail Firefox.
But this site (just one listing some books, not a retail site), suddenly threw up a new page, a malware, sign in type.

Oh er.....nothing much happened other than I had to KILL to get rid of the page.

But isn't Firejail meant to prevent that sort of thing?

michaelmurfy

meow
13579 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1966705 1-Mar-2018 18:45

Firejail is just Firefox inside a chroot jail. It doesn't prevent those dodgy "you have malware - phone this number" type pages with a Javascript loop which ends up chewing up all your resources and eventually crashing your browser. Just prevents Firefox itself from accessing your system drive.

It is quite common on Linux to sandbox apps this way - Ubuntu Snap does the same sort of thing (to a degree) where it restricts access to the system.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

kyhwana2

2572 posts

Uber Geek
+1 received by user: 233

#1966731 1-Mar-2018 18:50

Nope, it just prevents anything bad from "escaping" the jail.

You want something like ublock origin to block all the ads that most malvertising hitches a ride via..

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41027

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1966771 1-Mar-2018 20:17

kyhwana2: Nope, it just prevents anything bad from "escaping" the jail. You want something like ublock origin to block all the ads that most malvertising hitches a ride via..

Except that is not always ads that deliver malware. Sometimes it's a malicious page which try loading Flash, or on Internet Explorer an ObjectX. Or some javascript that injects something or simply the user has installed a browser add-on that modifies pages - not unheard of browser add-ons that started as useful tools and end up being sold by the developer and the next thing you know is all those millions of installations get an update with malware payload.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

pctek

807 posts

Ultimate Geek
+1 received by user: 157
Inactive user

#1966785 1-Mar-2018 21:25

I have adblock, same as ublock?

It is a php page...wordpress perhaps? Used to be common with php sites like that when I worked at Webdrive....

freitasm

BDFL - Memuneh
80646 posts

Uber Geek
+1 received by user: 41027

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1966786 1-Mar-2018 21:27

pctek:

I have adblock, same as ublock?

It is a php page...wordpress perhaps? Used to be common with php sites like that when I worked at Webdrive....

Case in point. If ads are already blocked then obviously there's another vector - and again blaming ads for everything is just wrong.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

kyhwana2

2572 posts

Uber Geek
+1 received by user: 233

#1966883 2-Mar-2018 09:08

freitasm:
pctek:

I have adblock, same as ublock?

It is a php page...wordpress perhaps? Used to be common with php sites like that when I worked at Webdrive....

Case in point. If ads are already blocked then obviously there's another vector - and again blaming ads for everything is just wrong.

This is true, in this case it's crappy web hosts either not patching their boxes or using bad credentials, then getting owned, or not cleaning up after their customers get owned. There are a few NZ web hosts that are guilty of this.

You'll also find a bunch of phishing sites hosted on the same compromised boxes.