2

My laptop have been hacked a few months ago and my data is being to uploaded to some remote server without my knowledge.

Is there a way I can find it out and prevent it from happening?

I have changed my hard disk and installed a new distribution but its not helping. I have installed some applications like wireshark but I am not able to pin point the applications and prevent it from uploading my data to server.

Is there any application which would pin point the application which is uploading my data.

  • blog.serverdensity.com/80-linux-monitoring-tools-know has a lot of monitoring tools. I'd say look into netstat and lsof. Unfortunately though, product recommendations are off-topic here. – forest Nov 5 '18 at 9:07
  • 2
    How do you know your "data is being to uploaded to some remote server"? That detail might help narrow in on an answer. – schroeder Nov 5 '18 at 10:20
2

To get a crack at this one would have to correlate traffic generated with processes that are running on the machine. A real life example could be a break-in I had a few years ago into a Linux box (PLD). A process was running on the machine called dd_ssh and the corresponding file was located in /tmp. The machine was generating a ton of traffic, and basically it became a zombie for sending spam. The trick was to:

  1. Use some network dumping software (like tcpdump) to identify the traffic being generated.
  2. Use netstat -punt to identify the PID of the process that is generating the traffic (the last column contains the PID/name of the process).
  3. Use ps to pinpoint the process and the corresponding file.

That way you will identify the traffic → process → file relation, eventually finding the culprit.

2

I think your friends on this case are wireshark + lsof + netstat, by mastering these tools i'm sure you can identify the application that is uploading your data.

  • 1
    Wireshark is pretty... heavy for monitoring network activity by application. Complete packet captures should only be done when you have a very specific target. Not to mention, it's quite insecure when it comes to untrusted input. What you'd really want to do is just netstat and lsof, and leave out Wireshark. – forest Nov 5 '18 at 9:05
  • 1
    Or, to add to @forest comment, use tshark and script the capture filter to only grab packets from the source port identified by the other detection mechanisms – schroeder Nov 5 '18 at 10:18
  • @forest I had tried wireshark and etherape already, will try netstat and lsof... Thanks.. – Som Nov 5 '18 at 10:33
0

I would recommend trying out these network sniffers.

  1. Wireshark (pro tip: filter ip.addr == "<server-address>")
  2. Netspoof-ng
  3. EtherApe

If you're unable to pin down what application is uploading data, you can check netstat -a, isof.

  • 3
    The OP says they tried sniffers and sniffers will not tell you which application is sending. – schroeder Nov 5 '18 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.