Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to get my PC to the service because sometimes the system hangs and suddendly reboots without any reason. Anyway, I will create a test user if they want to start the computer. Moreover I think about making a check of the file system before I brought and after I will get my PC back. I thought about a "#ls -alR > before.txt" out of the root directory. After I will get my PC back, I'll do the same and compare both files with the "diff" command (Maybe they have tried to install some crap). Is there a better solution for this?

share|improve this question
up vote 1 down vote accepted

ls -lR / would only tell you what the repair service did without trying to hide their tracks at all. If they want to install a trojan horse, they'll just use non-standard tools that don't use the normal channels to access the filesystem.

You should also run find / -xdev -type f -exec sha512sum {} + >before-checksums.txt. This stores a cryptographic checksum of every regular file. If the repair service modifies the files, it will show on the checksums. The boot sector is also vulnerable; keep a copy of it, as well as the first sector of every partition: for x in /dev/sda*; do head -c 512 <"$x" >"${x##*/}.sector1".

Even that might not be protection against a really determined and knowledgeable attacker. A cryptographic checksum of the whole disk would be but it would simply not match if they did as little as boot from the disk (which would update the filesystem's last mount time, write some log entries and so on).

When you retrieve the computer, make sure to boot from a live CD/USB and not from the system you get back, since if the system has been rootkitted the kernel will likely report original versions of the files and not the actual disk content (but will use the disk content to install some kind of backdoor during boot).

Of course, if they decide to read any private data on the disk, you won't know.

Why don't you just take the disk out?

(And hope they don't install a trojan firmware, for example on the motherboard (BIOS) or on the network card.)

share|improve this answer
Hello, it's difficult to take the disc out because I have a 2x1Terrabyte RAID 1 and I'd rather not want to tinker around on it. But your tipp was very helpful, thanks. – Bevor Nov 11 '10 at 7:31

If by "solution" you mean "having my system clean after I get it back from the service", it might be wise to consider making an image and restoring it afterwards - that way, you would be sure it's in the state you left it.

Also, you mention installing - if you make that user non-sudo, they would not be able to install anything anyway.

The method you suggested should work pretty well otherwise.

share|improve this answer
If they have physical access, it doesn't matter what permissions you give them, they can install whatever they want without leaving any trace that you'd see in-system. – Gilles Nov 10 '10 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .