How do you find out if an adversary has remote access to your computer?

What's kind of strange about your question goes to - who are you and who wants your stuff? Are you a human rights activist travelling to Tibet? Are you a Falun Gong supporter in the US? Are you a Snowden supporter in the US? Are you a journalist for a major newspaper that leaks embarrassing things about Senators? Are you a normal guy who doesn't trust their brother's friend or the babysitter?

  • who is the 'adversary' (and therefore what are their resources and what can they do to you)

  • how much might you have hypothetically trusted this adversary in the past, or someone or some group that they could have controllled,

  • do you think that this adversary could hide things in places where you couldn't usually look with commercial off the shelf or homemade tools?

  • do you have a way to compare before/after snapshots of either the whole system or many parts of it to ensure integrity

  • is your adversary so powerful that they could embed remote access such that even a wipe/reinstall of the OS would not be enough to ensure that they are kept out, and long term, could not get right back in?

So, some hints here. If your adversary is something like the NSA, and they can control Microsoft, and Microsoft has been effective at getting motherboard level chips in place like TPM chips which hold secrets from the user and even parts of the OS, and in the past malware has run in everything from graphics cards to other chipsets besides your CPU and has exploited signed drivers running at kernel level, totally evading all this antivirus and so on -- well you are super duper hosed.

If your adversary is the NSA, and you are using Gmail on a Chromebook, same deal.

If your adversary is the NSA, and you are using a Macbook with Mac OS X and FileVault and doing all the good things. You are still pwned.

Is your adversary the 'evil maid' (a roommate?) who's had an hour alone with your PC up and booted in a live state, with your account logged in?

Dude, a beginner will never spot the things someone could be doing to you.

Even an expert would hardly HARDLY be able to tell if someone was an intruder on their system.

If you even suspect intrusion, and require security, wipe and rebuild and consider carefully if that's actually enough to stop whoever it is you think is your adversary.

/r/AskNetsec Thread