0

I am interested to know whether is it a reasonable decision to try and restrict my own user account as much as possible to the point where I would need to use my own password much more frequently (now I use it only for mounting new disks and for system updates). For example I downloaded and opened a malicious program without administrative rights (sudo or etc.) on newly installed Ubuntu with default settings. Would this program be allowed for example: take a whole screenshot of my desktop, sniff my keystrokes (for later use for sudo as an example), listen or watch my microphone or webcam and adding itself in autostart (systemd service or gnome autostart folder, etc.) without me noticing? Of course neglecting the possibility of doing this through 0-day exploits. How dangerous could it get and is there any tips how I could secure my data in case of virus penetrating my system (except for backups and not launching malware in the first place)?

TLDR: How many rights does the arbitrary usermode(ring3) program have in context of the current non-administrative user?

1 Answer 1

1

Would this program be allowed for example: take a whole screenshot of my desktop

Under X11/X.org, yes, easily. Under Wayland it's complicated but possible.

sniff my keystrokes (for later use for sudo as an example)

Likewise.

listen or watch my microphone or webcam

Yes.

and adding itself in autostart (systemd service or gnome autostart folder, etc.) without me noticing?

Yes, for the user session autostart, i.e. ~/.config/autostart/*.desktop. Adding itself as a system service could be possible only via sudo (as well as kernel level/system services exploits) but then if it has sniffed your sudo password, it all becomes trivial.

How dangerous could it get and is there any tips how I could secure my data in case of virus penetrating my system (except for backups and not launching malware in the first place)?

You could:

  • run a web browser under firejail and confine it to a limited number of directories. It will not help you if you recklessly execute downloaded files.
  • run a web browser in a VM, e.g. KVM/VirtualBox/VMWare Workstation but then VMs have been escaped from though it's a very expensive high grade attack which you're very unlikely to be a target of unless the three letter agencies are interested in you in which case there are easier ways to infiltrate your device (e.g. hardware level sniffers, hidden cameras and cameras planted locally, remote data collection using lasers or extremely sensitive microphones etc.)
  • run a web browser on a remote PC/system - the absolute safest option.
4
  • Thank you for the detailed answer. So, I guess if I ran a malware program on my own laptop or home pc, it is only a matter of time before hacker gets full rights on my pc? I thought at least with autostart there is a little protection, because as I remember, on Windows to add a program to autostart, you would need admin rights, so it makes hacker to have a significant time constraint before user disappears forever. Or am I a wrong about this statement? Mar 28, 2021 at 19:58
  • it is only a matter of time before hacker gets full rights on my pc? it depends on how the malware is coded but it's perfectly possible. Windows to add a program to autostart, you would need admin rights - that's incorrect, the normal user has multiple entry points for autostart in Windows neither of which requires admin access, e.g. HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run, then C:\Users\%User%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup . Mar 28, 2021 at 20:44
  • Thank you once more for this amount of detailed explaining. I guess there is no way to protect myself after launching malware, because even if I don't care about my laptop or PC, I would still need to enter my password when logging in to social network for example, so it doesn't matter if I use VM or a real PC when hacker can sniff the password and then do his dirty business unless his goal is to distrupt my machine physically. Mar 28, 2021 at 20:50
  • I guess there is no way to protect myself after launching malware correct, at this point consider your PC 100% compromised which necessitates offline data extraction and complete wipe of storage (nowadays, you also need to reflash your UEFI firmware/BIOS just in case to be extra sure). Mar 28, 2021 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .