Hi.
I have open this topic because i need help. I think that i have been hacked. And the reason is that there is a password in Sys-net ( in my system is called sys-ethernet) and It has been changed. I tried to conect to internet and I could not do it because the system did not accept the usual password. I installed it several months ago and i have been using this password several times without problems until yesterday, when suddenly it did not work.
Before my questions, I would like to explain where the o.s. is installed
System.
I installed qubes 4.2.1 in an usb pendrive of 256gb.
It works trough an Acer aspire 5 with 32gb of ram.
I use a netgear nighthawk m1100 router and I conect it to the computer with a usb hub with an ethernet connection. The wifi in this router is disconnected. But it worked before when i used it in a different configuration with different devices.
I do not know how the attack was done. But i consider different options:
1.someone had access to my computer / usb, and through a brute force attack they hacked the decryption phrase and the password system. To after that change the sys-ethernet password. I do not have neither an easy password nor an easy decryption phrase. But everything is possible.
- I downloaded some malware program by mistake. I do not think so because besides balena etcher and a couple of tools, i have not download anything weird and when i download anything i use a fully volatile qube and the tools are installed on a qube without connection to sys-firewall.But as i said everything is possible.
- I infected the system, uploading a file from a pendrive. When i transfer files from / to a qube. I always do it from a fully volatile qube to a qube without ethernet connection. So technically none of them have acces to sys-ethernet.
- The attack came from the netgear router.as i said the router wifi is not connected but it was connected when i used it in a different configuration with different devices.
Questions:
- How bad can the damage be? My sys-ethernet has a vpn in it.so i do not know if the hacker had access to what i did online.
- If the attack was from the router how far could the attacker go? He/she could go beyond the firewall?
- Could the hacker had access to the whole system if it was uploaded from an usb to a qube without connection to sys-ethernet
- As i use a pendrive connected to a computer based on windows. Could a malware jump from windows to qubes? This question sounds quite silly but i would like to ask it. I am not an expert.
Regards
