Edit: I may have included too much additional information, I tried to provide enough data so others that have experienced this or may experience it in the future are able to locate this thread through search engines and hopefully get a resolution the issue.
This gets called anytime I download an ISO and I can’t figure out how to make it stop. Its able to replace the freshly downloaded ISO with the Rock Ridge version instantaneously before I could even run a dd command or launch disk image writer to get the fresh ISO written to disk before it is modified.
xorriso -as mkisofs -R -r -J -joliet-long -l -cache-inodes -iso-level 3 --grub2-boot-info --grub2-mbr /usr/lib/grub/i386-pc/boot_hybrid.img -efi-boot-part --efi-boot-image -v -A “application_id” -p “preparer” -publisher “publisher” -V “cdlabel” --modification-date=20240XXXXXXXX -no-emul-boot -boot-load-size 4 -boot-info-table -b boot/grub/grub_eltorito -eltorito-alt-boot -e boot/grub/efi.img -no-emul-boot -isohybrid-gpt-basdat -isohybrid-apm-hfsplus -o /home/user/derivative-binary/17.2.3.7/Kicksecure-Xfce-17.2.3.7.iso /home/user/derivative-binary/Kicksecure-Xfce_iso-tmp
I don’t think I’m on the real Kicksecure anymore. A lot of things that shouldn’t be enabled by default are enabled like the bluetooth.service, overlayfs, fuse, and ntfs3g are also enabled. My xdg-user-dirs is normally /home/user/.config I think, it has been changed to point to /usr/bin/share/, that way I load flatpaks from the wrong directory just like the flatpak escape 0day did.
The doocumentation (man pages for example) aren’t even the same and my grub menu shows that lines have been removed, there is a new line added that is a if fi statement to insert two more kernel modules named lzopio and xen (I think that’s the name of them, very close if not). It seems like the lower deck of the overlayfs is hooking into upper deck with some malicious binaries and shared objects, deleting anything hooked into the upper deck causes a crash, the lower deck is all lib32 software running on a squashfs.img and its dependencies get mangled in with my own, I have to download SSH libs for apps that don’t require networking to function or other random packages that should not be dependencies. I also have to delete the boot order using efitbootmgr and modify my grub entry in order to actually boot into the system at the lower deck. Even figuring out how to boot into the lower deck of the system doesn’t solve the problem though unfortunately.
It’s not as simple as reformatting my USB drive and secure erasing my SSD then using a fresh ISO, it’s like the data doesn’t really get wiped from the USB even though it appears that way to software like gparted and gnome-disks reading the disk image. I have wiped it then brought it over to a remote location, away from my potentially infected machine and it still manages to write that same ISO with the overlayfs and Rock Ridge ISO.
So, what I’m trying to get at as is, has anyone dealt with this before? What can I do aside from considering my devices trashed? I’m strongly considering dumping this data publicly out of frustration but something doesn’t feel right about doing that, somebody certainly put a lot of time and effort into devoping and writing documentation for this system.
As mentioned earlier, the man pages and python documentation are not standard, almost all of the binaries serve an alternate purpose than their name would lead you to believe, for example I can run ‘gpic FILENAME > OUTPUT.txt’ and deobfuscate data hidden inside of files. There is a man page for GNUstep (if I recall correctly) that’s as long as novel and it goes into detail about how to write code in order to cause a buffer overflow in the kernel. So sharing something like that publicly seems to me like I would be destroying the hard work of someone or some group of individuals who have put a lot of time into it. As much I hate what they did to me, I’m also in awe of their work and complexity of the system at the same time.
Is this a known thing that others are getting attacked with in the wild, is it more likely a targeted attack and not wide spread? Locally it seems to spread like a worm via usb and through the network, the boot loader they force me to boot from contains a kernel for Windows, Mac, and Linux (version 5.1, unsupported and out of date), so even switching operating systems does not solve the problem. I hope someone can provide a solution that doesn’t involve throwing my machine into the dump.