Do i need anti virus, firewalls etc on peppermint 2?

[john-i-am]

Hi all

Only yesterday my bank called to say i have been a victim of identity fraud to the tune of £635. It seems my debit card was used to repay a Wonga.com loan. I have no idea how my card was cloned but have to explore the possibility the details may have been stolen from some online purchases.
I was under the impression that linux based systems didn't really need firewalls etc, so never bothered. I'm running peppermint 2 and was wondering what people advise, and would it noticeably slow the system down. I love peppermint because its so fast from start up.
Any help would be appreciated,
thanks
john

[Mark Greaves (PCNetSpec)]

OK, online banking and purchasing ..

If they "cloned" your card they must have at some point had physical access to your card, and run it through a card reader .. I watched a program recently that had gangs placing false fronts on cash points .. have you recently placed your card into a cash point, entered your PIN,  but the cash point didn't give you any cash ?

I would think t more likely that it's someone that you've purchased something from (possibly online) that you've given your card details to.

Or that you've not been careful in not checking the URL for secure connections when purchasing something online .. and have been redirected to another site.
(clear your browser cache and check your hosts file)

The only other way someone could get your card details from your PC would be if you have them stored on your PC and/or a keylogger.

Best practice would be to only use a non-writeable LiveCD (or LiveUSB WITHOUT persistence) for any online banking or purchasing .. that way any malware that may be installed, browser caches, and any changes to your hosts file will be erased upon reboot.

Have you installed any software from outside the default software repositories ?

If you only install software from the default repos, and have a reasonable password it's HIGHLY unlikely this has anything to do with your Linux OS.

There is AV/anti-rootkit software for Linux, but IMHO it's pointless .. just stick to software from the default (or trusted) repositories and you're about as safe as you can be.

Your router should have a NAT firewall anyway

I *doubt* if this has anything to do with your Linux PC .. and if your card was "cloned" I'm absolutely positive (unless you have a credit card reader on your PC )

But it would still be a good idea to ONLY use a LiveCD (or LiveUSB WITHOUT persistence) for online banking and purchases.

[Mark Greaves (PCNetSpec)]

Oh .. nearly forgot.

Peppermint 2 is based on Ubuntu 11.04 so is now "end of life" and has been receiving NO security updates for a short while.

Whilst I doubt if someone has exploited a security weakness on your Peppermint 2 OS this quickly .. it may be a good idea to consider moving to Peppermint 3 which will receive security updates for 4+ years yet.

[john-i-am]

thanks mark
i am wary of using cash machines and always check for false fronts, hidden camera's etc when drawing cash. Because of my lack of knowledge with linux systems i wouldn't know how to download anything outside of the default software. My recent purchases have either been though amazon which has my details stored.

But it would still be a good idea to ONLY use a LiveCD (or LiveUSB WITHOUT persistence) for online banking and purchases.

ok, this sounds good, if only i knew what it all meant lol. could you talk me through this method in as simple terms as you can please.
many thanks,
john

[Mark Greaves (PCNetSpec)]

Has your system got a CD/DVD drive ? .. has ALL systems you may use for online banking got a CD/DVD drive ?

or do you think a LiveUSB (bootable USB stick) would be a better option ?
(be aware, older PC's may not be able to boot a USB stick)

And are you going to be creating the LiveCD/LiveUSB on a Windows PC or a Peppermint one ?

[john-i-am]

hi mark

I am using the acer aspire one, 4 years old i guess so it has no cd drive. i have an old windows machine too but i try to stay clear of it because it is real slow and clunky. My preferred choice would be a usb stick for this machine, if that is possible.
cheers
john

[Toonman]

I am using Ubuntu 12.4. I have never had any problems.  I use online banking for personal and business use as well as vat. As Mark pointed out be very careful of url's.  As well as dodgy emails asking to verify bank details etc.

[Mark Greaves (PCNetSpec)]

The following instructions are for creating a PeppermintOS Three LiveUSB (without persistence) stick using a Windows PC .. if you need instructions for creating one on a Linux PC, let me know.

On your Windows PC, download the PeppermintOS (Three) 32bit ISO image from here:
http://peppermintos.info/dl2/Peppermint-3-20121105-i386.iso
or see here:
http://peppermintos.com/download/

Once you've got the ISO image .. download Universal USB Installer (version 1.9.0.5 or higher) from here:
http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/

Start Universal USB Installer, and at ..

Step 1 .. In the drop down list, select PeppermintOS (Three)
Step 2  .. point it at the ISO image you downloaded
Step 3 .. Choose your (already plugged in >= 1GB) USB stick .. probably best to let it format it too, so backup its contents first.
Step 4 .. Set the slider to the ZERO

Heres a pic of the Universal USB Installer interface

Click Create .. and wait till it's done .. it will take a while, and *may* appear to have stopped .. but just wait till it says it's "Done" .. as in the following pic

Pic of Universal USB Installer .. Installing to USB Stick

Once the LiveUSB has been created, click Close, plug it into your AA1, then turn ON your AA1 .. as soon as you see the first screen (Acer Empowering People), hit the F12 key to access the boot device selection screen .. and select the USB HDD as the drive to boot from and hit Enter to boot.

When asked, select "Try Peppermint" not "Install Peppermint"

Be aware .. running from a USB stick will be quite a bit slower that running it from the internal SSD, but you're only going to be using it for the occaisional banking/buying.

As I said, it's unlikely Peppermint was the problem in the first place .. but this Peppermint LiveUSB will be unable to save any changes, so it will be impossible for malware to get installed and persist across a reboot.

You'll still need to be VERY careful with checking URL's in the browser .. and preferably don't go visiting any other sites besides the one you want buy/bank on first (ie. boot, open browser, go DIRECTLY to the site you want to bank/buy from).

================================================================

For even better security whilst banking/buying ..

Boot the LiveUSB you just created, and don't set up a wireless connection .. connect to your router with an ethernet cable.

--

[john-i-am]

thanks mark

like you said, my card could have been cloned while out shopping rather than online, but it's best to take all the preventive measures i can.
I will try this out and see how i get on.
many thanks
john

[john-i-am]

thanks toonman

All my recent purchases have been from amazon where my card details are stored, or the verified by visa thingy has popped up.
cheers
john