Call for help to the forum's security experts

[BernyJB]

I'm, as of now, using the wifi connection in a Starbucks store near my place. At least for now, that's the only option I have.
I'm running Fedora 30 (hope to upgrade soon), and using Conky as a system monitor. For the last few days I've been seeing my CPU usage go through the roof for no reason, so I'm suspecting my laptop is being used to mine crypto while I'm working (there was a reported incident not long ago for the same company).
Normally, my CPU usage hovers around 5%. The absolutely HIGHEST I've seen it go was about 30-35% when I was running Freecad and VLC at the same time. Right now, I'm seeing CPU usage in the upper 90% only on Firefox, which makes no sense.
Memory usage seems to be ok though, at around 15%.
I ran ClamAV, and, unsurprisingly, didn't find anything.
Should I be worried?
What can I do about it?

Thank you  all in advance. 

[1679790686]

1679790686

[1679790686]

1679790686

[1679790686]

1679790686

[BlackHatCoiner]

We can't know for sure if your laptop is affected with something malicious, but only make you questions to form a picture of your machine's status. Have you installed lots of programs whose reputation deflects their legitimacy? Is it yours, personal? Do you ever get to share it others? What's your OS?

[NeuroticFish]

What's your OS?

Fedora 30. Linux.

Right now, I'm seeing CPU usage in the upper 90% only on Firefox, which makes no sense.

Does it happen always or it's related to visiting certain website? I'm asking because it was not uncommon, especially a couple of years ago, for websites to have crypto miners hidden in their pages.
You may want to take a look what does Firefox' task manager tell. Maybe it gives you a clue who's the culprit: https://support.mozilla.org/en-US/kb/task-manager-tabs-or-extensions-are-slowing-firefox

[BernyJB]

Thank you both. 

BlackHatCoiner (or anybody else): ask away. I'm ready. 

I haven't installed any program (other than electrum) for months. The computer is strictly mine, I have a 30 character password made of letters, numbers and signs. Literally speaking, this laptop has never been touched by anybody else but me, not even to wipe it off. I'm running Fedora 30 with Openbox and Tint2.
Right now, for example, after rebooting the computer, I'm typing this reply and seeing CPU usages of up to 50%, which is way too high for only using Firefox, especially on a forum.
I do have a lot of tabs open (mostly Binance, I'm checking prices), but haven't touched them since I restarted the machine.

NeuroticFish : well, I answered that question above...
A few months ago, there was a bit of a scandal because a customer found the ISP (Fibertel) was injecting malware in people's computers to mine crypto without consent (or knowledge). The company issued an apology, Starbucks issued another one, and they changed the ISP. But now (as in the last week or so, I've been coming to this store literally for months) I'm finding this problem.

I opened Firefox's task manager, but it's not showing anything out of the ordinary. Incidentally, what makes me even more suspicious is that I close Firefox and wait, and CPU usage stays near 100%. 

[NeuroticFish]

I opened Firefox's task manager, but it's not showing anything out of the ordinary. Incidentally, what makes me even more suspicious is that I close Firefox and wait, and CPU usage stays near 100%.  

...After you closed Firefox it may hang (with no UI) while some part of it is working... At least on Windows this is not uncommon.

Since I have no idea what can it be, I would start with doing changes that can help me find the culprit.
What if you use another browser for a while? It could be a test to show whether the problem is with your Firefox, some website or something else.
Also you can take a look what extensions you have installed, maybe you see anything suspicious.

These are 2 ideas/directions you can try.
And/or you can wait for answers from people more into Linux...

[jackg]

Have you got any plugins in Firefox that might use a lot of data? Did anyone tell you how to get rid of the miner that was injected into your machine (is there a chance it's still there).

Normally if you have a lot of tabs open in browsers, it only loads the active ones or an active few, have you checked that's all it does when you load it up (eg there's no loading dots or icons in the title bar on tabs).

Can you see the specific resource usage for fedora programs too because you could start there (I know Windows obviously has it but Ubuntu and Debian make that thing a bit less explicit).

[o_e_l_e_o]

Have you tried using System Monitor or the top command in Terminal to see if there is anything else that is using so much CPU power?

In terms of Firefox, then let's start with the simple things. Open Firefox, type about:config in the URL bar, accept any warning which comes up, search for the following two strings and make sure both are set to "true":
browser.contentblocking.cryptomining.preferences.ui.enabled
privacy.trackingprotection.cryptomining.enabled

Which extensions do you have installed?

[BitMaxz]

What are your laptop's current specs?

I do not have so much experience with Fedora OS but I think you can solve this issue by uninstalling the firefox browser if you feel that someone on Starbuck installed something in your browser.

Just reinstall it after and then go to settings and disable the hardware acceleration.

[BernyJB]

Thank you all.
I have closed most of the tabs on Firefox, and it seems to have helped a bit. CPU usage is still too high, but it went down a bit. 

Have you tried using System Monitor or the top command in Terminal to see if there is anything else that is using so much CPU power?

In terms of Firefox, then let's start with the simple things. Open Firefox, type about:config in the URL bar, accept any warning which comes up, search for the following two strings and make sure both are set to "true":
browser.contentblocking.cryptomining.preferences.ui.enabled
privacy.trackingprotection.cryptomining.enabled

Which extensions do you have installed?

Here's top:



It shows "web content" for the highest CPU loads. Right now I have Firefox and Chrome open, So I don't even know which one is hogging so much CPU. Right now I have no working extensions on FF. I have installed Adblock Plus and Ublock, but had to disable them a while ago.
My biggest problem is Fedora stopped providing support for F30, so I have had no updates for a while, and finding a replacement has proved difficult.

Incidentally, I looked at about:config. Both strings are set to true.

[lovesmayfamilis]

The browser itself has already implemented protection against hidden mining. You can also check your privacy settings and enable protection if it is disabled for some reason.



And why don't you update your system to the latest version? Is Fedora 35 inferior to version 30?

[o_e_l_e_o]

Ok. A couple of things I would do next. First would be to type about:performance in to a new tab in Firefox and see what the exact culprit is. If nothing is showing up out of the ordinary there, then try about:processes.

I also found this answer on stackexchange: https://unix.stackexchange.com/questions/321997/debugging-high-near-total-cpu-memory-usage-of-web-content-application-on-lin
Maybe try uninstalling your two disabled ad-blockers, and installing NoScript. Restart and see if that makes a difference. Don't open anything else except Firefox while you are doing this to exclude anything else being the culprit.

[NeuroticFish]

I've read that it can be simply a Firefox problem: bad handling on GPU hardware and disabling hardware acceleration may be just the easy fix.
Also I've read that Opera may be a good replacement, or an option to check whether you have the same issues at browsing, without opening Firefox.

[Lucius]

No one remembered that OP plays with faucets full of all sorts of garbage, and at least 1/3 of them run crypto mining the moment you load them - of course, if you don't have proactive protection that blocks it. It is also possible that some crypto-malware has been downloaded, disguised, and running in the background, and the possibility of using a public wireless network should not be ruled out - malicious attacks that are carried out in this way are very widespread and popular among hackers.

[stompix]

It shows "web content" for the highest CPU loads. Right now I have Firefox and Chrome open, So I don't even know which one is hogging so much CPU.

D'oh! Close one of them and you're going to see who is the culprit, but most likely is firefox.
I used to have Fedora for like 6 years on my laptop, changed it a while ago since I constantly run into memory management problems with every single browser with addons, it was just a pain in the ass, normally you would install Linux on older machines so you could still use them but it as worse than windows, unless you browse a simple page forum every add-on would just increase memory usage.

Maybe try uninstalling your two disabled ad-blockers, and installing NoScript.

Looking at what Lucius mentioned, with Noscript probably OP will have nothing to use his browser for
Checking his older posts, he uses in one of the tabs Whatsapp directly from the browser, depending on the conversations you have that thing alone can grind to a halt even an average modern laptop.

[BernyJB]

Thank you all.

Lovesmayfamilis I don't have that in my settings. It may be part of the newer versions of Firefox...  
I did try Fedora 34 and 35, and Ubuntu, Linux Mint, Mabox, Manjaro, and a few others. There are several things that just don't work (like the screen blanking out every few minutes regardless of your settings, VLC losing audio (yeah, I did try several other video players), or the repo list just getting corrupted, making it impossible to update), and nobody in their respective forums seems to have a clue. That's why I came back to F30, it just works. The downside is I have no security patches.  

O_e_l_e_o: right now it seems to be behaving, but I'll try that if it goes haywire again. Either way, I'm planning to install Open Suse Tumbleweed on another drive later today (let's hope it works), so I should be able to get a newer version of firefox (and all security updates! ), so maybe I can fix the whole problem right away...

NeuroticFish: I haven't tried Opera. I might.
I will be trying Open Suse today on another hard drive, and if it works I will have this hdd available to try other stuff. I'm not using it as a cold wallet because it's getting a bit old, and I'm a bit afraid it might quit on me, but a second "spare" OS could be a good idea...

To make things worse, Virtualbox is not working properly (probably because I haven't been able to update it in months), so I can't test different distros on it. Oh, well...
The thing is I have been using Firefox (with this same exact settings), for years, even on this same computer (yeah, it's an oldie), and never had an issue.

ETFBitcoin: right now I'm not using either. In any case, when I was using them, they did work together without issue. In a future install I think I'll go with Ublock though, as it seems to be a lot more aggressive than Adblock plus.

I am trying to get a new distro, but most seem to be having issues I can't fix, and not having internet access at home makes everything a bit more complicated...

Lucius: I've been (not really "playing") with faucets for over a month, and this issue just showed up in the last week or so. I'm still using Cointiply today, and I'm under 9% CPU usage (not the best, but I'll take it).

Stompix: at the time I posted that, either browser was doing it. Today, Firefox seems to be doing ok.
I am using whatsapp, and have been using it for a couple of years now, as it pays the bills. Hopefully I will stop using it altogether soon enough, but we'll see...
In any case, I didn't have any issues with it before, and I'm not having any issues today.

I'm starting to think it may be because I had a lot of tabs open on firefox, showing prices on binance pairs. Those tabs keep running in the background even when you're not looking at them (which may be the reason why I'm seeing ~10% usage now, instead of the usual <5%, as I still have 4 pairs running).
 

[Trojane]

That's absolutely true from the draft you've shown over there, it really high ... normally, most apps are programmed to operate on thier own and even when you're busy lunching your desired window,it keeps relunching other apps that can possibly run on thier own,(for this reason, the battery cell runs low easily and it makes the thermal regulation abnormal) it does alot of other wrong things most especially if the system isnt upgraded...I don't guarantee fedora 30 not to mishave under Linux as an OS, it does atimes

[aysg76]

There could be possible explanation of cryptojacking which is most common type of hack under which hackers use your system power to mine some cryptocurrency without you knowing about it as the malicious code is injected to your device which runs in the background without you knowing about it.The only way is to check the CPU and GPU power consumption as you have already done it so it could be the same case.

This could happen during when you popped up some fake website containing that malicious link and upon clicking on it the malware runs a algorithm in the system and code to run for mining process is deployed in your system.The hackers use this and can use your system to mine crypto for them making your system slow which is why it's suggested not to click on those links.

As you are roaming around some faucets still it might be possible from that way it has started now due to some reasons or you became aware about CPU consumption lately?

Check this article i found on Google for your help : Mining scams

[BernyJB]

Check this article i found on Google for your help : Mining scams

Just finished reading it. Damn, that's difficult! Gonna have to read it again.

I think a big part of the problem may have been I was using an older version of Firefox, and a version of Fedora that had reached its end-of-life a while ago. I just installed Open Suse Tumbleweed (hope it works), and, so far, everything's going smoothly.
Yeah, the reason I discovered (or started suspecting) I was being attacked is because my computer started running slow, which prompted me to check Conky (you can see it in the screenshot above, in the top-left of the screen), and CPU usage was through the roof. Right now I still don't have conky installed (I have to configure it), but I will soon enough. I just can't live without it.

[BernyJB]

What issues do you have? Distro like Fedora, Ubuntu, Linux Mint and Pop OS should work out of the box most of the time. If you want stable OS with long software/security support, check distro with LTS version or use Debian.

Yeah, they should, but they don't.
I admit I tried Ubuntu and Linux Mint but I didn't like them. Either those things have become really bad through the years, or I've changed a lot (probably the latter. Openbox really messes your head up),  Fedora I've been using (and loving) since the end of CrunchBang!. It used to work out of the box.

The 2 problems that pissed me off the most (and ultimately led me to abandon F34 and F35) were the screen blanking up (and locking up) every 10 minutes, regardless of what you did to it (I changed the power settings on the xfce-settings-manager (which used to do the trick in earlier versions), plus I followed several suggestions from the Fedora Forum, and many others from searches. Nothing worked), and VLC (and other video players) sound continuously breaking up while I was using it (again, I tried a gazillion ways to fix it. Nothing ever came close to make a difference).

Then I moved to Mabox and Manjaro, and both distros ended up getting their repo lists corrupted, making updating impossible. Now, I know Arch fans may see that as "fun", but I don't. I install an operating system to be able to work with the computer, not to have to work endlessly on it.

Now I installed Open Suse. We're progressing: before, VLC audio broke up, now it doesn't work at all. I'll try fixing it over the weekend, but it looks like I'm gonna have to keep on looking...

[BernyJB]

I'm not expert, but usually it's because driver problem. Why don't you try Debian? It has great backward compatible (it's one if very few distro which still offer 32-bit version and driver for very old device). Make sure you grab non-free (as in closed source software) version.

I did. 
Crunchbang! was Debian based. I went to Fedora because of Debian's stupid hypocritical policy of not accepting proprietary drivers yet not providing alternatives to them.  Fedora is the only distro (as far as I know) that accepts both free and non-free stuff.

In the meantime, I'm back to F30. Yay!
I installed Solus yesterday. Had to run an update over 50 times, and was finally unable to do  it, and when I tried to boot it again, it wouldn't even start.
My advice to Solus developers (if there's one on this forum): if you're concerned about user experience, a good starting point would be to make a distro that actually works...