all 15 comments

sorted by: hot top controversial new old
[–] 12 points 2 months ago (2 children)

So the chain of exploits would have to be arbitrary code execution in VLC from playing a malicious FLAC file, chained into a privilege escalation to be able to mess with hardware and finally an attack against the firmware. This chain of exploits seem extremely unlikely. Bundled in some random torrent no less.

Honestly a double hardware failure is probably more likely.

  • source
  • hideshow 2 child comments
  • [–] [S] 0 points 2 months ago* (last edited 2 months ago) (1 child)

    I agree that the chain of exploits you're mentioning is unlikely.

    But it's also possible there was no malicious FLAC file and that first my router was attacked, and then I was attacked via AMD PSP which hacked the firmware of SSD drive and this firmware tried to transfer the firmware attack to the second laptop.

    I also plugged in the same ethernet device into both laptops at one point (to try to get the hacked router to work) and it could have been a badusb firmware attack or at attack that came from the router to both laptops.

    Would 2 keyboards fail in the exact same way, with all caps and shift held down, but one is persistent after reboots and one isn't? It doesn't make sense.

    Is this a typical pattern for keyboard controller failure that could be seen in this same way on two laptops at the same time?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 months ago

    Would 2 keyboards fail in the exact same way, with all caps and shift held down, but one is persistent after reboots and one isn’t? It doesn’t make sense.

    Is this a typical pattern for keyboard controller failure that could be seen in this same way on two laptops at the same time?

    I mean, I think it's much more likely that some hardware failed, than that someone executed a highly sophisticated attack that worked but ended up showing obvious signs of tampering.

  • source
  • parent
  • [–] 16 points 2 months ago (1 child)

    Hydrate, sleep, no stimulants. If the government is still in your keyboard after that, at least it’s not dehydration.

  • source
  • hideshow 1 child comment
  • [–] [S] 3 points 2 months ago*

    This edgy response isn't helpful. I do sleep and don't use any stimulants except decaff coffee.

    If you think I'm just crazy, you could at least let me know why you think 3 hardware components failed within this period, two of them in the exact same unusual way on 2 devices.

  • source
  • parent
  • [–] 7 points 2 months ago* (1 child)

    I think you've skipped a bunch of troubleshooting steps into the realm of paranoia.

    You need to take a step back, take some deep breaths. As another commenter said, ensure that you are taking care of your own health, because you're not wrong, this sounds batshit.


    After that, you can start troubleshooting one thing at a time, starting with the most basic, ignoring any assumptions and focusing on only what you know as fact. Your description is so flooded with extraneous detail that it's hard to follow, but what I got out of it is this:

    • You're incredibly concerned about privacy, but not particularly knowledgeable (using TOR for all web browsing, using random VPN without actually looking into it, instead of taking some time to study before you jump in feet first).
    • This means you are likely to be using some combinations of software and settings that are non-standard, that you may not fully understand. I don't mean this as an insult, we've all been there, but we need to stop focusing on what you assume. The type of people asking for help on asklemmy of all places are not the same people being targeted by state actors or "super hackers", unless there's a lot of shit you left out.
    • This is on top of your admittance of doing vibe-coding with all the supply chain risks that you are thankfully somewhat aware of.
    • You recently changed VPN providers. This is not placed at any point in the overall timeline, so we cannot begin to guess at any relation to further events, such as shady VPN software installs before or after certain listed issues.
    • You recently torrented some FLAC files and used VLC to play them, which is the last thing you recall doing before you started having your most recent issues, which appear to be your router requiring a firmware reflash, and the keyboard input issues.
    • "Around that time" of the FLAC album download, but not specifically before or after, your router stopped working and required a full firmware reflash. You do not say where you obtained this firmware, if it is the official manufacturer firmware or something custom/third party like OpenWRT. This was a few days ago.
    • After fixing the router and cleaning, you begin having keyboard input issues. No word on of the cleaning involved any spraying or wiping of the keyboard before you noticed issues, so no idea on hardware damage or accidentally triggered keyboard shortcuts.
    • Keyboard issues noted: One row non functional, some keys entering multiple times on single press, issues with capslock/shift
    • You moved the HDD to another machine, played the FLAC(s) again, and the keyboard issue started again.

    I'll be real, your immediate jump to thinking this is some sort of targeted active attack is silly. You need to isolate if the problem is with the keyboard, settings on the installed OS (specific to the drive), or after you play the FLAC file. Test one thing at a time, offline. Don't introduce additional variables. You'll also want to ensure VLC is fully updated, as a number of updates to it are security related. Embedding malware in media files isn't common, but it's much more likely than being the target of an intentional attack, or of picking up malware capable of jumping across multiple firmwares.

  • source
  • hideshow 1 child comment
  • [–] [S] 2 points 2 months ago*

    My software is somewhat standard. Plain Debian or Plain Fedora.

    I did not install any VPN software and used a generic wireguard file in network manager. I had chatted with the VPN owner who seemed nice. All VPNs involve a certain level of trust and the hack may not be related.

    The router firmware is official manufacturer firmware, SHA256 verified, that probably does have unpatched CVE vulnerabilities because they are slow with firmware updates. I've considered moving the firmware to OpenWrt to reduce attack surface since CVEs are patched more quickly with OpenWrt.

    I did not clean the keyboard at all. I do not believe I triggered keyboard shortcuts. I didn't spray anything.

    The second (bad) laptop works fine after a reboot. I do not have the second hard drive plugged into it anymore and am not playing the FLAC files. Methodically testing again seems risky as the infection seemed to start in the second laptop, but not persist after reboot and unplugging the first hard drive. I'm concerned about damaging the Fedora laptop by testing.

    I update via cron, everything was up to date in terms of packages.

    VLC was in flatpak, it would have had to escape a sandbox to get out. VLC was recently updated.

    I'm not that knowledgeable compared to someone who is a skilled hacker or developer. I've taken programming courses. I'm not that ignorant on these topics, but I'm not a real developer.

    I was working on open source software that would have made it harder to do network correlation attacks. Probably no one would have cared, because I'm no one, but I am don't know for sure. Everything about this seems implausible to me.

  • source
  • parent
  • [–] 6 points 2 months ago (3 children)

    Seems like something to do with the Operating system. Had a similar issue lately with fedora Linux where both of my laptops had I/O issues. Restarting and updating fixed the issue.

    Now it's possible that your keyboard could be going bad.

  • source
  • hideshow 3 child comments
  • [–] [S] 2 points 2 months ago* (last edited 2 months ago) (2 children)

    I can't input almost anything into the bios on Good Laptop now. The caps lock/shift problem happens in the bios too. If it was just an OS problem, it wouldn't impact the bios.

    First a Debian keyboard going bad, then immediately after I plug in the Debian hard drive into the Fedora device suddenly the Fedora keyboard starts going bad in the exact same way but doesn't survive reboot? That seems too unlikely to be just a coincidence.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 months ago* (last edited 2 months ago) (1 child)

    Process of elimination. You could try things like format the drive and reinstall the OS and using a USB keyboard on the laptop to narrow down the possible sources. Keep going until you have your answers.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 2 points 2 months ago*

    It's a decent idea, but there's risks of doing things that way.

    The Debian laptop has a damaged keyboard no matter what I do, this includes when I am using the bios, and this includes when I plug in a USB keyboard, which also seems to always have caps locked/shift held down with this laptop and certain keys not working. That suggests a damaged keyboard controller right?

    The Fedora laptop is currently working. When I plugged in the Debian hard drive in an enclosure via USB, the keyboard suddenly stopped working normally, with caps lock held down and shift held down, and then I unplugged it and rebooted.

    I can't test the Debian laptop. I already reflashed the bios and the keyboard doesn't work in that, so I know experimenting with a new OS isn't going to change anything. I also tried another OS on it and had the same problem. The Debian laptop is damaged. I have no idea where, I suspect it's a keyboard controller or motherboard firmware, but I don't know.

    If I test the Fedora laptop, I risk transferring firmware malware over that may survive a reboot, unlike last time. It could be the bios and chipset is just resistant to this attack and it will never persist. It could also be that I just noticed it quickly and it wasn't able to gain permanence, but would have done so with time.

    To test this involves a risk of damaging motherboard or chip firmware that I can't simply reset. I could test this again by plugging in the Debian hard drive into the working Fedora laptop, playing the Lana del Rey song again, and just seeing what happens. But what if this breaks the Fedora laptop too?

  • source
  • parent
  • [–] [M] 2 points 2 months ago*

    Locking for rule 5.

  • source
  • [–] 3 points 2 months ago* (last edited 2 months ago)

    I have used vibe coding

    You really need to take what I'm about to say seriously and not dismiss it offhand.

    It's possible this is AI psychosis. Don't use AI any more. At all. It's fucking with your mind. Also recommended: seek help. This is not meant as an insult. I'm really concerned for your mental health. You need to reach out to a professional.

  • source
  • [–] 1 point 2 months ago (1 child)

    Puff the magic dragon lived by the sea…

  • source
  • hideshow 1 child comment