My old pc has been hacked

Ancalagon · 2019-03-04 15:28:24

Hi guys, I'm not an expert but I know that this will not be an easy topic.

I'm not living with my parents but they are using my old pc. I have arch installed on it and usually I use ssh to do things or to install some software if needed. I had an old firewall (hardware) but it broke at the beginning of february. My fault I know, but the pc was without security control, and a weak password. The pc has been hacked through ssh. I presume via brute force.

Now, I had disabled ssh and port forwarding on my router, the pc is only capable to surf the net. It's the only thing I can do because I will not be able to put my hands on the pc till saturday. Before closing the ssh port, I had tried to connect to the pc via ssh but the password had changed. Another thing, the local IP and the gateway on my old pc was changed too (I had seen this by photo). The IP has been changed to 192.168.178.199 and gateway to 192.168.178.111, and it's strange because the original ones are IP 192.168.178.2 and gateway 192.168.178.1, the router. Of course my pc wasn't able to connect to internet, cause gateway and ip combination. But it's strange. Why, someone capable of finding an ssh password (weak, ok) and my root password (hard one), will change the IP and gateway in a way that will make unusable a hacked pc? What's the point?
My real concern is what the has been made / done to the system? How can I be sure that the system is not corrupted now with some strange and dangerous software?

On saturday I will reset the root password via grub and this will be easy. But I don't know how to check my system for malware/crypto-things or dangerous things.

Thank you so much.

HalosGhost · 2019-03-04 15:41:36

If you know an attacker has gained shell access to a machine, then there's no way to guarantee it's not compromised.

Personally (and some people have, perhaps correctly, identified me as paranoid), I would not trust the machine any longer. I would replace it and recycle the hardware (after having wiped all personal data from it).

This is a great time to think about the way to secure the next machine: easy things: don't allow ssh login with password at all (use only publickey, and have your key be password-protected); rate-limit ssh login (makes brute forcing much less reasonable).

Next, consider the threat model you're attempting to protect against; if you're trying to work against the NSA, then the steps you take to secure a system are very different than attempting to fend off botnets and automated port scanners.

Perhaps consider using lynis; it's in the repos and scans a linux system to make security suggestions; don't really look at this until you've figured out who you're defending against (a lot of its recommendations are unreasonable for most threat-models).

All the best,

-HG

schard · 2019-03-04 15:41:58

If you do not have copies of each and every file or at least their checksums and also a copy of the bootsectors of the disks in the PC, there is no way you can be sure, that you find all possible manipulations and backdoors.
Your only option is to completely re-install the system then, and, to be on the safe side, shred the boot sectors of all disks.

Trilby · 2019-03-04 15:43:01

Ancalagon wrote:

The pc has been hacked through ssh. I presume via brute force.

There is absolutely no evidence of this presented in your post. Nine times out of ten when someone says this, they are completely wrong. The tenth time, they are only partially wrong.

In fact, there is virtually no concrete information in your post whatsoever just interpretation, and wild speculation.
You do provide the local IP addresses, but only the values, and nothing about how those values were obtained (no commands nor verbatim output).

EDIT:

Ancalagon wrote:

But it's strange. Why, someone capable of finding an ssh password (weak, ok) and my root password (hard one), will change the IP and gateway in a way that will make unusable a hacked pc? What's the point?

Yes, it is strange. And it's evidence (admittedly weak) against your hypothesis about what has actually happended. But given that there is absolutely zero evidence for your hypothesis, this bit against it should bury it: there is no reason to think your were "hacked". Something went wrong, yes. So tell us about that something with actual diagnostic details and concrete facts, and maybe we can help fix it.

An alternative hypothesis (also with no evidence to back it yet, but it's far more parsimonious): something went wrong with your parent's router (perhaps even just a power outage) and/or the service provider changed something on their end. This resulted in a new range of local IP addresses being assigned, and in turn potentially your inability to shell into the machine.

Last edited by Trilby (2019-03-04 15:52:15)

HalosGhost · 2019-03-04 15:43:43

schard wrote:

If you do not have copies of each and every file or at least their checksums and also a copy of the bootsectors of the disks in the PC, there is no way you can be sure, that you find all possible manipulations and backdoors.
Your only option is to completely re-install the system then, and, to be on the safe side, shred the boot sectors of all disks.

Note that (and, again, this may be my paranoia) there are exploits on lower-level hardware (such as hard drive buffers and firmware) that schard's comments would not save you from. It is unlikely that a random attacker has leveraged these tools (as they can be a huge pain to actually use), but they do exist.

Trilby wrote:

Ancalagon wrote:
The pc has been hacked through ssh. I presume via brute force.
There is absolutely no evidence of this presented in your post. Nine times out of ten when someone says this, they are completely wrong. The tenth time, they are only partially wrong.

I would also like to take a moment to second this. As I said above, if you're actually positive that an attacker has achieved shell access, then there are steps to take. But I too find this situation somewhat unlikely.

Moving to Newbie Corner.

All the best,

-HG

seth · 2019-03-04 15:51:26

I will carefully side w/ the parrot inspector here. You assume you're trying the same system on a different IP w/ a different password, but what is more likely is that it's a different system or your approaches have failed because it got a different lease (and IP) and that doesn't match the port forwarding.
Get HW access first, don't boot the system but use eg. a live distro specialised on forensics (or just grml) to inspect the system offline, in particular whether the password (hashes) have actually changed.

On a general note (and bear w/ my swearing): password access over the internet is a HUUUUUGE no-no. Switch to a public key auth in any event and asap.

Ancalagon · 2019-03-04 16:09:07

Thank you for all your answer. I know that something can go wrong with services and configuration, but how can a root password change it alone without a direct event? My parents are not able to launch a terminal and my previous configurations are static, so the local IP of the machine theoretically can't change alone

seth · 2019-03-04 16:12:37

It cant, except for a broken disk and some really bad luck.
However: how exactly have you confirmed that the root PW changed? You said also the PW for the ssh login changed, so you cannot log into that system to inspect it, can you?
The router lease table can very well collide w/ the desires of a client, that's not a proof of anything.

Trilby · 2019-03-04 16:14:50

Again saying the root password changed is an inference. Post actual facts (commands and their output) not your inferences.

Not being able to open a terminal (whatever that means) is not evidence of the root password changing. Being at a getty or similar login prompt and entering "root" and "yourpassword" and getting a "login incorrect" response would certainly be suggestive, though not entirely conclusive. It's also possible that the caps lock was on, or there was a keyboard error, or - as Seth mentioned - a disk error affecting the storage of the root password. None of these require that the root password has been deliberately changed by an attacker.

Last edited by Trilby (2019-03-04 16:17:56)

Arch Linux

#1 2019-03-04 15:28:24

My old pc has been hacked

#2 2019-03-04 15:41:36

Re: My old pc has been hacked

#3 2019-03-04 15:41:58

Re: My old pc has been hacked

#4 2019-03-04 15:43:01

Re: My old pc has been hacked

#5 2019-03-04 15:43:43

Re: My old pc has been hacked

#6 2019-03-04 15:51:26

Re: My old pc has been hacked

#7 2019-03-04 16:09:07

Re: My old pc has been hacked

#8 2019-03-04 16:12:37

Re: My old pc has been hacked

#9 2019-03-04 16:14:50

Re: My old pc has been hacked

Board footer