Topic: Call for help to the forum's security experts (Read 381 times)

I never hear that distro, but it would be great if it works on your laptop.


I never use Solus or it's package manager (eopkg), but i definitely never experience problem with different package manager. While it's bad experience for you, take note Solus is rolling release distro, so i wouldn't expect stability from it.


It's not 90s or early 2000, most distro these days should able to work flawlessly or with little problem these days.

Well, it didn't, and neither did Mageia.
I'm off to MX Linux now...


But my point is I used crunchbang! for years, it was a rolling release, and it was a rock. 
I don't know. I couldn't find much information on MX Linux (other than it comes with Fluxbox, which is almost as good as Openbox), so I don't know whether it's a rolling release or not. But to be honest, I was more than a bit upset yesterday afternoon, so I may take another look now...


My point exactly. It's like people defend their right not to learn from their mistakes.
I mean, Linux was the big promise when LT developed the kernel, yet it's been DECADES and it's still nothing compared to Windows. Now, anybody that has used any Linux distro for 5 minutes understands it's far superior to Windows, not to mention it's free, yet people keep coming up with distros that are buggy, difficult to set up, unstable, high maintenance, you name it. Don't they understand that system doesn't work?


That would be my guess as well, but then I switch the hard drive to another one with F30, and everything works flawlessly.
I don't. I've been stuck with F30 for over a year now, because I'm unable to find a working replacement, and it's getting tremendously annoying. My laptop is from 2016, so it's not new, but it's not a dinosaur either, and so far it's been working great. It's a cheap Chinese generic one with a 1.5 GHz Celeron I bought to have a lighter (and cheaper) one to get to work, as I had a 17" HP that weighed a ton. But the HP died on me, and this one keeps on going.
I didn't think about monitoring network traffic. I can see that on Conky at all times, and it is a bit high, but nothing to write home about (under 6k download, and under 1K upload, that having 4 open tabs on Binance, which keep updating all the time).
The more I think about it, the more I believe it's just because I have a bunch of open tabs on Firefox, nothing to do with mining or the like.
We'll see... MX Linux is Debian based, so it should (hopefully) work. But, to be honest, it's a good thing I'm broke, cause I'm getting ready to light the computer on fire. 


Oh, I never touch my repo list. The weird part is all those were fresh installs, and they failed right from the beginning.



Right now I'm at a loss. I have a Linux course I expect to follow in the near future (if I can ever get VLC to work), but right now I just want a working distro, nothing fancy. Maybe in a couple of years I can start tinkering with LFS, and get a distro to my liking...

Something sounds broken in your configuration if updates are failing to install. I'm not sure if I would point that to being compromised in some way or if it's just a configuration error. Especially, since you said other distro's haven't worked in the past. It might be just because it seems you like to use older distributions which are no longer supported. I think before going through the following, it might be worth considering updating to a clean install of a newer Linux which has long term support, and go through that to see if the same inconsistencies pop up. Ubuntu or Debian are the best for this I'd like to think, they're generally the most used, and most supported. I know you've previously suggested you don't like Ubuntu, but if we can get a minimally working system, then we can potentially rule out driver issues or we could actually pinpoint the difference between your normal operating systems, and more modern up to date ones.

Otherwise, what I would do is monitor your system monitor, and also look at your incoming, and outgoing network connections for a long period of time. See if there's anything suspicious, and if there's we can work from there. Otherwise, I actually think this might be pointing to a problem at the operating system level.  The configuration errors might not be down to user error, but in compatible drivers/hardware, which is rare I'll be honest especially if your on a modern machine. I use fairly older laptops to do work, so I've come across my fair share of nuisances when it comes to bugs with Linux, so I know how frustrating they can be at times.

If your updates aren't working or they're failing weirdly, I would check your sources.list, and see if there's any weird repo or if there's just a repo that's incompatible with your software/hardware which could be causing the problem. I've seen people add repo's for the wrong architecture from time to time which can cause issues when updating, but then Linux usually warns you something is adrift in your sources.list.

I guess the question is; is your cpu consumption, and disk consumption only high when your connected to the internet? This doesn't prove anything either way, but if the resources are still being used without being connected to the internet, it might point to it not being a miner. Monitoring the network connections through the terminal should point out any miner, since I'd assume they'd need to make connections from outside of your machine.


Old distro reminds me of my days dabbling in Slackware.

Shouldn't be luck, unless your using a older computer then pretty much all newer hardware works flawlessly out of the box. The only time you start running into issues is when there's older hardware, although usually this doesn't cause problems with updating, unless there's some kind of corruption or incompatibility in your sources.list.

ETFBitcoin: Crunchbang! was a rolling release, so versions were far between. If I remember correctly (I'm really bad with dates), Corenominal abandoned crunchbang! development in 2015 or so. Either way, yeah, it's been a long time. It's sorely missed. In fact, at least as far as I'm concerned, the fact it's been talked about after all these years is a clear testament to its quality.

I will try Open Mandriva now, see if it works. If  it doesn't, I guess I'm gonna have to take a look at that unofficial version...

Your guess is as good as mine...
I ran the update. It had to download 368 files (which is a lot, but not unheard of in a fresh install), and it started stalling and eventually stopping after downloading a few files. Then all of a sudden, when I was at about file 160, it went back to 0. 
That's when I quit, rebooted and it never started again.

Lovesmayfamilis: Oh, trust me, I'm not a power user, not by a long shot. I'm a rookie when it comes to Linux. I just happen to love it.
I don't know. I've been using VLC probably since 2010 or so, and I never had to install anything on it. That's the one thing I loved: it just worked.
In any case, I'm not a fan of experimenting at all. I loved crunchbang! because I installed it once and forgot about it. Then, I loved Fedora (with the caveat that I had to reinstall it every couple of years or so) for the same reason: I installed it, installed the apps I used, and copied my home directory in full to the new version, and voilá!, no fuss. That changed with F34.

I don't know, maybe I'm spoiled. Maybe I was lucky that all my distros worked flawlessly out of the box before, and now I'm just finding a facet of Linux I didn't know about. But reality is I've been at it for over a year, and my hardware is starting to feel it, and so is my patience. We'll see how it goes with Open Mandriva, but this is getting on my very last nerve.

You look like a power user on Linux systems, but reading your adventures with systems, I'm beginning to have my doubts.
At the moment, I'm working on Fedora 35. And I showed my browser example from it.  Firefox Version 97.0. To view the video, You probably needed to install additional codecs. And also check to set the time to turn off the screen during idle time.
The same as you, I am also a fan of experimenting, that is, trying out different Linux distributions. But the latter suits me at the moment, after Debian, Mint, Ubuntu, Manjaro, deepin, and others.
For a long time, I have used a completely simple system that is flexible for all the whims of the user, this is MX Linux.


Yesterday I read that your choice fell on this system, but again, the software will always be new, but there is no guarantee that it will always be able to work perfectly. That's why its second version is considered the most stable, isn't it?

The beauty of Linux systems is that each user can eventually find and customize the system to their liking.
https://www.linuxcapable.com/how-to-install-nvidia-495-xx-beta-drivers-on-fedora-35/

I did. 
Crunchbang! was Debian based. I went to Fedora because of Debian's stupid hypocritical policy of not accepting proprietary drivers yet not providing alternatives to them.  Fedora is the only distro (as far as I know) that accepts both free and non-free stuff.

In the meantime, I'm back to F30. Yay!
I installed Solus yesterday. Had to run an update over 50 times, and was finally unable to do  it, and when I tried to boot it again, it wouldn't even start.
My advice to Solus developers (if there's one on this forum): if you're concerned about user experience, a good starting point would be to make a distro that actually works...   

Yeah, they should, but they don't.
I admit I tried Ubuntu and Linux Mint but I didn't like them. Either those things have become really bad through the years, or I've changed a lot (probably the latter. Openbox really messes your head up),  Fedora I've been using (and loving) since the end of CrunchBang!. It used to work out of the box.

The 2 problems that pissed me off the most (and ultimately led me to abandon F34 and F35) were the screen blanking up (and locking up) every 10 minutes, regardless of what you did to it (I changed the power settings on the xfce-settings-manager (which used to do the trick in earlier versions), plus I followed several suggestions from the Fedora Forum, and many others from searches. Nothing worked), and VLC (and other video players) sound continuously breaking up while I was using it (again, I tried a gazillion ways to fix it. Nothing ever came close to make a difference).

Then I moved to Mabox and Manjaro, and both distros ended up getting their repo lists corrupted, making updating impossible. Now, I know Arch fans may see that as "fun", but I don't. I install an operating system to be able to work with the computer, not to have to work endlessly on it.

Now I installed Open Suse. We're progressing: before, VLC audio broke up, now it doesn't work at all. I'll try fixing it over the weekend, but it looks like I'm gonna have to keep on looking...

Just finished reading it. Damn, that's difficult! Gonna have to read it again.

I think a big part of the problem may have been I was using an older version of Firefox, and a version of Fedora that had reached its end-of-life a while ago. I just installed Open Suse Tumbleweed (hope it works), and, so far, everything's going smoothly.
Yeah, the reason I discovered (or started suspecting) I was being attacked is because my computer started running slow, which prompted me to check Conky (you can see it in the screenshot above, in the top-left of the screen), and CPU usage was through the roof. Right now I still don't have conky installed (I have to configure it), but I will soon enough. I just can't live without it.

There could be possible explanation of cryptojacking which is most common type of hack under which hackers use your system power to mine some cryptocurrency without you knowing about it as the malicious code is injected to your device which runs in the background without you knowing about it.The only way is to check the CPU and GPU power consumption as you have already done it so it could be the same case.

This could happen during when you popped up some fake website containing that malicious link and upon clicking on it the malware runs a algorithm in the system and code to run for mining process is deployed in your system.The hackers use this and can use your system to mine crypto for them making your system slow which is why it's suggested not to click on those links.

As you are roaming around some faucets still it might be possible from that way it has started now due to some reasons or you became aware about CPU consumption lately?

Check this article i found on Google for your help : Mining scams

That's absolutely true from the draft you've shown over there, it really high ... normally, most apps are programmed to operate on thier own and even when you're busy lunching your desired window,it keeps relunching other apps that can possibly run on thier own,(for this reason, the battery cell runs low easily and it makes the thermal regulation abnormal) it does alot of other wrong things most especially if the system isnt upgraded...I don't guarantee fedora 30 not to mishave under Linux as an OS, it does atimes

Thank you all.

Lovesmayfamilis I don't have that in my settings. It may be part of the newer versions of Firefox...  
I did try Fedora 34 and 35, and Ubuntu, Linux Mint, Mabox, Manjaro, and a few others. There are several things that just don't work (like the screen blanking out every few minutes regardless of your settings, VLC losing audio (yeah, I did try several other video players), or the repo list just getting corrupted, making it impossible to update), and nobody in their respective forums seems to have a clue. That's why I came back to F30, it just works. The downside is I have no security patches.  

O_e_l_e_o: right now it seems to be behaving, but I'll try that if it goes haywire again. Either way, I'm planning to install Open Suse Tumbleweed on another drive later today (let's hope it works), so I should be able to get a newer version of firefox (and all security updates! ), so maybe I can fix the whole problem right away...

NeuroticFish: I haven't tried Opera. I might.
I will be trying Open Suse today on another hard drive, and if it works I will have this hdd available to try other stuff. I'm not using it as a cold wallet because it's getting a bit old, and I'm a bit afraid it might quit on me, but a second "spare" OS could be a good idea...

To make things worse, Virtualbox is not working properly (probably because I haven't been able to update it in months), so I can't test different distros on it. Oh, well...
The thing is I have been using Firefox (with this same exact settings), for years, even on this same computer (yeah, it's an oldie), and never had an issue.

ETFBitcoin: right now I'm not using either. In any case, when I was using them, they did work together without issue. In a future install I think I'll go with Ublock though, as it seems to be a lot more aggressive than Adblock plus.

I am trying to get a new distro, but most seem to be having issues I can't fix, and not having internet access at home makes everything a bit more complicated...

Lucius: I've been (not really "playing") with faucets for over a month, and this issue just showed up in the last week or so. I'm still using Cointiply today, and I'm under 9% CPU usage (not the best, but I'll take it).

Stompix: at the time I posted that, either browser was doing it. Today, Firefox seems to be doing ok.
I am using whatsapp, and have been using it for a couple of years now, as it pays the bills. Hopefully I will stop using it altogether soon enough, but we'll see...
In any case, I didn't have any issues with it before, and I'm not having any issues today.

I'm starting to think it may be because I had a lot of tabs open on firefox, showing prices on binance pairs. Those tabs keep running in the background even when you're not looking at them (which may be the reason why I'm seeing ~10% usage now, instead of the usual <5%, as I still have 4 pairs running).
 

D'oh! Close one of them and you're going to see who is the culprit, but most likely is firefox.
I used to have Fedora for like 6 years on my laptop, changed it a while ago since I constantly run into memory management problems with every single browser with addons, it was just a pain in the ass, normally you would install Linux on older machines so you could still use them but it as worse than windows, unless you browse a simple page forum every add-on would just increase memory usage.


Looking at what Lucius mentioned, with Noscript probably OP will have nothing to use his browser for
Checking his older posts, he uses in one of the tabs Whatsapp directly from the browser, depending on the conversations you have that thing alone can grind to a halt even an average modern laptop.

No one remembered that OP plays with faucets full of all sorts of garbage, and at least 1/3 of them run crypto mining the moment you load them - of course, if you don't have proactive protection that blocks it. It is also possible that some crypto-malware has been downloaded, disguised, and running in the background, and the possibility of using a public wireless network should not be ruled out - malicious attacks that are carried out in this way are very widespread and popular among hackers.

I've read that it can be simply a Firefox problem: bad handling on GPU hardware and disabling hardware acceleration may be just the easy fix.
Also I've read that Opera may be a good replacement, or an option to check whether you have the same issues at browsing, without opening Firefox.

Ok. A couple of things I would do next. First would be to type about:performance in to a new tab in Firefox and see what the exact culprit is. If nothing is showing up out of the ordinary there, then try about:processes.

I also found this answer on stackexchange: https://unix.stackexchange.com/questions/321997/debugging-high-near-total-cpu-memory-usage-of-web-content-application-on-lin
Maybe try uninstalling your two disabled ad-blockers, and installing NoScript. Restart and see if that makes a difference. Don't open anything else except Firefox while you are doing this to exclude anything else being the culprit.

The browser itself has already implemented protection against hidden mining. You can also check your privacy settings and enable protection if it is disabled for some reason.



And why don't you update your system to the latest version? Is Fedora 35 inferior to version 30?

Thank you all.
I have closed most of the tabs on Firefox, and it seems to have helped a bit. CPU usage is still too high, but it went down a bit. 


Here's top:



It shows "web content" for the highest CPU loads. Right now I have Firefox and Chrome open, So I don't even know which one is hogging so much CPU. Right now I have no working extensions on FF. I have installed Adblock Plus and Ublock, but had to disable them a while ago.
My biggest problem is Fedora stopped providing support for F30, so I have had no updates for a while, and finding a replacement has proved difficult.

Incidentally, I looked at about:config. Both strings are set to true.

What are your laptop's current specs?

I do not have so much experience with Fedora OS but I think you can solve this issue by uninstalling the firefox browser if you feel that someone on Starbuck installed something in your browser.

Just reinstall it after and then go to settings and disable the hardware acceleration.

Have you tried using System Monitor or the top command in Terminal to see if there is anything else that is using so much CPU power?

In terms of Firefox, then let's start with the simple things. Open Firefox, type about:config in the URL bar, accept any warning which comes up, search for the following two strings and make sure both are set to "true":
browser.contentblocking.cryptomining.preferences.ui.enabled
privacy.trackingprotection.cryptomining.enabled

Which extensions do you have installed?

Have you got any plugins in Firefox that might use a lot of data? Did anyone tell you how to get rid of the miner that was injected into your machine (is there a chance it's still there).

Normally if you have a lot of tabs open in browsers, it only loads the active ones or an active few, have you checked that's all it does when you load it up (eg there's no loading dots or icons in the title bar on tabs).

Can you see the specific resource usage for fedora programs too because you could start there (I know Windows obviously has it but Ubuntu and Debian make that thing a bit less explicit).

...After you closed Firefox it may hang (with no UI) while some part of it is working... At least on Windows this is not uncommon.

Since I have no idea what can it be, I would start with doing changes that can help me find the culprit.
What if you use another browser for a while? It could be a test to show whether the problem is with your Firefox, some website or something else.
Also you can take a look what extensions you have installed, maybe you see anything suspicious.

These are 2 ideas/directions you can try.
And/or you can wait for answers from people more into Linux...

Thank you both. 

BlackHatCoiner (or anybody else): ask away. I'm ready. 

I haven't installed any program (other than electrum) for months. The computer is strictly mine, I have a 30 character password made of letters, numbers and signs. Literally speaking, this laptop has never been touched by anybody else but me, not even to wipe it off. I'm running Fedora 30 with Openbox and Tint2.
Right now, for example, after rebooting the computer, I'm typing this reply and seeing CPU usages of up to 50%, which is way too high for only using Firefox, especially on a forum.
I do have a lot of tabs open (mostly Binance, I'm checking prices), but haven't touched them since I restarted the machine.

NeuroticFish : well, I answered that question above...
A few months ago, there was a bit of a scandal because a customer found the ISP (Fibertel) was injecting malware in people's computers to mine crypto without consent (or knowledge). The company issued an apology, Starbucks issued another one, and they changed the ISP. But now (as in the last week or so, I've been coming to this store literally for months) I'm finding this problem.

I opened Firefox's task manager, but it's not showing anything out of the ordinary. Incidentally, what makes me even more suspicious is that I close Firefox and wait, and CPU usage stays near 100%. 

Fedora 30. Linux.


Does it happen always or it's related to visiting certain website? I'm asking because it was not uncommon, especially a couple of years ago, for websites to have crypto miners hidden in their pages.
You may want to take a look what does Firefox' task manager tell. Maybe it gives you a clue who's the culprit: https://support.mozilla.org/en-US/kb/task-manager-tabs-or-extensions-are-slowing-firefox

We can't know for sure if your laptop is affected with something malicious, but only make you questions to form a picture of your machine's status. Have you installed lots of programs whose reputation deflects their legitimacy? Is it yours, personal? Do you ever get to share it others? What's your OS?

I'm, as of now, using the wifi connection in a Starbucks store near my place. At least for now, that's the only option I have.
I'm running Fedora 30 (hope to upgrade soon), and using Conky as a system monitor. For the last few days I've been seeing my CPU usage go through the roof for no reason, so I'm suspecting my laptop is being used to mine crypto while I'm working (there was a reported incident not long ago for the same company).
Normally, my CPU usage hovers around 5%. The absolutely HIGHEST I've seen it go was about 30-35% when I was running Freecad and VLC at the same time. Right now, I'm seeing CPU usage in the upper 90% only on Firefox, which makes no sense.
Memory usage seems to be ok though, at around 15%.
I ran ClamAV, and, unsurprisingly, didn't find anything.
Should I be worried?
What can I do about it?

Thank you  all in advance.