Data Preservation






Online Security



Go through your password manager and see if you're re-using passwords across multiple accounts, or should add 2FA to any accounts. Maybe 2FA is newly supported on some account that didn't have it before.

If you have a PIN on your phone account, to prevent SIM-swapping, call your provider again and try to make a change, and see if they actually do ask for the PIN.

Check that auto-updating is working for your operating system, browsers, anti-virus, VPN. Are you using just about the newest version of each ? Check that updates have not changed privacy settings back to defaults.

If your Android phone is old and not getting updated any more, consider buying a new phone, or flashing a custom ROM (not easy; see Android Custom ROMs section of my Android page).

Is your ISP updating your router's firmware ? You may have to write down the current version and check every 6 months or so.

For each of your simpler devices (TV, IP camera, printer), do some internet searches for "exploit/vulnerability/hack/problem MANUFACTURERNAME model NNN".





Virus / Malware



When was the last time you ran an anti-virus scan ?

Testing your Anti-Virus

+/-
EICAR Standard Anti-Virus Test File
Fortinet's "Test Your Metal" (browser fetches bad files from server, see if firewall or AV etc stops it)
Atomic Red Team

Web site that does various tests: AMTSO Security Features Check Tools
Where to get virus samples, to check your AV ?
MalShare
TekDefense
VirusShare.com
MalwareBazaar
theZoo
greg5678 / Malware-Samples (Linux only)
Packet Storm's "Unix rootkits" (have to compile some from source)
VirusTotal Private/Premium API

Keylogger:
Run a test program that does keylogging and see if your software detects/stops it:
Mike Williams' "How to test anti-keylogger software"
SpyShelter's "Security Test Tool"

Install a real keylogger and see if your software detects it:
Windows:
Spyrix Free Keylogger
Revealer Keylogger Free
StupidKeylogger
Linux:
lkl, uberkey, THC-vlogger, PyKeylogger, logkeys.


Malware Removal






Accounts





Check your status in a bank-account-monitoring service:
ChexSystems' "Consumer Disclosure"
LexisNexis' "Accurint Individual Access Program"
[I requested my LexisNexis report. 42 pages, much of it repetitive. It showed 2/3 of the addresses I've lived at, and one address that was wrong. A boat that I had owned, but none of the cars I owned. None of my bank accounts or my credit card. Nothing about school or employment history.]
[Sent an opt-out request to LexisNexis, and got a response (paraphrased): "Your request is approved and in process. Note that your info will remain in the following services: restricted public records products available to commercial and govt entities that meet credential requirements and are used to detect and prevent fraud, enforce transactions, perform due diligence and other critical business and govt functions; products regulated by the Fair Credit Reporting Act, third-party data available through real-time gateways; news; legal documents."]





Network and Device Security



Test browser and your computer's network configuration

+/- Linux Security's "Security Tools"
See "Security Testing" section of my "Linux Controls" page



How to tell if you've been hacked

+/-
In general, look for changes or suspicious activity (past and present) in your devices, your network, your online accounts, and your offline accounts. A lot of work.

Have you received any strange messages about password resets or new accounts created ? Are you unable to do a password reset, or to get emails or SMSs from some site ? Also think back: have you done anything risky or unusual recently ?

Look first for simple mistakes. Is the password-reset email ending up in the Spam folder ? Did you misspell your email address or give the wrong phone number to a site ?

Check email accounts carefully. Are you able to log in ? Has anyone added blocking or filtering or forwarding rules, or a new alias, or a new folder ? What is in the Sent, Spam, Trash folders ? Do you have 2FA enabled ? Do you use the same password anywhere else ?

Look at login/access histories on your machines and accounts. Some sites have a "logout all devices that are logged in right now" button.

Check the lists of apps installed on your computer or phone. Check the lists of third-party apps with access to your online (Facebook, email) accounts. Check the lists of add-ons in your browsers. Any that you weren't aware of ?

Sometimes, the damage will be obvious: most files deleted, or files encrypted and names changed to something like "filename.lock" and you get a ransomware note.

WikiHow's "How to Know if You've Been Hacked"
Adam Levin's "How To Tell If You've Been Hacked (And What To Do About It)"
Pixel Privacy's "How to Tell If You Have Been Hacked"
Cale Hunt's "How to tell if your PC has been hacked"
Roger A. Grimes's "15 signs you've been hacked"

TechIncidents' "Penetration Testing Cheat Sheet For Windows Machine - Intrusion Detection"
SANS Institute's "SCORE Security Checklist" (PDF)
meirwah's "awesome-incident-response"
How-To Geek's "How to See What Web Sites Your Computer is Secretly Connecting To"

General tools for analyzing what's happening in Windows:
Microsoft's "Windows Sysinternals"
Sandro Villinger's "5 ways to see what's going on in your Windows server system right now"
Mark Russinovich's "TCPView"

For Linux, see "Monitor what's happening in your system" section of my "Using Linux" page

Micah Lee's "It's Impossible to Prove Your Laptop Hasn't Been Hacked. I Spent Two Years Finding Out."


If ransomware, ID Ransomware



What to do if you've been hacked

+/-
What was hacked and how was it hacked ? This is key. If hacked through password re-use, that tells you one set of things to do (password manager, change passwords, enable 2FA on key accounts). If it was a SIM-swap, that says do another set of things (check other accounts with that number, maybe change number, put PIN on the support account at your phone-provider). Through malware on your device, that says do another set of things (scans, install anti-virus, check that software is updated, maybe re-install whole system, stop downloading dodgy stuff).

If the damage to your system is clear and not really targeted, maybe just cleaning (with malware remover and AV) and scanning is good enough. If damage is extensive, probably factory-reset and re-install the whole system. If you were targeted by someone sophisticated or determined, maybe sell the system and buy a complete new one.

Leo Notenboom's "Email Hacked? 7 Things You Need to Do NOW"
Leo Notenboom's "Facebook Hacked? What You Need to Do NOW"

If ransomware, isolate the machine and do backups before trying any decryptors; some supposed decryptors are malicious.



Port scanning and router testing:

+/-

First, deliberately create a suspicious situation:

+/-
To deliberately create an open port on your computer (to see if your testing catches it), on Linux run "netcat -4 -k -l -v PORTNUM" (IPv4 TCP) or "netcat -6 -k -l -u -v PORTNUM" (IPv6 UDP) or similar. Use port number 22 (SSH) or 80 (HTTP) if it should be closed in your system; that open port should be caught by any tester.

You could log into the administration page of your router and temporarily enable something bad, such as PnP. Just don't forget to turn it off again later.

Testing network (mainly router) from WAN side:

+/-
Usually you run a browser on your machine, access one of these web sites, and then the site server tries to get into your home network using your IP address.

Turn off your VPN to use these.


Also, you could set up a machine somewhere on the public internet to test your network (mainly, router) from the WAN side.

From StackExchange's "Best way to test my home network from the outside":
+/- If you decide to perform a scan from the Internet you may want to give your ISP a heads-up to avoid any trouble.

I run scans on my home IP from a Linode account [virtual Linux box on a cloud service]. Any VPS that doesn't filter your outbound traffic should work (just make sure it doesn't violate your TOS).

First run a full scan against your home IP address. Expect to find only the ports you know you have explicitly opened open. Expect everything else to be "filtered".

Then verify that it is your home router that is performing the filtering and not your ISP. To do this, open a port on your router and rerun the scan. Expect that the port you have opened is detected as open by your scanner. If you find that you still see this port as filtered, then your ISP may be blocking that port. If so, this isn't necessarily a problem, but it means that the previous test didn't test your router, it tested the network connection to your router. Don't forget to disable the port when you're done.

If you want to test your router in isolation, and your router isn't built in to the modem, then you can test it as follows:
  1. Disconnect the router from your modem. (Where "modem" is whatever device connects from your LAN to your ISP's network.)

  2. Connect a second computer to the WAN port on the router. Configure this computer with a static IP address that is independent of the LAN addresses used by your router.

  3. You may need to turn on a DHCP server on the second computer so that the router's WAN interface gets an IP address as usual.

  4. Perform the scans described above from the second computer.



Testing router from inside (LAN side):

+/-
You run a browser or other app on your machine, and try to access ports on the LAN side of your router, from across the LAN.

Assuming router's LAN IP address is 192.168.0.1:

These should give 404 or nothing or "unable to connect" or login page:
192.168.0.1/HNAP1
192.168.0.1/cgi-in/config.exp
192.168.0.1/cgi-bin/export_debug_msg.exp
192.168.0.1/cgi/ cgi_status.js
192.168.0.1/ BRS_netgear_success.html
192.168.0.1/ /cgi-bin/;echo$IFS'Vulnerable'
192.168.0.1:32764 (backdoor on some routers)
192.168.0.1:19541
192.168.0.1:8080
192.168.0.1:8443
192.168.0.1:7547 (TR-069 or CPE WAN Management Protocol (CWMP))
192.168.0.1:23 (Telnet)
192.168.0.1:2323 (Telnet)
192.168.0.1:80 (HTTP)
192.168.0.1:443 (HTTP)
192.168.0.1:443 (HTTPS)

If you have nmap:

nmap -F 192.168.0.1

# increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, probe for service version info,
# use default script, do all ports, address 192.168.0.1
nmap -v -A -Pn --open --reason -sV -sC -p 1-65535 192.168.0.1

# increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, do all ports, address 192.168.0.1
sudo nmap -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -p 1-65535 192.168.0.1
If TCP port 139 (netbios-ssn) is open outbound, that is to allow "NetBIOS services on MS hosts". Probably best to turn it off, unless you're sure you need it.

If TCP port 445 (microsoft-ds) is open outbound, that is to allow "direct TCP/IP MS Networking access without the need for a NetBIOS layer". Probably best to turn it off, unless you're sure you need it.

Port 1900 is PnP; that should not be open.
Android app: "UPnP Tool" by TJ App.

If TCP port 5060 (SIP) is open outbound, probably that is to allow VoIP or video-conferencing, such as Zoom. Probably okay in the outbound direction ?

For other open ports, do internet searches to find out what they're used for.

Depending on open ports, you could try:

ftp -v 192.168.0.1
ssh -v admin@192.168.0.1
ssh -v root@192.168.0.1
ssh -v Root@192.168.0.1
telnet 192.168.0.1
If test from LAN side gives suspicious results, go to previous section and investigate from WAN side.

Testing IPv6 from LAN side

+/-
Your PC's IPv6 localhost address: [::1]
Same address written fully: [0000:0000:0000:0000:0000:0000:0000:0001]
Real IPv6 address on public internet: [2600::] (Sprint)

There is no standard IPv6 LAN address for the router, equivalent to 192.168.0.1 in IPv4. IPv6 addresses on your LAN are used on the WAN too, so your router's IPv6 address has to be assigned by your ISP.

IPv6 addresses starting with FC00 or FD00 are LAN-only.

Depending on your /etc/hosts file, IPv6 names may include: ip6-localhost, ip6-loopback, ip6-allnodes, ip6-allrouters, or similar starting with "ipv6-" instead of "ip6-". Try "ping6" to them.

If you have nmap:

# not sure these are right, I have IPv6 disabled so I can't test them !

# IPv6, increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, no DNS resolution, probe for service version info,
# use default script, do all ports, address ::1
nmap -6 -v -A -Pn --open --reason -n -sV -sC -p 1-65535 ::1

# IPv6, increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, no DNS resolution, do all ports, address ::1
sudo nmap -6 -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -n -p 1-65535 ::1

Android apps to test network (clients and router) from LAN side:


PC applications to test network (clients and router) from LAN side:

+/-
You run one of these apps on your PC, and use it to scan your LAN for vulnerable machines or open ports.


PC applications to beat on a single device (client or router):

+/-
You run one of these apps on your PC, and give it the LAN IP address of a single machine you want to attack.


Browser to test a single device:

+/-
Testing webcam / security camera from inside (LAN side)
+/-
Assuming camera's LAN IP address is 192.168.0.100:

192.168.0.100 /err.htm
192.168.0.100:10554
192.168.0.100:81
192.168.0.100:23 (Telnet)
192.168.0.100:2323 (Telnet)
192.168.0.100

If test from LAN side gives suspicious results, investigate from WAN side.

Testing networked printer from inside (LAN side)
+/-
Assuming printer's LAN IP address is 192.168.0.100:

192.168.0.100:23 (Telnet)
192.168.0.100:2323 (Telnet)
192.168.0.100
Probably ports 9100, 631, 515 will be open on the LAN side; this is normal. But they shouldn't be exposed on the WAN side.

If test from LAN side gives suspicious results, investigate from WAN side.




Lee Munson's "Penetration testing for the home computer user"
TechIncidents' "Penetration Testing Checklist with Android, windows, Apple & Blackberry Phones"
Online Tech Tips' "How to Scan Your Network for Devices and Open Ports"
SpiceWork's thread "How can I pen test my own network?" (more about business networks)
Router Security's "Test Your Router" (also cameras, printers, etc)
Paul Wagenseil's "Your Router's Security Stinks: Here's How to Fix It"





Online Privacy



Test

+/-

Minimize the number of things you use:

+/-
Do you really need to use:
  • Each add-on you have installed in your browser ?
  • Each app you have installed on your phone ?
  • Each app you have installed on your computer ?
  • Each app you have allowed to access your Facebook account ?
  • Each app you have allowed to access your email account ?
  • Each social media site you use ?
Every one of these is potential point of failure, a thing that could be stealing and selling your data, or accidentally having a security vulnerability.



Painful things: Maybe every few years, change your email address, phone, phone number, credit card number ? Maybe do a factory-reset of your phone, or a fresh OS install on your computer ? Change to a different internet service provider (ISP) ?



Review my Computer Security and Privacy page and see if you can make some improvements in various areas.





Do a periodic check and cleanup



Idea: scanner app:
+/-
It would be nice to have an app that did a very quick scan of your system, reported any sensitive apps or conditions, and suggested that you check their settings to make sure they're secure and updated. Maybe report:
  • Remote-control apps (Teamviewer, VNC, X2Go, AnyDesk, NoMachine, et al).
  • Apps that backup/syncing to somewhere else (Dropbox et al).
  • Apps/services that handle incoming traffic (web server et al).
  • Network file-shares.
You might even find things you forgot were installed, or you never knew were installed or active.

In Linux *buntu:

EGREPLIST='vnc|^vino|x2go|remmina|^rclone|^rsync|dropbox|megasync|^xrdp|odrive|nextcloud|^xpra|vinagre|krfb|nomachine|teamviewer|anydesk|guacamole-server|guacd|gnome-user-share|mate-user-share|vsftpd|^samba/|^apache2/|^httpd/|^nginx/|openssh-*server'
apt list | egrep -i ${EGREPLIST} | grep installed

# If you find a "suspicious" apt/deb package:
apt show PKGNAME
ls -l /var/lib/dpkg/info/PKGNAME.list 	# see when installed

snap list | egrep -i ${EGREPLIST}
# If you find a "suspicious" snap image:
snap info IMGNAME

flatpak list | egrep -i ${EGREPLIST}

sudo docker image ls | egrep -i ${EGREPLIST}

sudo ps -eo comm | egrep -i ${EGREPLIST} | grep -v grep

# Some specific apps:
xpra list
xpra info

lsmod | grep -i ^nfs







This page updated: March 2021