0

I recently had a security breach on my PC, I ran a software called thaiphoon burner and DRAM calculator despite my windows warning. Long story short while I do not know if they are directly responsible, all my anti virus programs, including avira, windows defender were all uninstalled without a trace right after I ran the two programs mentioned above.

I have formatted and reinstalled my windows 10 (with a usb drive that was once connected to it so I don't even know if it's safe), backed up my files on a HDD that I still don't know how to recover, but what concerns me more is, even if my current system is safe, can hackers / malware obtain other information about me/my network that makes future hacking/cyberattack easier?

Namely, could it be possible that the malwares I had executed had collected information about my network, so that now my entire network is in some sense "compromised" to a point where no computers connected to my network is safe? And any information trafficked on network is compromised?

Improve this question

1 Answer 1

Reset to default
2

To some extent, yes, I'd worry that any devices that were connected to your network at the time your PC was running malware, might also be infected by something. Take backups and monitor for suspicious behavior going forward on all your devices attached to your network. Make sure they are all up-to-date and have malware protection enabled. But, if you are not on a corporate network or high-security network, I would not worry about network infrastructure mapping or anything that may have taken place.

What I would worry about, indeed my primary concern, would be compromise of any passwords or accounts that may have been stored on or accessed from your computer. Do you have any saved passwords in your browser? Use a password manager? Log into any websites while the malware was active? Assume all such passwords are compromised. Go change all your passwords on all websites you may have accessed immediately. If you reuse a password anywhere, change your password anywhere it is used, regardless of whether you accessed that specific site on that computer.

My other worry would be a persistent ransomware infection or something that is waiting in the background, biding time, in order to wipe out your backups before striking. Reformatting is probably enough for that but be sure to take a backup of all your devices, and save to disconnected storage that would be inaccessible to any ransomware. But I think your online account security should be your first concern an this point.

Improve this answer
4
  • I don't save any passwords online, I remember them by head. I have activated 2 factor authentication on all my accounts where that's avalable, what are the risks if I haven't changed my passwords? How would my device affect other devices that were connected to my network?I had an iphone, ipad, and macbook connected to the network at the time. If we go with the assumption that all malwares/viruses have been removed from my PC, and assuming none of my other devices were infected should I be concern about any other network security breach from that event?
    – Ecotistician
    Commented Apr 28, 2020 at 19:33
  • If you logged into any online services while your PC was infected, it could have stolen your password with a keylogger. Additionally it may have stolen a session token or created an oauth token it could use in the future. Those might even be able to bypass 2FA. 2FA will decrease your risk significantly where used, but especially if one of the compromised accounts is a recovery email for other accounts, an attacker may be able to get past it. Since you remember your passwords in your head, I highly suspect you either re-use passwords or follow a predictable/guessable (by a computer) pattern...
    – Ben
    Commented Apr 29, 2020 at 17:01
  • ...so you'll need to change passwords on other accounts as well to prevent password stuffing attacks. As for other network-attached devices, consider the havoc that the NotPetya worm caused. It first had to get on a network, but once it was on a network, which took some doing, it spread rapidly by using EternalBlue to spread to other devices on the same network. Many times a local network is in a more "trusted" position than the wider Internet, with more services exposed, etc. and open to attackers on a local network. Alternatively, there are exploits that require close physical proximity, ...
    – Ben
    Commented Apr 29, 2020 at 17:07
  • ...such as attacks that exploit vulnerabilities in WiFi device driver's or the Bluetooth stack. Attacks such as these often require you to be attached to the same WiFi network or paired with a device over Bluetooth, but at the very least you'd need to me in physical range of the WiFi or Bluetooth antenna to send exploit packets. Your PC being compromised gives the attacker a beachhead on your network, within physical range of your devices, if it has WiFi or Bluetooth capability. Such attacks are rare but probably not unheard of. Like I said I'd be more worried about your online accounts.
    – Ben
    Commented Apr 29, 2020 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .