I just assume my system is hacked at all times and act accordingly.
That is the only truly secure practice.
Professionals: How do you make sure your computer hasn't been hacked?
11–20 of 32 posts
Re: Professionals: How do you make sure your computer hasn't been hacked?
#12The first step you should take is conducting a complex threat assessment. Question 1: "Am I someone a sophisticated actor (e.g. nation states) would target?" If the answer is yes, then congratulations—you're probably already compromised and will never know it. If the answer is no, then you've very little to worry about as long as you practice good security habits.
>If the answer is no, then you've very little to worry about as long as you practice good security habits.
This is very hard to define. I have all my servers on cloud locked down and can only ssh with keys (No passwords) and everytime I look at the access log, it just makes me sweat seeing all the "drive by" ssh access attempts using standard usernames (which I don't use) and even unstandard user names (like "mother", "suser" etc).
Almost like returning home and seeing unknown footprints outside your home door. You know the door is secure, the window is bolted and you have an alarm. But still it's unnerving.
Basic practices I follow:
Don't run services with a user that has root access.
SSH only with keys
Open up ports on Azure portal only for required services.
Check "last", "uptime" "htop" everytime I login.
Re: Professionals: How do you make sure your computer hasn't been hacked?
#13God(s) love(s) a try-er!
Re: Professionals: How do you make sure your computer hasn't been hacked?
#14I just assume my system is hacked at all times and act accordingly. That is the only truly secure practice.
You're being downvoted - maybe because it sounds like a snarky answer? I've thought about your response and after some thinking, I feel that it's a legitimate answer. I reflected for a moment and have decided that I am starting to do the same - using the computer with the expectation that I am not the only user. It's paranoid, but it also helps me sleep at night.
Maybe working at a large insurance company, where every keystroke could be replayed by a perfect stranger, has rubbed off on my home usage. But I come from a networking field and know perfectly well that our little home routers are not things we should rely on to be on our side. Maybe they are, but I think there's a bit of luck. A lot of planning and a bit of luck.
Re: Professionals: How do you make sure your computer hasn't been hacked?
#15On a Fedora Linux laptop, I occasionally boot from USB and verify the RPM package database.
On servers, try to have secure remote logs. Use a different administration SSH key for the log server so that even if your user account and ssh-agent was compromised the attacker can't use it to edit the logs.
Have your firewall log new connections that aren't part of normal, regular service. Especially outgoing connections from servers. If a web server suddenly starts sending email on port 25 to France, it's probably hacked.
Audit the logs for anomalies such as SSH connections from new remote IPs, etc. Or known user accounts at weird times. Why is your sysadmin coworker suddenly logging in at 4 am? Etc.
Re: Professionals: How do you make sure your computer hasn't been hacked?
#16Re: Professionals: How do you make sure your computer hasn't been hacked?
#17I just assume my system is hacked at all times and act accordingly. That is the only truly secure practice.
You're being downvoted - maybe because it sounds like a snarky answer? I've thought about your response and after some thinking, I feel that it's a legitimate answer. I reflected for a moment and have decided that I am starting to do the same - using the computer with the expectation that I am not the only user. It's paranoid, but it also helps me sleep at night. Maybe working at a large insurance company, where ever…
I was being serious even if it came off flippant.
There is no way to be 100% certain of your security with a system as complex as a computer so if you need 100% certainty then you have to assume you are compromised, even if that is a very low probability.
Re: Professionals: How do you make sure your computer hasn't been hacked?
#18reinstall.
Re: Professionals: How do you make sure your computer hasn't been hacked?
#19The first step you should take is conducting a complex threat assessment. Question 1: "Am I someone a sophisticated actor (e.g. nation states) would target?" If the answer is yes, then congratulations—you're probably already compromised and will never know it. If the answer is no, then you've very little to worry about as long as you practice good security habits.
>If the answer is no, then you've very little to worry about as long as you practice good security habits. This is very hard to define. I have all my servers on cloud locked down and can only ssh with keys (No passwords) and everytime I look at the access log, it just makes me sweat seeing all the "drive by" ssh access attempts using standard usernames (which I don't use) and even unstandard user names (like "mother"…
Have you tried/are you interested in setting a different port number on the server? Setting a different port number and using ssh_config on your clients (so you don't have to keep specifying the different port) helps a ton. I've done this with a Google 2FA solution[1] and honestly haven't seen a single rogue attempt.
----- [1] https://www.digitalocean.com/community/tutorials/how-to-set-...
Re: Professionals: How do you make sure your computer hasn't been hacked?
#20[deleted]