Fakc Windows Defender scam...
A Fake Windows Defender Attack on a Linux Computer
I had an interesting little computer-security experience this morning that may be worth describing, particularly for people who use Linux.
My main computer is an HP Z840 workstation running Ubuntu MATE Linux. I happened to have Chromium open to Facebook when a small popup appeared in the lower-right corner of the screen.
It looked very much like one of the Facebook/Messenger-type notifications I occasionally see. There was a button associated with a message along the lines of “You have a notification...”
I clicked it.
That was apparently a mistake.
Almost immediately, things started getting strange. Windows and pieces of text were flashing or changing so quickly that I couldn't get a good look at most of them. Among the fragments I managed to read were messages along the lines of:
Windows Defender has determined that your computer...
and:
We have determined that your computer needs to be shut down and are shutting it down...
Eventually the display became effectively locked on one of these warning screens. I couldn't regain normal control of Chromium or the desktop, and finally shut the Z840 down by holding the physical power button until the machine powered off.
After restarting it, everything appeared completely normal.
I have subsequently been using the Z840 normally for hours without seeing any further problems.
The Interesting Part: This Isn't a Windows Computer
There is one fairly obvious problem with the warnings I was receiving:
There isn't any Windows on this computer.
The Z840 runs Ubuntu MATE.
So “Windows Defender” had most definitely not examined my operating system, discovered some catastrophic problem, and decided to shut down my computer.
The warnings were fake.
What I apparently encountered was a browser-based fake Windows Defender or tech-support scare page.
These things can use ordinary browser capabilities—JavaScript, full-screen displays, repeated dialogs and notifications—to create the appearance that the operating system itself has been compromised.
In reality, the browser may be the only thing that's actually misbehaving.
The Initial Popup May Be the Important Part
The most interesting aspect of the incident was how it started.
The original popup did not look like some gigantic flashing warning saying:
CLICK HERE TO DESTROY YOUR COMPUTER!
Had it looked like that, obviously I wouldn't have clicked it.
Instead, it appeared in the lower-right corner of the screen and looked enough like an ordinary Facebook or Messenger notification that I clicked the button without giving it much thought.
Modern browsers allow websites to send desktop notifications. Unfortunately, malicious or deceptive sites can abuse this feature. A notification can be designed to resemble a legitimate message, system notification or security warning.
That makes checking browser notification permissions worthwhile.
In Chromium, this page can be reached directly by entering:
chrome://settings/content/notifications
Any unfamiliar websites listed as being allowed to send notifications should be removed or blocked.
It is also worth checking:
chrome://extensions
to make sure there aren't any browser extensions present that you don't recognize.
Did Linux Save Me?
Possibly—but with an important qualification.
The scare page itself clearly worked perfectly well under Linux. It only needed Chromium to create a convincing illusion that something terrible was happening to the computer.
But if the people behind the page intended eventually to install a Windows executable or some other Windows-specific malware, Ubuntu would have presented them with a fairly substantial problem.
A malicious Windows .exe file does not simply become an Ubuntu Linux program.
On the other hand, many of these operations don't actually need to install malware automatically. The objective may simply be to frighten the victim into doing something:
calling a fake Microsoft support number;
downloading remote-access software;
providing passwords or credit-card information;
paying somebody to “repair” a computer that isn't broken.
So I can't say that Linux definitely stopped a Windows malware infection. It is entirely possible that there never was an automatic malware payload in the first place.
Still, there was something rather amusing about watching a fake Windows Defender screen solemnly informing an Ubuntu Linux workstation that Windows had discovered a terrible problem.
What I Should Have Done Instead of Pulling the Plug
Holding down the power button worked, but it isn't the nicest way to shut down a Linux computer. An abrupt power loss always carries some risk of filesystem corruption.
If something similar happens again, the first thing I'll try is:
Alt+F4
which may simply close the offending Chromium window.
If the browser has the desktop effectively locked but Linux itself is still functioning, another possibility is:
Ctrl+Alt+T
to open a terminal, followed by:
pkill chromium
That should kill Chromium without having to shut down the entire computer.
Bottom Line
As far as I can determine, the Z840 itself was never compromised.
The most likely explanation is that I clicked a deceptive browser notification that opened a fake Windows Defender/tech-support scare page. The page managed to make Chromium sufficiently obnoxious that it appeared, temporarily, as though the entire computer had been taken over.
After rebooting, Ubuntu came back normally and the workstation has continued operating without any unusual behavior.
The experience does suggest three useful rules:
Don't assume a desktop-looking notification actually came from the application it resembles.
Periodically check which websites have permission to send browser notifications.
If a web browser claims that Windows Defender has discovered a catastrophic Windows problem on an Ubuntu Linux machine, there is probably considerably more wrong with the warning than with the computer.