[SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

homepod · 2019-08-02 15:20:29

After an add with a warror was played on youtube(in regards to Games of Thrones v3m.uuzu.com), it fired a pid called RDD Process which was taking up 50% of the processeor speed. I've killed it immediately.

Process Name RDD Process
User - 

Status Zombie
CPU 67%
Started today 13:03
CPU Time 7:38.74

Command Line /usr/lib/firefox -contentproc -parentBuildID 20190720144906 -prefsLen7503 -prefMapSize 181422 -greomni /usr/lib/firefox/omnji.ja --appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 12579 true rdd

To my understanding is a cookie which mines crypto.

I've discovered it after 7 hours

How to stop it?

Last edited by homepod (2019-08-02 16:55:41)

ewaller · 2019-08-02 18:23:34

If you exit firefox, does the zombie process go away?
When you restart firefox, does the process start again?

If the answers are yes, no I would say you are okay.

homepod · 2019-08-02 20:37:07

ewaller wrote:

If you exit firefox, does the zombie process go away?
When you restart firefox, does the process start again?
If the answers are yes, no I would say you are okay.

If I exit, the PID dissapears yes. But it is fired only when that particular add appears. i was trying over and over again. Apparently some infosec experts classified it as a virus, which affects millions of machines worldwide.

Be aware of that!

I've installed an add-blocker and switched to epiphany which has less capabilities reading flash.

Trilby · 2019-08-02 22:21:31

homepod wrote:

... which has less capabilities reading flash.

Flash? Really? Do you need flash for anything?

I do all sorts of things on the web, and have had no need for flashplugin/player/etc for years.

loqs · 2019-08-02 23:52:00

https://bugzilla.mozilla.org/show_bug.cgi?id=1506291 It is sandboxing for the media decoder process.

homepod · 2019-08-03 08:37:43

Trilby wrote:

homepod wrote:
... which has less capabilities reading flash.
Flash? Really? Do you need flash for anything?
I do all sorts of things on the web, and have had no need for flashplugin/player/etc for years.

Sometimes I play videos from youtube or I watch TV

homepod · 2019-08-03 08:41:46

loqs wrote:

https://bugzilla.mozilla.org/show_bug.cgi?id=1506291 It is sandboxing for the media decoder process.

Oh well to my understanding, this sandbox bug is exploited by cryptominers at least

homepod · 2019-08-03 09:20:14

A quick fix to this is to go to about:config in firefox and disable media.rdd-process.enabled whoever created this sandbox didnt think through the implications thus allowing 3rd parties to exploit your CPU.

loqs · 2019-08-03 11:29:34

Could the process not just be stuck in a loop wasting CPU due to a bug rather than being hijacked?

Trilby · 2019-08-03 12:43:09

Youtube does not use/require flash. Nor does hulu, amazon prime video, netflix, nor any other commonly used service that I'm aware of. There are some old browser games that still use flash, but I'd be hard pressed to even find other websites that do. Flash is dead: major browsers will not even have options to enable flash within the next year.

homepod · 2019-08-03 12:59:27

loqs wrote:

Could the process not just be stuck in a loop wasting CPU due to a bug rather than being hijacked?

First, I take it as a security break. Why would someone add somethign which does nothing but highjacks CPU?

Of course this could be a bug but at the same time someone might try to open a door to your computer.

Arch Linux

#1 2019-08-02 15:20:29

[SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#2 2019-08-02 18:23:34

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#3 2019-08-02 20:37:07

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#4 2019-08-02 22:21:31

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#5 2019-08-02 23:52:00

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#6 2019-08-03 08:37:43

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#7 2019-08-03 08:41:46

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#8 2019-08-03 09:20:14

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#9 2019-08-03 11:29:34

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#10 2019-08-03 12:43:09

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

#11 2019-08-03 12:59:27

Re: [SECURITY] RDD Process (firefox Cookie) taking up 50% of processor

Board footer