1

I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was finishing up and I stuck around to get as many details as possible. He was on a Linux system. This codejam was labeled a "hackathon" but in reality it was just a programming event, with $10k in cash prizes on the line. Now I'm worried that I'm at risk.

I was running a Django project server on my Windows 10 machine periodically throughout the day. When the accusations of real, actual hacking were heard it turned into a murder mystery. I turned on my VPN but I have no idea if that would actually do anything. Is my computer safe? Do I have to nuke it from orbit? Excuse my naiveté, but I don't think anybody at the event saw my team as a serious threat or competition. How can I check my machine to see if there are any signs of intruder? I don't have a shell log to read.

How do I check to see if my Windows 10 machine was compromised in the time that I was on a network where other machines where allegedly compromised?

|improve this question
  • 2
    Your machine is probably as safe as it can be when you are using a network where you cannot fully trust the operator together with other persons you cannot fully trust too and their possible compromised machines - i.e. similar to any open WiFi or university network or similar. It is impossible to say from remote if your machine is compromised or how likely it would be. It is unknown what services were exposed to other machines in the network and how vulnerable these services were. It also does not matter much if you were seen as serious competition - some just try to hack systems for fun. – Steffen Ullrich Nov 11 '18 at 6:09
  • 1
    Finding evidence of compromise depends a lot on preparatory work. If you have regular backups of the whole system (disk images), it wouldn't be out of the question to inspect any changes manually. Otherwise, you'd probably be stuck with scanning your system with antimalware. There are quite a few "second opinion" scanners that may have options to increase detection at the expense of false positive rates too high for everyday use. To be 100% sure that you're not compromised without wiping would be very expensive, but maybe 99.99% would be good enough. – timuzhti Nov 11 '18 at 11:38
  • Maybe for your next "hackathon" you may want to create a virtual machine, and do all the development in that VM (with the network set to bridged so that it has a separate IP). Most of your risk at a hackathon is going to be the program you're writing, since it's not fully implemented and likely insecure at least part of the time. By doing your development in a VM you limit your risk. – Daisetsu Nov 18 '18 at 17:01
3

The short answer, yes, you're always at risk. Should you be worried? Probably not, people like to be the center of attention and be charlatans, another time try to ask for technical details, how did he know that there were a compromise of his computer, what did he do to mitigate?

If your operating system and running applications was updated, you had newly updated security definitions for Windows Defender installed and haven't disabled your firewall you're properly safe. Also try to think it about it another way - what value do you have as a target?

If you still don't trust that you're safe, I would wipe my machine. You can do many things to try to get the feeling that you're safe, but if you're machine was compromised and infected with a rootkit or similar, you would probably not find it anyway.

For Django specifically you can find their security documentation here: https://docs.djangoproject.com/en/stable/topics/security/

And current CVE's here: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=Django&search_type=all

|improve this answer
  • 1
    "what value do you have as a target?" - this is a good question but the answer is not obvious. Most users think that they are not important to attack but miss that it can be valuable for an attacker just do own as many systems as possible. The goal might not to attack the owner of these systems but to use the compromised system to attack other systems, i.e. sending spam, doing DDoS attacks or infiltrating other networks (like company networks) where the user connects to. – Steffen Ullrich Nov 11 '18 at 12:11
  • Agreed, pivoting is always a vector to consider. – Kristian Bodeholt Nov 11 '18 at 12:59
-1

How do I check to see if my windows 10 machine was compromised in the time that I was on a network where other machines where allegedly compromised?

Study computer forensics for a few years and you might have a chance. Point being: It's hard and it requires a lot of knowledge and it'll take a lot of time. If there were a simple way of checking whether a machine was compromised the world would be different.

It's in fact so hard that 99.9% of security experts don't even have a clue about it. Most security experts are concerned with preventing it in the first place and mitigate the aftermath but actually detecting compromised machines is a whole specialized field in its own.

You could start by checking the event log then checking the logs of the software you're running on then checking autostart locations then sniffing traffic to see if something generates traffic that shouldn't exist then run a few rootkit detection tools, check if new software was installed, check your browsers to see if new plugins were installed and the list goes on and on like this.

|improve this answer
  • 1
    I don't think this answer is helpful and I even doubt it is true. While there are attacks which are hard to detect even for specialists there are others with more obvious signs of a successful attack, like getting lots of advertisement (adware), draining the battery faster (crytomining), getting denied access to the system (ransomware) or getting blocked when trying to access various sites because the system has landed on a blacklist due to sending spam or similar. Most of the attacks are actually the more obvious ones. But I agree that the few details provided by the OP are not helpful. – Steffen Ullrich Nov 11 '18 at 10:53
  • It's not helpful, yes but there's not really anything "helpful" to begin with. Checking whether a system was compromised is not something you can instruct a beginner over the internet. It's too complicated for that. You could start by checking the event log then checking the logs of the software you're running on then checking autostart locations then sniffing traffic to see if something generates traffic that shouldn't exist then run a few rootkit detection tools and the list goes on and on like this. – mroman Nov 11 '18 at 11:06
  • Those are the simple things you can do but that doesn't even scratch the surface of what a professional specialized computer forensics guy can do and knows. – mroman Nov 11 '18 at 11:09
  • 1
    "Checking whether a system was compromised is not something you can instruct a beginner over the internet." - I fully agree with that. But I don't agree that only somebody who studied forensics for many years can maybe detect if a system is compromised. This might be true for sophisticated attacks but not for the more common average attacks. – Steffen Ullrich Nov 11 '18 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.