Being paranoid with infostealers

Privacy
1

Hi Everyone,

I was wondering if someone could advice me on this.

since learning the existence of info stealers, I really became paranoid with a potential info stealer on my Fedora linux, and although most stealers are in windows and I dont use windows I am still feel worried that I might have an infostealer on my laptop.

my question is, is there a way to know if a malicious program is running on the background and if there a way to save a history of the traffic from my computer to the outside word (so I can monitor the net activity)? some malwares are actually not visible when you check the running processes so i was wondering what is the best way to audit the security of my own device

I use the Gnome extension to check the traffic in & out, but it constantly shows bytes going in and out so I know this is not a good way to determine a suspicous activity (unless I see high traffic for no reason of course)

image
image524Ă—341 15.2 KB

many thanks guys

2

you could monitor your outgoing traffic on a router level for a prolonged timespan to check what is sent where and when

edit: + take @phnx advice into consideration as there likely has to be user interaction to get this kind of malware in the first place

1 Like
3

A tool like https://www.wireshark.org/ is good for this.

I do think you should assess whether you have any real reason to be worried about being infected by infostealer malware though. The odds are very low and even those infections that do occur are often from downloading blatantly sketchy files.

3 Likes
4

Hiding running processes would require a kernel extension, which most malware developer will not make (and which will require root access to install)

I haven’t personally seen Linux malware, but I would assume that it just uses an inconspicuous process name to blend in.

You can use the raboof/nethogs | github.com tool to check what processes are using the network.

But, if you’re not a targeted individual and haven’t installed out-of-repository (not dnf/flathub) stuff, you should be fine

3 Likes
5

General rule of thumb to avoid any type of infostealers: Don’t install random software applications and don’t give them permissions to your photos

4 Likes
6

Really you can’t reliably know, that’s why you want an operating system that has sandboxing and security features built in. Right now the most secure operating system you’re going to get is GrapheneOS but obviously it’s not quite a replacement for a desktop machine. The reality is you just really can’t know for sure, especially since malware likes to hide as system processes.

2 Likes
7

thank you all
Wireshark is on my learning list
I realy like the nethog app
I will just do my best to practice good opsec

Qubes Os is a good option, but sadly it doesnt work on my laptop

8

hi All,

just a small update

that is actually very good to know, thanks for the information

I installed pihole on my spare raspberry pi3a and it works great, this also shown me that there was no suspicious activity online at all.

I was annoyed to see that my ISP does not allow me to change the dns server at router level (time to change ISP I guess) but that will be for another topic :wink: