[SOLVED] browser chromium hijacked

Question

hello
I thought using linux I was safe, but I think my browser chromium is hijacked, because when I click randomly on some links, a tab opens showing the search engine scour.com.
I do not know what to do.
Can you help me?
Thank You
Last edited by ppsalama (2015-02-06 16:27:13)

Answer 1

@ppsalama:
Your question about exploits and hijacking brings up an interesting issue.  Most people think about security in a backwards way.  Every browser has a zillion exploits in its history, many of which are patched, but at any one time there are both known and unknown unpatched exploit vulnerabilities in the wild.  Using software with such vulnerabilities is a little like knowing that the road is absolutely infested with bloodthirty banditos, along every curve and narrow spot, but taking the horse and buggy through the pass every day in spite of knowing about those ugly characters.  Instead, one should be taking the train (or the jet plane) - and not take the bad road at all.  The bad road is the unencrypted one.  Theoretically, an encrypted connection completely isolates your channel so that banditos cannot get into it (because you're flying way high up over their heads).   
This works under three conditions: 1) Your cipher text cannot be broken on the fly.  2) Your authentication works (certificates), and you have no fuel leaks that cause you to crash in the desert.  The fuel leaks are the unencrypted side channels (http) branching from  a site that connects to you with https on the main page. (This mix of https/http is called mixed content=BAD). 
Unfortunately, the cipher suites that are typically used by default after https handshakes are often broken (easily) "on the fly."  This is because of the way server private keys have gotten into the wild.  The use of ephemeral keys alleviates this issue in all but the most targeted attacks, assuming the actual data encryption is also up to snuff.  Most ssl stack/browser combinations do not end up selecting a cipher suite that utilizes ephemeral keys (called DHE* cipher suites, or suites that use the diffie helman ephemeral key exchange mechanism).  However; this can be remedied by modifying your ssl stack + browser to supply ONLY DHE* cipher suites in the preferences list sent to the server, and to allow only DHE cipher suites in the final connection produced after the handshake.
The fact that DHE* is not uniformly being used is one of the reasons the internet is broken, along with certificates, mixed content, and invasive proxies.  Call your congressman.
Now, the good news:  This site (bbs.archlinux.org) accepts DHE* cipher suites if your browser puts them in the preferences list!  So, archlinux.org is one of VERY few sites that I feel comfortable visiting (Of course I have made the modifications to my ssl and browser).  This is a pretty important issue.  You should study it, or ask a techie friend about it.  Sometimes the key mechanism is referred to as a PFS (perfect forward secrecy) mechanism, if you want more buzzwords.  Sorry for such a long first post.
(See disclaimer in next message (below)).
Last edited by Ronaldlees (2015-03-08 14:47:33)