[gentoo-amd64] Re: help weird internet problem

[Duncan]

gentoo.taijin posted
<2b30dc310604251739u27abbe81o5d64ffcf3e99c705@××××××××××.com>, excerpted
below,  on Tue, 25 Apr 2006 17:39:19 -0700:

> Im having some very weird internet problems.&nbsp; I posted in the
> forums earlier today but still no luck.&nbsp; <span>About 90% of the the
> urls that I type into firefox and konqueror take me to a page that says
> the requested url was not found on this server. for example when I type
> in <a href="http://google.com/" target="_blank" onclick="return
> top.js.OpenExtLink(window,event,this)">google.com</a> I get this <a
> href="http://img288.imageshack.us/img288/5751/screenshot18wl.png"
> target="_blank" onclick="return
> top.js.OpenExtLink(window,event,this)">http://img288.imageshack.us/img288/5751/screenshot18wl.png</a>
>  but when I type in <a href="http://www.google.com/" target="_blank"
> onclick="return top.js.OpenExtLink(window,event,this)">
> www.google.com</a> it works fine some other urls that work are <a
> href="http://www.yahoo.com">www.yahoo.com</a> and <a
> href="http://www.aol.com">www.aol.com</a>.  some sites have weird images
> like <a href="http://www.afterdawn.com/" target="_blank" onclick="return
> top.js.OpenExtLink(window,event,this)"> www.afterdawn.com</a> <a
> href="http://img288.imageshack.us/img288/6292/screenshot2ni.png"
> target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
> http://img288.imageshack.us/img288/6292/screenshot2ni.png</a> It get's
> even more weird. I can access all websites through lynx, with no
> problems and all the other computers at my house work fine. I have tried
> changing nameservers ethernet cards recompiling firefox, putting myself
> on virtual DMZ. I am at my wits end. I would like to avoid reinstalling
> gentoo if at all possible, because I just reinstalled a month ago and
> things were working fine till two days ago.</span> <br
> clear="all"><br>-- <br>I lost an hour, has anyone found it? I want it
> back!!!

After you get it fixed, consider turning off HTML for your posts, I
understand that it's not your priority at the moment, but you can see what
a mess it makes of your posts, for those of us who choose not to use HTML,
above.  Faced with that sort of jumble, can you blame anyone who'd simply
skip the post and go onto the next?

Try disabling all plugins/extensions/java/javascript.  Also verify your
proxy settings.  It appears your firefox has been set to redirect thru
a hostile proxy.

Try setting up a new Linux user account (with a clean configuration) and
see if it is also redirected. If not, you can gamble that you haven't been
entirely rooted. If it's redirected as well, consider yourself rooted, and
that everything on the system (all files, passwords, any banking records,
etc)  is now both known to the cracker, and potentially compromised. 
Check for a keylogger, noting of course that a rootkit will have likely
replaced your ps and etc with versions that won't report the existence of
such a keylogger.  Best to reinstall from a known clean LiveCD or the like.

Even if there's no evidence that you've been fully rooted, it's at least
possible that anything you've done with firefox, checking your mail,
online banking, whatever, has been watched by the cracker, who now knows
those passwords.  If you do online banking, alert your bank immediately,
making arrangements to change your password and having them watch for
questionable transactions (if you don't decide to shut down that account
and open a new one entirely).  Same with any webmail accounts (which it
appears you use) and the like.  The cracker may or may not have been able
to intercept secure sessions, but I would assume that he did.  If you
know how to verify the legitimacy of an SSL session in firefox, and do so
religously, chances are you are still safe, but again, I'd take no
chances.  If not, I'd /certainly/ consider anything you've done online to
now  be known to this cracker, and shut down those accounts, not just
change passwords, opening new ones.

After you've cleaned up the damage, be sure to alter your behavior
sufficiently that this won't happen again.  Maybe you didn't keep firefox
updated and he got in thru a known vuln there.  Maybe you do keep it
updated, but it was an extension that let you down.  In any case,
scripting, java, and plugins are best off by default, turned on only for
sites you trust.  I understand that a per-site scripting permissions
extension is available for firefox -- that it doesn't have per-site
permissions resolution by default.  You can either install it, or simply
keep scripting off by default and toggle it on where needed.  Similarly
for java/plugins/cookies (altho session cookies aren't so bad and are
often helpful, and some tools let you treat all cookies as session
cookies).  Greasemonkey, due to the way it works, is an especially
critical extension to keep updated, and be aware of how it functions and
the potential weaknesses of the approach.  It can be used fairly securely,
but you need to be aware of things when you use it, as it can increase
security risk for those not used to routinely evaluating the risk and
modifying their actions accordingly.

I have to mention that HTML mail you sent here too, since it is the belief
of many (yours truly included, as should be obvious) that HTML, while
fine for web pages, is an unneeded security hazard for mail, and that the
only folks using it for mail are the crackers (who exploit its
vulnerabilities), the spammers (who exploit its ability to hide spam
filter confounding text), and the aoler/noobs that wouldn't know a
security hole if they tripped and fell in.  While that may be a bit
strong, the correlation between your use of HTML mail and the fact that
you are dealing with the apparent effects of a successful exploit is hard
to avoid.  Safe computing, like safe sex, is a choice -- you have to make
the choice to learn about it, then the choice to put it into practice --
failing to do so is putting both yourself and others at risk.  Many would
argue that someone using HTML mail either doesn't know or simply doesn't
care about safe computing, and that it's exactly that attitude which now
finds you in this situation.

Something else you may consider is privoxy.  I use it here, with
konqueror, my browser of choice, but it'll work for firefox or the like
just as well.  http://www.privoxy.org  Even if your browser of choice
doesn't allow per-site toggling of various things (cookies, scripting,
plugins, etc), privoxy does. For example, I have privoxy set to turn all
cookies into session-only cookies, with per-site exceptions where
necessary.  I then set konqueror to accept session-only cookies by
default, which is a global checkbox in addition to its usual per-site
settings, but do /not/ check the box that would tell konqueror to make
/all/ cookies into session cookies, because privoxy does that for me, and
checking that box would make konqueror set the cookies for the sites I
want to keep cookies for to session-only as well.  Privoxy does a lot of
other things too.  I have mine customized with a rather detailed filter
(that I created myself) that enforces  my light text on a dark background
preferences, without killing color entirely (it turns a bright robin's egg
blue background to navy blue, and makes a dark brick red text designed to
be visible on white, to a bright red that's readable on a dark background,
etc), for instance. Privoxy's rules don't apply to secure pages, of
course, since for those it just forwards the request, since it's encrypted
and privoxy can't read it.

When your done, you should still be doing security updates, but if you
somehow miss one or it doesn't come out before a cracker starts exploiting
the problem, you'll probably not be victimized anyway, because the
scripts necessary for the exploit simply won't run on sites that might
consider hosting them, as you'd hopefully not trust such sites enough to
toggle it on, and it'll be off except where you /have/ turned it on.
Similarly with potentially vulnerable extensions and plugins, as well as
the cookies which otherwise make it so easy for the doubleclicks of the
world to track your movements from site to site.

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman in
http://www.linuxdevcenter.com/pub/a/linux/2004/12/22/rms_interview.html


-- 
gentoo-amd64@g.o mailing list