My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections through my router or ISP. Reviewing my event logs, it looks like a certificate was installed/updated when I was away from my computer (It was in sleep mode). Should I delete all of the certificates and regenerate them? Is this possible or necessary?

Also, are there any signs that data recovery might have been performed on a hard drive? I noticed many of my system files have modified times that can't be explained because I was away from my computer at those times. I ran a malware and rootkit scan and everything appears to be fine. Firewall also appears to be fine.

  • 4
    How do you know your system was accessed by an attacker? Could the Windows Update or some other maintenance process have run and modified the date/time stamps? You seem to be very certain of an attack; do you have any more information that supports this? Can you post the event logs to pastebin and share the link? How could we know if there are signs of data recovery on your system? All we see is your post here, we have no information except your post. Please review this: security.stackexchange.com/help/how-to-ask – 0xSheepdog May 25 '17 at 18:17
  • @0xSheepdog how do I renew all of my certificates? – victim May 25 '17 at 18:44
  • Which local certificates? The windows certificates identifyong your system to an Active Directory domain? The web browser embedded CA public certificates? I get the sense you arw asking for answers to questions you dont cometely understand. That is why I started with "how do you know you have been compromised?" That could help us determine what the actual issue may be. – 0xSheepdog May 25 '17 at 18:48
  • @0xSheepdog I meant the trusted root certification authorities that can viewed from the Microsoft management console. – victim May 26 '17 at 4:00
  • Do you know which specific cert was updated? And what was changed? – Mike Goodwin May 29 '17 at 20:25

If you think an attacker has had unauthorised access to your system, the only way to be sure that you've removed the infection is to rebuild the system completely from trusted media.

Whilst you may have seen an event log entry relating to certificates there's no way to know whether other changes have been made which are not in your logs.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.