Hacked!

*Robin*

At the end of the financial year I got an email from my accountant. All looked perfectly normal; correct addy, polite message: "Please look at this document" - he sends me half a dozen similar ones a year.

Unfortunately his account has been hacked (he tells me his IT guy says nothing can be done about it at his end). The document has downloaded something onto my laptop which I think is a file-sharing programme.

When I try to shut down the laptop, the following message appears:
WebRTC has active PeerConnections

Somewhat concerning, a bit annoying, but not crucial until I moved the laptop onto my mobile connection (3 mifi). The entire month's internet allowance was used up in less than ten minutes while I was checking emails (£35 worth)!

Please can anyone tell me if there's anything I - a very un-tech-savvy user - can do to get rid of this parasite programme (apart from replacing the laptop!)? It's running on Linux, in case that makes a difference to any advice. I'm also worried that I may be inadvertently breaking some law by this peer-thing running on my machine.

agrinnall

I'm slightly surprised to find a self-confessed un-tech-savvy person running Linux. But it offers an opportunity for those people who push Linux as a solution in every (usually inappropriate) situation to come to your rescue.

megaginge

Which linux distribution are you running?

https://www.howtoforge.com/how_to_find_out_about_your_linux_distribution if you need help finding it

nkomp18

The message "WebRTC has active PeerConnections"

could be a product of your Chrome settings.

Paste this "chrome://flags/" in your Chrome web address bar.

Find and disable the WebRTC.

psychic_teabag

Looks like webRTC is a browser feature, so presumably could affect both windows and linux. Don't know much about it myself, but looks like it can be used for file-sharing, which means it might be exploitable for stealing files and things. A quick search suggests there's a security hole which can reveal your IP address.

https://www.whoer.net/blog/article/how-to-disable-webrtc-in-various-browsers/

From a shell, you can use 'netstat' to see what connections your machine has open : I'd suggest netstat -tnp
t = tcp only
n = no reverse name-lookup (can be a bit slow)
p = show program that made the connection

Double_V

Maybe a clean install will help ?

*Robin*

Thank you everyone for your suggestions.

Yes, I use Chrome, so it looks like I can't get rid of the parasite.

The tech-savvy son who set up my laptop is busy elsewhere keeping European air travellers safe so I can't ask him for help until his next leave..

It seems ridiculous to dump the laptop, but if I do that; buy another and use it on the same ISP address [with the same browser as Chrome is the only one I am happy with] - will I have the same problem, or is it 'tied' to my current machine?

ETA: The "Zorin" version of Linux is what's installed, but I've no idea which variant.

*Robin*

Well. I've downloaded Firefox, but there doesn't seem to be any obvious way of disabling Chrome and using Firefox instead (ie. no icon)?

Rubidium

*Robin* wrote: »

Thank you everyone for your suggestions.

Yes, I use Chrome, so it looks like I can't get rid of the parasite.

The tech-savvy son who set up my laptop is busy elsewhere keeping European air travellers safe so I can't ask him for help until his next leave..

It seems ridiculous to dump the laptop, but if I do that; buy another and use it on the same ISP address [with the same browser as Chrome is the only one I am happy with] - will I have the same problem, or is it 'tied' to my current machine?

ETA: The "Zorin" version of Linux is what's installed, but I've no idea which variant.

If your prefered browser is Chrome, I suggest that you download and install the Slimjet browser here

Slimjet is a fast and secure browser based on Chromium that integrates many powerful and convenient features not in Chrome, including dissabling of WebRTC with a simple checkbox in settings.

It looks and feels the same but you have control of many things not available in Chrome!

Rubidium

*Robin* wrote: »

Well. I've downloaded Firefox, but there doesn't seem to be any obvious way of disabling Chrome and using Firefox instead (ie. no icon)?

Simply close Chrome and then open Slimjet and make that your default browser. You will be asked if you want it to be your default browser.

Fightsback

I doubt very much you have been hacked, it sounds to me like it could be an old bug in chrome. What version of chrome are you using ?

In the meantime you can disable webrtc in Chrome, copy this to the address bar and enter:

chrome://flags/#disable-webrtc