Ask Ubuntu General Room

@KazWolfe: My I/O activity was going mad though every time I logged in and the process using it all up at nearly 100% wasn't one I recognized so I thought it best be safe than sorry. Also, a weird looking website popped up when I was just browsing the web normally and not going anywhere unusual so that was a little odd.

Nathan Osman

But it could be made to be one.

Zacharee1

it used to work

I swear

Kaz Wolfe

10:07 PM

wiki was never a magic tag.

Zacharee1

is this like the Berenstein/stain Bears thing?

I remember it as Stein

Kaz Wolfe

wiki is not a magic tag.

and what did rkhunter, say @ParanoidPanda?

And what was the process name/location?

user136984

@KazWolfe: Something was blocking it from finishing the scan.

Kaz Wolfe

that should be impossible.

also why did you not contact me to give me a sample of this malware?

you do know i collect these things, right?

user136984

That wasn't my number one priority then.

Kaz Wolfe

10:10 PM

well good job being the one person this year infected with what i can only assume was a targeted zero-day attack

user136984

With rootkits it's best to just get rid of them, the longer you wait with an investigation the longer you are exposed.

Kaz Wolfe

actually, i'm pretty confident now that it wasn't malware, but instead the Snooper's Charter compliance binary file.

Zacharee1

I am so confused

Kaz Wolfe

(it takes 30 seconds to zip a file and send it to me)

Zacharee1

I know [wiki:something] used to work!

Kaz Wolfe

10:11 PM

it never worked.

wiki was never, and still is not, a magic tag.

Zacharee1

then how do I know about it? o_O

Kaz Wolfe

iunno.

user136984

@KazWolfe: Well, maybe next time if I find the thing.

user136984

But why do you need me? I'm sure if you just search for plenty of dodgy things you will come across far more interesting stuff than you will find with me.

Kaz Wolfe

please do. i might even be able to tell you more about how it operates, if it is actual malware, and how to nuke it.

because there's no guarantee i'll find the same type of malware that you got.

some people collect stamps, I collect cyber-bioweapons.

Zacharee1

10:13 PM

Magic Malware Maker

now with BACON

Kaz Wolfe

and yes, i do have competent quarantine methods.

user136984

There was certainly some zero-day exploit involved because it escaped my QEMU VM and did some nasty things to apparmor.

Kaz Wolfe

kay, now i really really want to see what this was.

and why it was designed to be so targeted at a QEMU container with running apparmor.

user136984

Maybe they designed it to target many systems.

Kaz Wolfe

and burn a bunch of zerodays at once?

user136984

10:16 PM

I doubt that it was specific to those otherwise that would have just been some bad luck.

Kaz Wolfe

zerodays are really really valuable, you don't just burn them unless you have a really good payload or you have a lot of hope in your targets.

user136984

It's because Google thinks that I am a 35-year-old lesbian woman (I have tried correcting it but it always seems to set it back). So I got lots of weird adverts...

user136984

My touchpad also malfunctions and the disabling of the tap to click doesn't work in QEMU VMs for some reason... So yeah... That might have contributed to it.

Kaz Wolfe

yeah m8, your touchpad got 0dayed. time for a new computer.

user136984

I don't understand how searching for Ubuntu and programming related things as well as the occasional Panda made it think such strange things about me... But it does...

user136984

10:21 PM

@KazWolfe: Do you think that it is possible someone else who actually is a 35-year-old lesbian woman is using my Google cookie ID or something? Because seriously, it keeps setting it back and I get the mightiest of weird adverts you could imagine. Some of which contain malicious JS, in fact, most of them do.

Kaz Wolfe

anything's possible.

i'm pretty sure they'd have to be pretty lucky to guess your cookie

unless they're spying on you or your computer.

user136984

These sorts of strange happenings seem to follow me around. But it's thought this for the last 5 years about my account...

Kaz Wolfe

i think you're just too paranoid.

just turn on DNT, reset your add cookie, etc, etc, etc.

i mean, from what i hear regarding your situation, you're being intentionally and directly targeted.

- Alteration of ad previews to be malicious
- Drive-By ad malware for your browser
- Dropping a qEMU 0day for whatever reason
- and so on.

user136984

Well, that is possible, there is someone whom I am on not very good terms with who knows someone who I have suspected of using zero-days before to target me. At least Skype was talking to their server in strange ways an awful lot for no apparent legitimate reason.

Kaz Wolfe

don't take this the wrong way, but i don't think you're worth dropping zerodays on.

I mean, you don't have any sort of secret government intel

I don't think you have any high-profile business trade secrets

Like I said, zerodays are extremely valuable. you don't just go around freely wasting them on people.

if that's the case, either someone really really hates you, or you do have a bunch of very interesting secrets on your hard drive.

user136984

10:32 PM

I don't, but there is a mad man out there who hates me and last I heard he wants to be a hacker. He has also broken the Computer Misuse Act many many times... Though never been caught as far as I am aware. And knows people who are quite expert in the area.

user136984

@KazWolfe This guy would if he could. He's mad and obsessed.

user136984

I just hope this is an unfortunate coincidence though. But I will keep an eye out for anything else strange, and I'll let you know if I have any samples.

Kaz Wolfe

just saying: zerodium.com/program.html

VM escapes can be up to $50k

and with something like qemu

Ask Ubuntu Meta

0

Q: Privilege viewer?

Is there a a way to easily see what permissions you have, like you can see how much/many rep and badges you have? If I need to improve this or otherwise, please leave a comment and tell me how to improve it instead of just downvoting

user136984

It is possible I would be able to reproduce the issue, possible, I don't know for certain. But is there like a way of doing this securely without infecting my host system? Also, if the host is infected with a possible rootkit, that makes detection a lot harder.

Kaz Wolfe

10:38 PM

not really sure i understand what you're asking...

Thomas Ward

@ParanoidPanda Separate system that you can pull the cord from and the hard drive

and then take the drive out to a gun range for target practice when you're done.

Kaz Wolfe

@ThomasWard Privileges are available on the Badges page btw.

Top-right corner navbox

Thomas Ward

@KazWolfe that's... still in the help center :/

throws sticks at @KazWolfe

Kaz Wolfe

@ThomasWard yeah, but it is available from the badges page.

user136984

@KazWolfe: If we are talking about something which could be a rootkit as well then if I reproduce the issue in my QEMU VM and the rootkit gets into the host, it may make it harder for me to determine how it did it and what it is currently doing because of the very nature of rootkits. So I would have to find a completely sandboxes environment.

Kaz Wolfe

10:40 PM

@ThomasWard /me gets the stick and brings it back

Thomas Ward

@KazWolfe and how are you going to pick up a five-hundred pound rod of parsteel?

Kaz Wolfe

@ThomasWard you said sticks.

not a five-hundred pound rod of parsteel

Thomas Ward

parsteel

Kaz Wolfe

so i picked up the stick.

Thomas Ward

:P

@KazWolfe I never indicated size, composition, or weight of the stick

Kaz Wolfe

10:41 PM

and brought it back.

therefore, i got to.

Thomas Ward

so therefore a rod of metal could be considered a stick in the right minds :)

Kaz Wolfe

so, would you throw the light 100% wood stick again?

Thomas Ward

it's only 45% wood. 45% wood, 55% recycled paper.

throws the sorta-wood stick that weighs thirty grams

user136984

@ThomasWard But how would I analyse the system without connecting to it in some way if I want to determine how the rootkit operates?

Kaz Wolfe

gets the stick and brings it back, again

Thomas Ward

10:44 PM

@ParanoidPanda You asked how to make it completely sandboxed. The answer is only a system that isn't inside of the host OS.

Nathan Osman

Yay for sticks.

Thomas Ward

I didn't indicate whether you could solve it or not

Nathan Osman

I've got my SE chat Go package receiving events now.

Thomas Ward

@NathanOsman @NathanOsman at least it isn't an 40-foot-long rod of tungsten carbide hurtling towards the earth at extreme velocities

Nathan Osman

^--- that's a good thing

Kaz Wolfe

10:45 PM

what is with @ThomasWard and rods of steel from space? What's wrong with regular old fun wooden sticks?

Thomas Ward

@KazWolfe I've been playing too much Call of Duty: Ghosts recently.

Kaz Wolfe

@ThomasWard go play with more tame city wolves.

Nathan Osman

And I've been playing too much Portal.

Everytime we walk through the hospital, I see air ducts and abandoned corridors.

And everytime I see an oval mirror, I want to jump into it.

Thomas Ward

@NathanOsman Portal, or Portal 2?

'cause I recently redownloaded Portal 2

Nathan Osman

I just played both.

Seth

10:48 PM

@NathanOsman Have you started dreaming about it though? Or hit the point where you can't sleep because your brain is analyzing positions and moves? That's when I know I need to stop.

Nathan Osman

There was one night last week where I stayed up until 2am trying to finish the game.

Does that count?

Kaz Wolfe

@NathanOsman Now you get to play Portal Stories: Mel.

Nathan Osman

I've heard of that one.

Kaz Wolfe

@Seth so what i'm doing with No Man's Sky? And what I did with Skyrim?

Nathan Osman

Does it go into the story more or is it totally separate?

Kaz Wolfe

10:49 PM

both.

definitely much more challenging.

Nathan Osman

Ah.

Seth

@KazWolfe plz, don't post images. Use the xkcd link. it'll onebox and be better.

2078: He announces that he's finally making the jump from screen+irssi to tmux+weechat.

Kaz Wolfe

@Seth i'm lazy and keep forgetting that.

does this mean i get kickbanned?

:(

Nathan Osman

YES.

Kaz Wolfe

awwwwww fine.

i probably deserve it

edwinksl

10:51 PM

AU slack please

Seth

well, I hadn't seen that one yet. and it's awesome. So I'll be lenient :P

edwinksl

need party parrots

Kaz Wolfe

this time can I do it?

Because I know what the hell i'm doing with this "moderation" thing?

edwinksl

slack moderation is pretty straightforward

Byte Commander

@Seth Happened to me with WoT recently. ~~Luckily~~ ~~Unfortunately~~ ~~Luckily~~ ~~Unfortunately~~ the holidays are over now...

Kaz Wolfe

10:52 PM

@Zacharee1 will still screw it up

edwinksl

is true

Kaz Wolfe

somehow

Seth

@KazWolfe hahahaha. this. so much this.

I least my classes are hard this quarter. Last quarter was sooo boring.

Now I've got group presentations every week. Oh and the professor likes to get the VP or dean to sit in on those >_<

edwinksl

what college is this

Seth

if I told you I'd have to permaban you.

user136984

10:54 PM

Goodnight! :)

slack is set up.

:(

askubuntu.slack.com

@Seth what are you studying?

Seth

@ByteCommander IT systems.

Kaz Wolfe

10:55 PM

Discord me your e-mails and I will invite.

Nathan Osman

Did anyone just get an event notification?

Seth

The point of getting the VP/dean to sit in is that it's supposed to be a real world scenario where you have to present to non technical people.

@NathanOsman nope. but if you join a room with events you get their notifications for a few days. Just DON'T GO BACK. I've made that mistake before.

Nathan Osman

Ah.

Okay.

So I didn't disturb anyone with my testing then.

Whew.

Byte Commander

@Seth I'm studying Applied IT.

In Maths, we're currently calculating RSA encryption

Manually.

Seth

also, @ParanoidPanda, ProtonMail now supports using PGP keys directly and two factor authentication.

@ByteCommander Ah. Mine's very similar. All applied.

I'm not much of a theoretical person.

Byte Commander

11:01 PM

Me neither. But it's still an excrementload of boring complex stuff one will never ever need again.

Seth

@ByteCommander RSA? We use RSA every day!

Byte Commander

But you're not encrypting numbers using RSA on paper! You have libraries for that!

And that was already one of the most interesting things we do.

Kaz Wolfe

paper rsa. nothx.

Seth

Ah. I missed the manually message. Wow. I can understand doing it with a calculator, but anything below that is just torture.

Nathan Osman

@GeorgetheDev testing, testing, 1, 2, 3...

George the Dev

11:05 PM

@NathanOsman you said "@GeorgetheDev testing, testing, 1, 2, 3..."

Nathan Osman

:)

We are up and running! github.com/nathan-osman/go-sechat

edwinksl

moar bots?

Nathan Osman

Not necessarily although that would be cool.

This could also be used to develop a chat app.

Kaz Wolfe

cc @edwinksl

Nathan Osman

Lol.

edwinksl

11:19 PM

looks like yahoo has a new name

rip yahoo

@KazWolfe is there a :dreidelparrot:

Kaz Wolfe

yes

Nathan Osman

@edwinksl Where are you seeing this?

edwinksl

@NathanOsman venturebeat.com/2017/01/09/…

Nathan Osman

Yuck.

What an ugly name

edwinksl

yeah

Kaz Wolfe

11:25 PM

there. all the parrots are on the slack.

Byte Commander

All the parrots and two lonesome wolves.

Nothing else.

Huh? What happened to the Discord server?

edwinksl

nuked

Byte Commander

Did you take it down or kick me?

Aww.

Why though?

Zacharee1

so Kaz will stop incessantly insulting me about it

Kaz Wolfe

(~~maybe~~ ~~probably~~ is) my fault.

Byte Commander

11:33 PM

I liked it.

Kaz Wolfe

huh. ~~test~~

welp, i'm stupid.

Byte Commander

Throws stick with thorns at @KazWolfe

Zacharee1

@ByteCommander I can't stand it anymore

Kaz Wolfe

ow.

Byte Commander

Tbh, Slack is laggy, resource-hungry, complicazed, ugly and especially lonely.

searches reset button

Would have been nice to at least be asked or notified first...

IanC

11:37 PM

gud evening!

Kaz Wolfe

o/ @IanC

Zacharee1

@ByteCommander if you want, you can make another, but I'm not managing it

Byte Commander

Well, why not.

Kaz Wolfe

well, good. glad i wasted my time on this slack.

Byte Commander

Would have been easier to migrate all the people if the old one was still up though.

Congrats.

Nobody joined except me, and I only did because I seemingly forgot how awful I found Slack when I last used it a year ago...

Kaz Wolfe

11:39 PM

and nuked

Zacharee1

so sorry my feelings inconvenienced you @ByteCommander

Byte Commander

You should get thicker skin when on the interwebs.

Kaz Wolfe

this is why i just don't have feelings. makes things so much less painful.

Byte Commander

sudo apt purge feelings

Kaz Wolfe

basically --^

Zacharee1

11:40 PM

@ByteCommander if it's just some random person, who cares, but I'm in contact with Kaz every day

IanC

@KazWolfe \o

Kaz Wolfe

and you should know i've always been a cynical ass who likes insulting literally everything around him, mostly cuz he can.

Byte Commander

beat him with a rainbow trout then.

Kaz Wolfe

mmm. trout.

Zacharee1

@KazWolfe but you don't persist on the same thing over and over and over and over and over

Kaz Wolfe

11:42 PM

actually i do.

Ronnie Marlow

I got a question, that is an important one.

Kaz Wolfe

@RonnieMarlow regarding?

Zacharee1

@KazWolfe then why is that the first time I've ever seen it?

IanC

not even a comment or an upvote on my StackOverflow question so far :/

Kaz Wolfe

because you're usually not online at 10 pm my time?

IanC

11:43 PM

looks like the Nagle's algorithm question story once again :o

Zacharee1

@KazWolfe sorry my timezone is three hours ahead

so how should I know you persistently insult everything if I'm never there?

for days on end?

weeks in this case

you just kept bringing it up

wouldn't stop

Kaz Wolfe

(nobody really asked me to, iirc)

Zacharee1

that is the worst excuse ever

Ronnie Marlow

I am in a pickle, I want my home directory encrypted and have it's own partation. But I have found a problem with this approach, I can't change the background to my own photo choice with ubuntu tweak. It won't accept the photo change, refused to do it.

Kaz Wolfe

@IanC i see two upvotes.

you came to the right person for terrible excuses, then.

Ronnie Marlow

11:45 PM

during the login process

IanC

@KazWolfe it's a miracle! :D

Zacharee1

@RonnieMarlow probably best to ask on Main

Ronnie Marlow

I know but I feel like I want the input from here. Since it more direct approach.

more communication

Kaz Wolfe

either way, back to coffee and fixing code written by idiot developers that have long since been fired for incompetence.

Ronnie Marlow

What is the purpose of an encrypted home directory? I know it's super secure but what about no encrypted home directory :)

Since the home directory and / directory are together.

not seperated file system.

Kaz Wolfe

11:51 PM

9

Q: Can an anti-virus protect me from KillDisk, malware for Linux?

A relative of mine has recently sent me an email. He recently came across this alarming head-line from anti-virus vendor ESET: KillDisk now targeting Linux: Demands $250K ransom, but can’t decrypt The email goes on to describe a piece of software that encrypts the contents of the disk and deman...

security malware antivirus

mods or whoever wants free flags...

Thomas Ward

hail Darkness

the Darkness this evening is cold but good

Kaz Wolfe

askubuntu.com/questions/870012/… too broad, potential offtopic

Byte Commander

@ThomasWard Can we synonymize speech-recognition and voice-recognition?

Thomas Ward

@ByteCommander Propose it on meta...

Byte Commander

oh, the laziness...

:P

Thomas Ward

11:58 PM

... or it won't happen.

Byte Commander

Maybe tomorrow

procrastination successful

Kaz Wolfe

or in two weeks

Nathan Osman

10

Q: Can I clean my Macbook Pro keyboard with vodka?

I don't have any cleaning product right now at home, and the only alcohol I have is vodka. Can it be used to clean my keyboard and trackpad, or will it damage my laptop? (I think that alcohol is often used to clean computers, but I'm not sure that it's the same kind of alcohol)

cleaning

Interesting title...

Transcript for