Hello, I need to help a friend who is about to buy a new notebook. Before I post my question I have to shortly explain the background:
the problem is my friend's brother: a medium-advanced user (currently studying programming&co.) who just can't stay without having total control of 100% of the electronic devices inside his house (and not only that).
If there is a notebook that everyone uses, he takes it and installs keyloggers and RATs; he wants always to know all the family's passwords, does things on other's mobile phones etc.
Seeing a PIN-protected Windows 10 he would just google around for methods to bypass the lock and then doing his shit;
What would probably happen to my friend is just that the brother waits her to fall asleep, powers on her new notebook, fills it with loggers and some other shit, and then just shut it down like nothing happened.
And now the question.
There are lots of threads about protecting a notebook from the outside attackers, but what about protecting it from the inside? I told my friend to just unbox her new notebook with me without letting her brother touch it before I touch and protect it very well against her brother, because he just wouldn't resist the arrival of a new notebook at home without he putting his hands and control on it because everything must stay under his control.
Have some ideas? How would you protect your PCs from yourselves? From someone who would google bypass for win10 protection methods and administrator privileges, give infected pendrives to her sister without she knowing and this kind of things? What should I do to protect a notebook from someone who has 24h access to it?
Thank you
The best idea would be to get a Linux notebook. These might be hard to find (or even impossible) so the best option would be to buy a good notebook, format it and install Ubuntu on it.
Or.. never thought I would've said this since it is overpriced shit: a Macbook (it's harder to get viruses on it since it's Linux)
Linux would be the hardcore option because I think she wouldn't be very happy knowing that she is on a linux distro and a linux distro is not windows, even with Ubuntu being very user friendly she would still need Windows programs that she would know can be emulated but generally setting things up and running windows programs on ubuntu would be harder.
If it was for me I'd installed it..
Unfortunately I need to protect a Windows notebook
While for the Macbook, price range is limited (around € 700) so she can't consider that option, but thanks
Using linux with LUKS encryption and making sure the password is strong and not written anywhere or tails would be secure, but thats a option that only advanced users should do.
I as well suggest you look into linux for this situation... There are plenty of alternatives to running windows applications on linux from wine to crossover. Crossover is one of the better options for handling windows applications under linux.
What about HD encryption?
I have never used it, but if it requires a password that can't be easily cracked at every boot it would make the notebook easier to protect
Anyways I thank you all for the answers and I'll try to talk her about some linux distro but I think some combination of encryption utilities, strong antivirus (just for pendrives&co because it could always be bypassed) and correct windows accounts privileges would be better
On my laptop I have the choice to disable any USB port and any other inputs. Best way to secure something is to not allow others to plug something into that device. At the same time you should also ensure that block can be protected physically or virtually. physically can be placing the laptop into a small safe or secured briefcase.
DO NOT DEAL WITH THIS MEMBER
Apr 30, 2017 04:56 PM
(This post was last modified: Apr 30, 2017 05:00 PM by Not Your Average Orange.)
I'd say Linux or DeepFreeze.
DeepFreeze is a software that is constantly taking pictures of your config files, and at every reboot your computer returns to it's previous state, which means that you can't download anything with it on.
It requires a master password however it can be bypassed by going into BIOS and setting the date +60 days.
With the premium version a separate drive is created with the space of your choice, whatever you put in it stays for the next reboot.
http://www.faronics.com/products/deep-fr...nterprise/
If you want HD encryption try veracrypt.
https://veracrypt.codeplex.com/wikipage?...20Tutorial
Since it's a netbook it probably has secureboot and all that nonsense. Which in that case VeraCrypt wouldn't be much help unless you were okay with booting the bios in legacy mode. So instead you should upgrade to windows 10 pro and use BitLocker. Then in the battery settings make the computer hibernate every time the lid is closed or if you are away from longer than 10 minutes etc. Deepfreeze is a good option that someone mentioned earlier, however, it does cost a bit of money. There are a few free alternatives that work just as well like Reboot Restore RX. Disabling usb ports is a good idea too. Another important thing to do is password protect your bios settings and make sure you turn off boot from usb/cd drives.
DO NOT DEAL WITH THIS MEMBER
(Apr 30, 2017 05:46 PM)SIM-1980240 Wrote: Since it's a netbook it probably has secureboot and all that nonsense. Which in that case VeraCrypt wouldn't be much help unless you were okay with booting the bios in legacy mode. So instead you should upgrade to windows 10 pro and use BitLocker. Then in the battery settings make the computer hibernate every time the lid is closed or if you are away from longer than 10 minutes etc. Deepfreeze is a good option that someone mentioned earlier, however, it does cost a bit of money. There are a few free alternatives that work just as well like Reboot Restore RX. Disabling usb ports is a good idea too. Another important thing to do is password protect your bios settings and make sure you turn off boot from usb/cd drives.
Lol, I just got shut down.
Not to forget physical security. Lock the laptop up in some locker. Any computers accessed can be manipulated.
protect bios
protect harddrive
protect usb poorts
and ur gg
Vouch
(Apr 30, 2017 04:06 PM)SIM-3257834 Wrote: On my laptop I have the choice to disable any USB port and any other inputs. Best way to secure something is to not allow others to plug something into that device. At the same time you should also ensure that block can be protected physically or virtually. physically can be placing the laptop into a small safe or secured briefcase.
This is important, true, we'll manage something for this, thank you
(Apr 30, 2017 04:56 PM)Not Your Average Orange Wrote: I'd say Linux or DeepFreeze.
DeepFreeze is a software that is constantly taking pictures of your config files, and at every reboot your computer returns to it's previous state, which means that you can't download anything with it on.
It requires a master password however it can be bypassed by going into BIOS and setting the date +60 days.
With the premium version a separate drive is created with the space of your choice, whatever you put in it stays for the next reboot.
http://www.faronics.com/products/deep-fr...nterprise/
If you want HD encryption try veracrypt.
https://veracrypt.codeplex.com/wikipage?...20Tutorial
I didn't know Deep Freeze and it seems very interesting, I'll do some research because it seems very useful, thanks
(Apr 30, 2017 05:46 PM)SIM-1980240 Wrote: Since it's a netbook it probably has secureboot and all that nonsense. Which in that case VeraCrypt wouldn't be much help unless you were okay with booting the bios in legacy mode. So instead you should upgrade to windows 10 pro and use BitLocker. Then in the battery settings make the computer hibernate every time the lid is closed or if you are away from longer than 10 minutes etc. Deepfreeze is a good option that someone mentioned earlier, however, it does cost a bit of money. There are a few free alternatives that work just as well like Reboot Restore RX. Disabling usb ports is a good idea too. Another important thing to do is password protect your bios settings and make sure you turn off boot from usb/cd drives.
Ok so no VeraCrypt but BitLocker instead, I'll just have to check if the Win10 version is Home or Pro
Reboot Restore RX is worth a look
While for the BIOS I think this is very important and I never thought about this before, this is one thing I'll do for sure, thank you
(Apr 30, 2017 09:26 PM)Elweth Wrote: Not to forget physical security. Lock the laptop up in some locker. Any computers accessed can be manipulated.
Yeah I think it would be hidden somewhere, I would warn my friend about this, with many protections I could just slow the brother but not stop it so better hide the notebook
(Apr 30, 2017 09:29 PM)XeCheats Wrote: protect bios
protect harddrive
protect usb poorts
and ur gg
Password for the bios
BitLocker for the HD
Disabling USB/DVD boot from BIOS
I just have to manage a way to protect USB ports without totally disabling them, a Pendrive may always be needed
Like a password before reading the pendrive or something
Without reading the pendrive no file can be transported phisically and locking internet access with another password there shouldn't be a way to phisically activate a keylogger and discover all the passwords
But this only if possible, I'll have to personally look for ways to realize this idea
You all gave me many ideas, thank you all very much 😎
|
