Hacked on Linux - How? - Need help

Privacy and Security Get Advice
1

Hey everyone.
I found a strange application yesterday evening on the Notebook of my wife which seems like a Malware.

Setup:

  • Router with OpenWrt based Firmware
  • 2 Notebooks (using PopOS)
  • 2 Phones (using GrapheneOS)
  • All connected via Ethernet
  • Main Ethernet connection comes from our Landlord into my Router
  • Router and all devices use MullvadVPN with LAN network sharing disabled
  • All 4 devices use Mullvad’s DNS content blocking
  • Also have gUFW installed on the Notebooks

My Actions:

  • I check the App, which was available on the PopStore and Flathub, it seemed fishy and i disconnected all my devices from Ethernet. I backed up all files and checked them via ClamTK, all seem fine.
    I reinstalled both Notebooks with a clean PopOS version and did a factory reset on my Router.
  • I did nothing yet with my Phones - The have not been connected to the Internet since.

Questions:

  1. How could this Application be on her Notebook? (And be verified on Flathub?)
  2. Are all devices in the Network effected?
  3. Do I need to factory reset my Phones as well?
    3.1 Can they even access the Phones when one Notebook in the Network was effected?
    3.2 Can i check Malwares on Android Phones?
  4. Does somebody know that app? Just a Joke, Keylooger?
  5. If they had access to device of my wife, could they get files? Passwords? Masterpasswords?
  6. Any advice in my current siuation?

Here are the Screenshots of the installed App:

Screenshot_1
Screenshot_1884×937 75.9 KB

Screenshot_2
Screenshot_2884×937 72.3 KB

Screenshot_3
Screenshot_3884×937 91 KB

2

I don’t think it’s a virus or something not good. The website linked to the app in FlatHub is the just the site of an Endless OS Initiative, the goal of “Hack Computer” is to learn kids how to code/hack. Also seems like this app is just a game. Just delete it if you don’t need it.

As for how, I don’t know, a dependency maybe?

3

Thanks for the Info, but I am still not sure what this App really is or if it is still Malware or came with Malware as a joke. It has installed itself on its own or while updating other apps via the PopShop. Not sure which app would have this as a dependency.

4

It seems weird to me that a Flathub flatpak could have installed itself on a computer. To confirm, this app isn’t something that comes with PopOS by default?

I would ask in the PopOS matrix room or subreddit as System76 seems pretty active on there.

1 Like
5

I have been using PopOS on different devices for a long time. Never seens this app before. Really strange.