A software developer and Linux nerd, living in Germany. I’m usually a chill dude but my online persona doesn’t always reflect my true personality. Take what I say with a grain of salt, I usually try to be nice and give good advice, though.
I’m into Free Software, selfhosting, microcontrollers and electronics, freedom, privacy and the usual stuff. And a few select other random things as well.
I don’t think OP’s dad will host a misconfigured cloud service on their computer or set an insecure password, enable ssh and then also open a port in the router. Most attacks on that list are specific to how internet servers are set up. And well, insecure old embedded devices. And we in fact have those systems targeted regularly. My servers gets bombarded with malicious traffic trying to get in.
Did you read the article? This Ringreaper thing is a method to hide something. It doesn’t have any means to infect a system. And it doesn’t really do anything except hide itself. It doesn’t delete your files, it doesn’t steal your passwords… It doesn’t spread… It’s not really what you think it is.
Edit: And congratulations for going back and appending your first comment with the wild claim you own the truth. I’m pretty sure people here downvote you because there’s almost no truth in what you spread here. I’d be willing to listen, but you don’t have any example to back it up. Instead you ramble on how servers are supposed to be desktop computers and attacks target the kernel instead of userspace applications… None of that is true. Sorry I’m not deliberately trying to be mean or hostile. But that’s how it is.
I’m sorry. Most I can find about “RingReaper” is that single blog post or people who rephrased it into their own articles. There seems to be zero information on how it spreads through the internet? And if anyone contracted RingReaper. And I can’t even discern how that’d get on someone’s computer unless they install it themselves (which is a form of malware, though not very pronounced on linux due to the distributions and central package repositories). There are no other methods highlighted in the post. And it can’t do privilege escalation either, just scan for other vulnerabilities. So is this a thing in reality and how can I find out? It seems like valid research to me, but I can’t see how it’s more than that… What I mean is, I can see how someone put the word “malware” in the title. But that in itself doesn’t really threaten my (or OP’s dad’s) computer.
Thanks for the link. But that’s not a vulnerability or malware. It’s academic research how to hide malicious syscalls. But it can’t infect anyone’s computer. And there isn’t any vulnerability to let it in.
You’re wrong. How would an Apache exploit “hack” your Steam or online banking app? That’s just not possible.
How would something that exploits the default password on a router infect my machine with a different password?
Malware uses specific attack vectors and specific vulnerabilities.
For example it’s something that has an Apache webserver installed and that Apache is accessible from outside… So the Apache exploit can do something. Do you have both conditions met on your laptop/desktop computer? I’m pretty sure that won’t be the case, and that’s the difference here. And yes, that’s specific.
Can I get some list or a reference to educate myself? As far as I know it still holds true. There’s rootkits, a lot of old stuff and exploits of webservers or embedded devices, supply chain attacks towards developers and the one day the Mint ISO file got compromised. But I’m completely unaware of desktop computer malware with high risk or actually spreading?! And the list on Wikipedia seems to confirm what i said…
I think most Linux distros will be fine. As of today desktop marketshare is still small, the governments mostly work within custom business applications. And to this date Linux malware and viruses for the desktop are practically unheard of. The common attacks are against the browsers, not the underlying operating system (so do timely updates and install an adblocker) or we’d expect phishing or phone scams and that’s against the human in front of the computer, again not the operating system. That makes me say they’re about all alright. Of course they’re not all equal. Immutable distros and sandboxing will help here. But the real deal is other countermeasures, like be aware how phishing works and try not to mix online banking and pirating games from shady websites. That belongs on separate user accounts or even installed operating systems. And use password managers, 2 factor authentication and these things. (And don’t use Edge, or some browser from some random third-party repository.)
Thanks. Yeah it’s always a bit difficult to judge other people’s closed-source demos. Your link in the post above just errors out for me: “Couldn’t find story matching ‘demo-p2p-call–video-call’.” And with the glitr link I can’t figure out how to call myself, I can just write text and get one of the canned responses. So I’m not really sure what to make of this 🤔 But nice work. I like the UI and there is demand for chat/messenging and p2p calls are a nice technology.
In the mid-term and once it’s more than just a demo, you probably need to decide where to go with this, eiter turn it into a commercial product, or go the community project route.
Btw, there’s a plethora of well tested and open source solutions, too. Jitsi Meet, MiroTalk, Galène, Peer-Calls… Some of them have a SFU, some are direct p2p or allow both modes, Galène doesn’t have e2ee but the other ones do. What I found helpful to find smaller easy to use solutions is to look at the project pages of the used libraries, they sometimes have a long list of random projects which use their webrtc or p2p stuff.
I’d try some of the Multimedia / Audio Linux distributions. I believe there are some which have everything set up for you and you can just try and explore. Notably Ubuntu Studio, AV Linux
Other than that, LMMS and Ardour, Qtractor, ZRhythm, Rosegarden, MuSE, or Mixxx for DJing… There’s generally a lot. DAWs, trackers, sequencers, synthesizers… you can do professional multitrack recording or just mess with your guitar or sample some electronic music…
It’s a bit difficult as a beginner, since there are a lot of options and they all have different user interfaces and you might need to learn a few concepts first. And /or read the documentation or watch some Youtube tutorials.
It is currently being threatened, yes.
Edit: Leadership is now going to make the decision whether they like the arms industry or not. And that’s going to be reflected in the vote in a few weeks.
No it’s not. It is currently facing fascism. But the story is being written as we speak. Is it going to succumb to it? Or fight and prevail? We don’t know… Stay tuned for the next episode, we’re going to find out in about 2 months.
To be fair: Using SOME (malicious) VPN can bear immense risks.
Sure. We get security vulnerabilities in Chrome and Firefox all the time. Sometimes the libraries handling images are vulnerable and that’s a big issue. And zero-days are a small fraction of actual attacks, most likely you’re getting hacked because of old, vulnerable software. So updates are the first priority. And backups is something people also frequently forget to set up.