Am I hacked? Help on how to know and protect myself

[mjolnir]

I have done that a hundred times, I've always installed the firewall before connecting it doesn't matter. XP, Vista, using Mcafee, Norton, Zonealarm none of these work.

[gogalthorp]

You should really have a hardware firewall in a separate router configured paranoid, even if you only have one computer. You might also checkout AppArmor It comes with Suse and it protects applications from changes by outside sources.You can find help in th help center.

[Themer]

Can you not simply request a new IP from your ISP???

[mjolnir]

I know i'm a noob, but I guess I know alot less than i thought. I thought your ip is unique to your computer, ill go to site a like grc.com and it will show my ip and if i use a different computer that will have a unique ip also. Where am I wrong?

Is this normal:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 ::1:631 :::* LISTEN
tcp 0 0 ::1:25 :::* LISTEN
udp 0 0 0.0.0.0:32768 0.0.0.0:*
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 0.0.0.0:5353 0.0.0.0:*
udp 0 0 0.0.0.0:111 0.0.0.0:*
udp 0 0 0.0.0.0:631 0.0.0.0:*

[Dapper Dan]

Looks fairly tight to me. SuSE might have these ports open by default. Every distro is different in this way.

Port 25 is for email traffic, port 631 is for cups printer traffic and port 111 is for NFS. If you aren't using any of these services, you could close them, or at least the ones you won't use. I suspect 25 is open because you are downloading your mail from a server. Do you have a printer set up on this machine? Read this about NFS. You might not need it at all. If not, use SuSE's firewall or ports configuration utility to close it. A really good "GUI" tool to manage Linux firewall is Guarddog.

[Themer]

usually if you type "ifconfig", it will tell you all you need to know. I'm pretty sure that unless you pay for a static IP from your ISP, it will change every now and then, and they can also give you a new one. It doesn't change very often, but it might occasionally, and you can definitely just request a new one. I'm not sure how to do it on wireless - that's what I have, but on a wired connection ifconfig will tell you.

EDIT: oh, and DHCP vs. staticis not the same thing as what I'm talking about. Your true IP will be unique, but your 192.168.xxxxx whatever wil be just unique on your LAN.

[Dapper Dan]

To add to what Themer suggests, a router is a good idea, even if there is only one box on it. Within your router are options to release and renew IP's from the ISP. You can also configure a router to deny outside ports to computers on the LAN even if those computers have that port open. Also, in administrator mode, you can check incoming and outgoing logs to see if there is something amiss...

Can you give us concrete details on exactly why you think you are being invaded, either on Linux or Windows? If you can, then specific solutions can be applied to specific problems.

[Samsara]

Out of curiosity, if you're getting weird issues that don't seem to be hacker related in SuSE, could it also be that the issues you are having in Windows are due to the same non-hacker realted issue? Are you paying for a static IP Address? If not, then this n00b at least ("this n00b" being me) would not expect you to still have that same IP address now.

[Themer]

True - they can stick with you for sometimes a couple months, or sometimes more than a year or 2, but if it's been over about 1 year I would doubt that you still have the same one. And like I've said before, multiple times, you can just go into your router and request a new IP - it takes about 1 minute at the most and is fairly simple.

[abreck]

If you are that worried about windows security on the net.. another thing I would recommend is installed suse fresh as stated before. If you have windows apps that you MUST use... there here is what I would do.

Install VMware or use the free VirtualBox bundled with suse 10.3. Install XP or your flavor of windows as a virtual machine. Disconnect the network options from you virtual install of windows.

This way you are in LInux. but you can work in Windows worry free. Also, your files will be stored in a virtual harddrive that is not just leaving things out for the world to see.

If you need resources off the net,, then minimize your virtual install and do your browsing.

I prefer VMware for this because it makes things extremely simple to drag and drop items from your linux desktop into your VM desktop.

In my opinion, this is the most secure way to use windows. I simply have a VM of xp for those pesky programs that don't like WINE or Crossover.