4 ms·
I'm not going to answer how I go about detecting infestations, because I don't want my techniques to become useless. However, I'll depart some knowledge on how
by nandesu 9y ago
I'm not going to answer how I go about detecting infestations, because I don't want my techniques to become useless. However, I'll depart some knowledge on how to better protect yourself.
1. Get familiar with your router.
- Find it's logs and look for anything weird incoming or outgoing that you know isn't you.
- Keep your firmware updated.
- Learn how to configure the firewall.
2. Get the most powerful machine you can afford and run a from the metal hyper visor. Make all your everyday OS installs be virtual machines or containers and be vigilant about keeping an eye on what's running on them.
4. On Linux
- Learn the "top", "ps", and "netstat" commands.
- After initial install of the OS, setup Tripwire.
- Pay attention to CERT alerts and try not to be one of the suckers that installs the various honeypot malware.
- Be concerned more with patches then Uptime (If the OS tells you it needs to be rebooted when you login, reboot the damn thing ASAP with respect to your maintenance windows).
4- OS X.
- Same as Linux, except OS X doesn't really virtualize so great. Apple really hasn't taken the time to stream line their code base when it's being run virtualized. Maybe performance will be okay on the new iMac Pro just as an effect of the Hardware overkill. Your milage may vary.
5- On Windows.
Windows is an entirely different level of complexity. However, it does virtualize very well and Microsoft has made many optimizations for it especially if you use Hyper-V.
The key here is backups. Seriously. You need to create snapshots after the initial install and if you really need to run some kind of shady freeware application, or scammy application to get your music onto your iPhone without iTunes, spin up a completely new windows VM, install all that crap in there, and when you are finished, trash that VM.
- Keep the windows defender updated and run a full scan weekly.
- Learn Task Manager
- Install SysInternals and learn what is going on in your system. https://technet.microsoft.com/en-us/sysinternals/bb842062.aspx https://technet.microsoft.com/en-us/sysinternals/bb842062.as...
- everdayimhustln 9y agoSamhain is less well-known but superior to TW, AIDE and OSSEC. (I've deployed both FOSS and commercial TW.) http://www.la-samhna.de/library/scanners.html http://www.la-samhna.de/library/scanners.html http://www.la-samhna.de/samhain/s_faq.html http://www.la-samhna.de/samhain/s_faq.html
- ralphc 9y agoMy router is supplied by UVerse so firmware updates are out of my hands. Should I run my own router off of the UVerse one?