Possible remote control of KDE & / or ability to break encrypted drive access in Dolphin which results in it crashing

[shelled]

May have originally started with Fire Dragon getting compromised by leaving accounts such as X logged in.

Dolphin has also been unstable for a while off and on not using Linux or Bitlocker encrypted drives.

System is fully compromised to not be recovered by corrupting a snapper package when trying to reinstall all packages.

System:
Kernel: 6.13.12-hardened1-2-hardened arch: x86_64 bits: 64 compiler: gcc
v: 15.1.1 clocksource: tsc avail: hpet,acpi_pm parameters: pti=on
page_alloc.shuffle=1 BOOT_IMAGE=/@/boot/vmlinuz-linux-hardened
root=UUID=90bad688-87c2-4fa2-a41d-19c0de4179f2 rw rootflags=subvol=@
quiet rd.luks.uuid=55e381a9-1da2-4774-9917-9126737d9ffd loglevel=3
ibt=off
Desktop: KDE Plasma v: 6.3.5 tk: Qt v: N/A info: frameworks v: 6.14.0
wm: kwin_wayland vt: 1 dm: SDDM Distro: Garuda base: Arch Linux
Machine:
Type: Desktop System: ASUS product: N/A v: N/A serial: <superuser required>
Mobo: ASUSTeK model: ROG STRIX B850-I GAMING WIFI v: Rev 1.xx
serial: <superuser required> part-nu: SKU uuid: <superuser required>
UEFI: American Megatrends v: 0825 date: 11/29/2024
Battery:
Device-1: ps-controller-battery-14:3a:9a:84:09:6f model: N/A serial: N/A
charge: N/A status: full
CPU:
Info: model: AMD Ryzen 7 8700G w/ Radeon 780M Graphics bits: 64 type: MT MCP
arch: Zen 4 gen: 4 level: v4 note: check built: 2022+ process: TSMC n5 (5nm)
family: 0x19 (25) model-id: 0x75 (117) stepping: 2 microcode: 0xA705206
Topology: cpus: 1x dies: 1 clusters: 1 cores: 8 threads: 16 tpc: 2
smt: enabled cache: L1: 512 KiB desc: d-8x32 KiB; i-8x32 KiB L2: 8 MiB
desc: 8x1024 KiB L3: 16 MiB desc: 1x16 MiB
Speed (MHz): avg: 2403 min/max: 400/5176 boost: enabled scaling:
driver: amd-pstate-epp governor: powersave cores: 1: 2403 2: 2403 3: 2403
4: 2403 5: 2403 6: 2403 7: 2403 8: 2403 9: 2403 10: 2403 11: 2403 12: 2403
13: 2403 14: 2403 15: 2403 16: 2403 bogomips: 134142
Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
Vulnerabilities: <filter>
Graphics:
Device-1: Advanced Micro Devices [AMD/ATI] Navi 32 [Radeon RX 7700 XT /
7800 XT] vendor: XFX driver: amdgpu v: kernel arch: RDNA-3 code: Navi-3x
process: TSMC n5 (5nm) built: 2022+ pcie: gen: 4 speed: 16 GT/s lanes: 16
ports: active: DP-3,HDMI-A-1 empty: DP-1,DP-2,Writeback-1 bus-ID: 03:00.0
chip-ID: 1002:747e class-ID: 0300
Device-2: Advanced Micro Devices [AMD/ATI] Phoenix1 vendor: ASUSTeK
driver: amdgpu v: kernel arch: RDNA-3 code: Phoenix process: TSMC n4 (4nm)
built: 2023+ pcie: gen: 4 speed: 16 GT/s lanes: 16 ports: active: none
empty: DP-4, DP-5, DP-6, DP-7, DP-8, HDMI-A-2, Writeback-2 bus-ID: 0d:00.0
chip-ID: 1002:15bf class-ID: 0300 temp: 43.0 C
Display: wayland server: X.org v: 1.21.1.16 with: Xwayland v: 24.1.6
compositor: kwin_wayland driver: X: loaded: amdgpu
unloaded: modesetting,radeon alternate: fbdev,vesa dri: radeonsi
gpu: amdgpu d-rect: 5360x2520 display-ID: 0
Monitor-1: DP-3 pos: bottom-l model: Samsung S34CG50 serial: <filter>
built: 2024 res: mode: 3440x1440 hz: 60 scale: 100% (1) dpi: 109 gamma: 1.2
size: 798x334mm (31.42x13.15") diag: 869mm (34.2") modes: max: 3440x1440
min: 720x400
Monitor-2: HDMI-A-1 pos: top-right model: Sharp HDMI built: 2008 res:
mode: 1920x1080 hz: 60 scale: 100% (1) dpi: 59 gamma: 1.2
size: 820x460mm (32.28x18.11") diag: 940mm (37") ratio: 16:9 modes:
max: 1920x1080 min: 720x400
API: EGL v: 1.5 hw: drv: amd radeonsi platforms: device: 0 drv: radeonsi
device: 1 drv: radeonsi device: 2 drv: swrast gbm: drv: radeonsi
surfaceless: drv: radeonsi wayland: drv: radeonsi x11: drv: radeonsi
API: OpenGL v: 4.6 compat-v: 4.5 vendor: amd mesa v: 25.0.5-arch1.1
glx-v: 1.4 direct-render: yes renderer: AMD Radeon RX 7800 XT (radeonsi
navi32 LLVM 19.1.7 DRM 3.61 6.13.12-hardened1-2-hardened)
device-ID: 1002:747e memory: 15.62 GiB unified: no display-ID: :1.0
API: Vulkan v: 1.4.313 layers: 9 device: 0 type: discrete-gpu name: AMD
Radeon RX 7800 XT (RADV NAVI32) driver: mesa radv v: 25.0.5-arch1.1
device-ID: 1002:747e surfaces: N/A device: 1 type: integrated-gpu name: AMD
Radeon Graphics (RADV PHOENIX) driver: mesa radv v: 25.0.5-arch1.1
device-ID: 1002:15bf surfaces: N/A device: 2 type: cpu name: llvmpipe
(LLVM 19.1.7 256 bits) driver: mesa llvmpipe v: 25.0.5-arch1.1 (LLVM
19.1.7) device-ID: 10005:0000 surfaces: N/A
Info: Tools: api: clinfo, eglinfo, glxinfo, vulkaninfo
de: kscreen-console,kscreen-doctor wl: wayland-info
x11: xdpyinfo, xprop, xrandr
Audio:
Device-1: Advanced Micro Devices [AMD/ATI] Navi 31 HDMI/DP Audio
driver: snd_hda_intel v: kernel pcie: gen: 4 speed: 16 GT/s lanes: 16
bus-ID: 03:00.1 chip-ID: 1002:ab30 class-ID: 0403
Device-2: Advanced Micro Devices [AMD/ATI] Rembrandt Radeon High
Definition Audio vendor: ASUSTeK driver: snd_hda_intel v: kernel pcie:
gen: 4 speed: 16 GT/s lanes: 16 bus-ID: 0d:00.1 chip-ID: 1002:1640
class-ID: 0403
Device-3: Sony DualSense wireless controller (PS5)
driver: playstation,snd-usb-audio,usbhid type: USB rev: 2.0 speed: 480 Mb/s
lanes: 1 mode: 2.0 bus-ID: 1-1:2 chip-ID: 054c:0ce6 class-ID: 0300
Device-4: ASUSTek USB Audio driver: hid-generic,snd-usb-audio,usbhid
type: USB rev: 2.0 speed: 480 Mb/s lanes: 1 mode: 2.0 bus-ID: 1-6:3
chip-ID: 0b05:1be1 class-ID: 0300
API: ALSA v: k6.13.12-hardened1-2-hardened status: kernel-api tools: N/A
Server-1: PipeWire v: 1.4.2 status: active with: 1: pipewire-pulse
status: active 2: wireplumber status: active 3: pipewire-alsa type: plugin
4: pw-jack type: plugin tools: pactl,pw-cat,pw-cli,wpctl
Network:
Device-1: Intel Ethernet I226-V vendor: ASUSTeK driver: igc v: kernel pcie:
gen: 2 speed: 5 GT/s lanes: 1 port: N/A bus-ID: 0a:00.0 chip-ID: 8086:125c
class-ID: 0200
IF: eno1 state: up speed: 1000 Mbps duplex: full mac: <filter>
Device-2: Sony DualSense wireless controller (PS5)
driver: playstation,snd-usb-audio,usbhid type: USB rev: 2.0 speed: 480 Mb/s
lanes: 1 mode: 2.0 bus-ID: 1-1:2 chip-ID: 054c:0ce6 class-ID: 0300
Info: services: NetworkManager,systemd-timesyncd
Drives:
Local Storage: total: 1.82 TiB used: 61.09 GiB (3.3%)
SMART Message: Unable to run smartctl. Root privileges required.
ID-1: /dev/nvme0n1 maj-min: 259:0 vendor: Samsung model: SSD 990 PRO 2TB
size: 1.82 TiB block-size: physical: 512 B logical: 512 B speed: 63.2 Gb/s
lanes: 4 tech: SSD serial: <filter> fw-rev: 4B2QJXD7 temp: 50.9 C
scheme: GPT
Partition:
ID-1: / raw-size: 71.28 GiB size: 71.28 GiB (100.00%)
used: 61.06 GiB (85.7%) fs: btrfs dev: /dev/dm-0 maj-min: 254:0
mapped: luks-55e381a9-1da2-4774-9917-9126737d9ffd
ID-2: /boot/efi raw-size: 100 MiB size: 96 MiB (96.00%)
used: 31.3 MiB (32.6%) fs: vfat dev: /dev/nvme0n1p1 maj-min: 259:1
ID-3: /home raw-size: 71.28 GiB size: 71.28 GiB (100.00%)
used: 61.06 GiB (85.7%) fs: btrfs dev: /dev/dm-0 maj-min: 254:0
mapped: luks-55e381a9-1da2-4774-9917-9126737d9ffd
ID-4: /var/log raw-size: 71.28 GiB size: 71.28 GiB (100.00%)
used: 61.06 GiB (85.7%) fs: btrfs dev: /dev/dm-0 maj-min: 254:0
mapped: luks-55e381a9-1da2-4774-9917-9126737d9ffd
ID-5: /var/tmp raw-size: 71.28 GiB size: 71.28 GiB (100.00%)
used: 61.06 GiB (85.7%) fs: btrfs dev: /dev/dm-0 maj-min: 254:0
mapped: luks-55e381a9-1da2-4774-9917-9126737d9ffd
Swap:
Kernel: swappiness: 133 (default 60) cache-pressure: 100 (default) zswap: no
ID-1: swap-1 type: zram size: 60.49 GiB used: 0 KiB (0.0%) priority: 100
comp: zstd avail: lzo-rle,lzo,lz4,lz4hc,deflate,842 max-streams: 16
dev: /dev/zram0
Sensors:
System Temperatures: cpu: 56.0 C mobo: 45.2 C
Fan Speeds (rpm): N/A
GPU: device: amdgpu temp: 58.0 C mem: 60.0 C fan: 606 watts: 40.00
device: amdgpu temp: 43.0 C watts: 18.09
Info:
Memory: total: 64 GiB note: est. available: 60.49 GiB
used: 15.29 GiB (25.3%)
Processes: 420 Power: uptime: 10m states: freeze,mem suspend: deep
avail: s2idle wakeups: 0 services: org_kde_powerdevil,
power-profiles-daemon, upowerd Init: systemd v: 257 default: graphical
tool: systemctl
Packages: pm: pacman pkgs: 1459 libs: 458 tools: octopi,paru Compilers:
gcc: 15.1.1 Shell: garuda-inxi default: fish v: 4.0.2 running-in: konsole
inxi: 3.3.38
Garuda (2.7.2-1):
System install date:     2025-02-05
Last full system update: 2025-05-12 ↻
Is partially upgraded:   No
Relevant software:       snapper NetworkManager dracut
Windows dual boot:       Probably (Run as root to verify)
Failed units:

[cybertheworm]

@shelled

Last full system update: 2025-05-12 ↻

You need to reboot your system, do that and then try again.

[shelled]

Full OS control seems to be possible also Kate is also slow to open; seems like any objective is possible; remote attacks are very targeted to achieve specific goals; also seen this behavior on Windows 10 11; this is also a dual boot system with most time spent in Garuda.

[shelled]

System performance degraded as well.

[shelled]

Pretty sure tried that already. Will try again. Seems to be something to do with KDE Wallet which used to be easier to uninstall; now it wants to remove 217 packages some of which would break the install further.

[shelled]

[shelled]

Very targeted attacks of recently used features such as Spectacle rectangular screenshot feature.

[shelled]

Same result from first reboot.

[SGS]

Stop posting like in a chatroom and stop also posting screenshots from terminal, please!

[danib]

You have a broken package. There’s nothing you show there that indicates your system compromised. Delete the cache and reinstall the package. It’s no big deal.

[shelled]

[SGS]

please, only use terminal not octopi, check .pac files, use garuda-update first.

[tbg]

Wow, you certainly seem to get hacked a lot. Searching your username on the forum turns up no less than 20 posts where you claim an “exploit” is occurring:

Possible bios got hacked; about to do a fresh install when new ISO Drops or test beta etc

This is just a record of noticable behavior of likely compromised system over a number of months that is about to be reinstalled. (Older computer & Garuda is running great; no issues really that need to be fixed; might be helpful for making Garuda or Linux more secure or for the new ISO release for September) Bios noticeably was manipulated; about to do a reinstall; reinstalled all packages and removed orphans which seemed to help a bit yet system is not running as it should. Seems like the fi…

Stacer remotely exploited to load slowly...(seems like)

Installing Stacer after a full system install & update usually allows it to load in a few seconds; if it is installed after the additional packages it takes longer. (now also after just the system update seems to be an exploit; as it does not happen every time; more likely after successive system updates.) Much appreciated. System: Kernel: 6.1.6-hardened2-1-hardened arch: x86_64 bits: 64 compiler: gcc v: 12.2.0 parameters: pti=on page_alloc.shuffle=1 BOOT_IMAGE=/@/boot/vmlinuz-linux-hardened r…

KDE memory leak / exploit is allowing for a remote attacker to convert sdhc cards to read only (windows formated and bitlocker encrypted sdhc

Using LibreWolf (piped youtube / Twitter main / Gmail mostly) allows for a remote attacker to access memory cards that are to be connected; to render them read only; so files can not be modified; or copied to the drive. Has happened twice; with user feedback turned on in KDE; in a two week period; even after the latest updates to the kernel yesterday. Attack is seems to be possible on windows formatted sdhc cards; also have tested bitlocker encypted sdhc cards (was not able to test linux encry…

KDE PS4/5 Controller getting compromised by unknown interface (used to work perfectly)

Unknown controller access device getting compromised; manipulating ps5 controller input after popping up before every game that is run or crashing games outright; in Steam and making the Steam interface unusable. [controller support is getting exploited and controlled in browser 030125] Kernel: 6.13.6-hardened1-1-hardened arch: x86_64 bits: 64 compiler: gcc v: 14.2.1 clocksource: tsc avail: hpet,acpi_pm parameters: pti=on page_alloc.shuffle=1 BOOT_IMAGE=/@/boot/vmlinuz-linux-hardened root=UUI…

Issues with files and programs not opening after using a browser for a few hours

Its an exploit or malware issue; some sort of memory leak from a downloaded file; which allows manipulation of Dophin or KDE. This is so detrimental to workflow that will likely need to stop using Linux. Can see that happening for pro audio issues; not something like this.

Tecknet UsbC / A Adapter is disconnecting and reconnecting after using beatport for about 10 hours on Brave Browser only happening on one machine

Tecknet UsbC / A Adapter is disconnecting and reconnecting; after using Beatport & Mammoth Interactive Courses for about 10 hours on Brave Browser; only happening on one machine. Happening for everything now even when the browser is not open. Guessing some sort of cache poisoning exploit because running Bleechbit seems to stop it from happening when Brave is not open at least. (chrome is exploitable) Much Appreciated. System: Kernel: 6.9.7-hardened1-1-hardened arch: x86_64 bits: 64 compiler:…

KDE freezes when plugging in power or attaching usb c power bank for charging

KDE freezes when plugging in power or attaching usb c power bank for charging Has happened doing nothing or when running a game using steam. Did not happen before KDE 6 was released & could be part of another exploit. Much appreciated. Kernel: 6.8.4-hardened1-1-hardened arch: x86_64 bits: 64 compiler: gcc v: 13.2.1 clocksource: tsc avail: hpet,acpi_pm parameters: pti=on page_alloc.shuffle=1 BOOT_IMAGE=/@/boot/vmlinuz-linux-hardened root=UUID=fb43e97c-1c95-43a6-9b71-d8cab7643f3d rw rootflags=…

Sporadic Lockups

Also experiencing this; reinstalling all packages through Garuda Assistant helped at one point; issue is now only happening when running certain programs such as VLC; or streaming video in browser for long periods which may be happening from exploits.

System freezing before KDE Plasma 6 update also screen going black and Librewolf & Firedragon auto closing

System will freeze or close windows (still happens but started happening before kde plasma 6 update); seems to be an exploit issue not a resource issue; only happens on hardened kernel (6.8 on zen seems to be helping but it is not the only issue and was not happening on zen for a few weeks now). Not effecting ESO anymore was originally though; Cyberpunk 2077 will also freeze and close as well as Firedragon & Librewolf (even after latest update); Firestorm Second Life Viewer & also VLC playing …

Sorry, but I didn’t have the patience to copy out the full list of your claimed past computer intrusions.

Perhaps it’s about time to limit your computer usage to performing less risky activities online to reduce your exposed attack vectors.

[shelled]

Looking into Proxmox; learning about cyber security not really very risky behavior; used to have a friend who was an NSA data forensics contractor things got weird after knowing him its been decades.

[shelled]

Will try terminal. Unlocking disks works though Partition Manager. Had this happen on a few installs now; also been getting warnings about packages not downloading but installing anyways; always a good opportunity to look into these issues; there have been hundreds of improvements in the last few years have been using this operating system; very impressed; took Windows a very long time to close holes that were being exploited; it is much better now; just do not like using windows. Always preferred linux. Like this distro the best out of all currently. Much appreciated.

[shelled]

It seems like a hardware issue; this has happened on 5 + installs that were not able to be restored from snaps and required a fresh install fix; everything is opening slower updates, VLC, Dolphin windows, Firestorm Viewer, Fire Dragon, Libre Wolf.

Steam does not open slower.

This is not effecting computer performance; Windows 11 dual boot is running great; its just this operating system install which these specific things. Guessing this is an unknown exploit. It behaves like file-less malware or a kit it took a few months to happen.

[shelled]

Reinstall started to work then broke & somehow the first part of the transaction was deleted.

error: problem occurred while upgrading linux-firmware
error: could not commit transaction
error: failed to commit transaction (transaction aborted)
Errors occurred, no packages were upgraded.
Press enter to exit

[shelled]

Follows a pattern that firmware is able to be exploited on multiple systems; original system being AMD APU from 2014; firmware hacking easier to cloak and it was being done on windows too.

[Apocalypticus]

@SGS

Hören Sie bitte auf, wie in einem Chatroom zu posten

Don’t you think that if someone wanted to hack a system using malicious firmware, they would do everything in their power to make it happen without problems and error messages?

EDIT: Missclicked. This post was a reply to @shelled not to @SGS

[tbg]

A man has been seeing the same doctor for years for the same symptoms with no results.

Finally one day the doctor says, “Okay, here’s what I want you to do. I want you to take the longest, hottest bath you can stand, then I want you to open all the doors and windows in the house.”

The man says “But doctor, I’ll get pneumonia, won’t I?”

And the doctor says “Yes, but I know how to treat that!”