I have been falling prey to cyber attacks for the better part of a couple of years. I live in a townhouse and am pretty sure the punk who is doing it is literally ten feet away from my equipment separated only by a couple sheets of drywall. I abandoned Windows and have been using nothing but Linux for the last four months so I'm still a noob. The last time I repaved my mini PC I hardened it using usg fix cis_level1_workstation. I blacklisted the modemmanager as I know it was used against me at one point. I blacklisted the bluetooth module and all its dependencies. I even blacklisted all modules related to Wifi. Here's the real kicker after doing all that, and more, I never even connected it to a switch or router (no internet connection). I think I made a mistake by trying to use the NIST tables instead of the UFW. I also usually use a Yubikey but there was an update that made it not work which I have now solved on my Linux Mint laptop. I created two users: the sudo user which I hid from the login screen and a regular user. I only ever logged in as the regular user and never once used the sudo user in my home. One morning the Trigkey G4 mini PC I was running Ubuntu 22.04 wouldn't boot. The power button would not even light up. After going through Trigkey's support I reset the CMOS and was able to make it boot. I guess I am looking for some advice on if there is anything I can do to keep this dip tard out of my system. I am planning on resetting the BIOS and having a look if I can disable any of the wireless hardware from there this time. I am also going to purge all files related to wifi, bluetooth, and the modem manager.
I'm planning on going back to using the UFW and definitely getting my Yubikey working with it again. I'm wondering if perhaps there are any experts here that could provide me with any extra steps I can take (I've probably left a few out). Oh yeah, in an attempt of preventing the 'how do you know it was a hack' which would take too much time to explain here is a sample of a system log I was able to pull from the box once I got back into it (in case anyone is wondering the only thing I was doing with it was watching the Star Wars animated show Clone wars with my eight year old son). I have other logs as well and am going to run RLinux6 on it to see if I can recover anything he may have tried to hide via file deletion but I suspect I will find nothing. It really sucks having to listen to your son cry because of what a cyber bully has been doing to us for years.
Mar 8 15:14:11 systemd-journal: Journal stoppedMar 8 15:14:11 kernel: Sending SIGTERM to remaining processes...Mar 8 15:14:11 kernel: Syncing filesystems and block devices.Mar 8 15:14:11 systemd: Shutting down.Mar 8 15:14:11 snapd: overlord.go:515: Released state lock fileMar 8 15:14:10 systemd: Stopped Thermal Daemon Service.Mar 8 15:14:09 thermald: terminating on user request ..Mar 8 15:14:08 systemd: Stopped ACPI event daemon.Mar 8 15:14:08 NetworkManager: <info> [1709928848.8389] exiting (success)Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for NetworkManager-dispatcher.service/start is destructive (umount.target has 'start' job queued, but 'stop' is included in transaction).Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for NetworkManager-dispatcher.service/start is destructive (umount.target has 'start' job queued, but 'stop' is included in transaction).Mar 8 15:14:08 systemd: Stopped WPA supplicant.Mar 8 15:14:08 dbus-daemon: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.nm-dispatcher.service': Transaction for NetworkManager-dispatcher.service/start is destructive (umount.target has 'start' job queued, but 'stop' is included in transaction). Mar 8 15:14:08 systemd: wpa_supplicant.service: Deactivated successfully. Mar 8 15:14:08 dbus-daemon: [system] Activating via systemd: service name='org.freedesktop.nm_dispatcher' unit='dbus-org.freedesktop.nm-dispatcher.service' requested by ':1.6' (uid=0 pid=535 comm="/usr/sbin/NetworkManager --no-daemon " label="unconfined") Mar 8 15:14:08 NetworkManager: <info> [1709928848.8174] caught SIGTERM, shutting down normally. Mar 8 15:14:08 systemd: Stopping WPA supplicant... Mar 8 15:14:08 (sd-pam): pam_unix(systemd-user:session): session closed for user philipheroux Mar 8 15:14:08 systemd: Reached target Exit the Session. Mar 8 15:14:08 pulseaudio: After module unload, module 'module-null-sink' was still loaded! Mar 8 15:14:08 dbus-daemon: [system] Activation via systemd failed for unit 'rtkit-daemon.service': Transaction for rtkit-daemon.service/start is destructive (shutdown.target has 'start' job queued, but 'stop' is included in transaction). Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (shutdown.target has 'start' job queued, but 'stop' is included in transaction). Mar 8 15:14:08 dbus-daemon: [system] Activating via systemd: service name='org.freedesktop.RealtimeKit1' unit='rtkit-daemon.service' requested by ':1.120' (uid=1001 pid=1174 comm="/usr/bin/pulseaudio --daemonize=no --log-target=jo" label="unconfined") Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (nftables.service has 'stop' job queued, but 'start' is included in transaction). Mar 8 15:14:08 dbus-daemon: [system] Activating via systemd: service name='org.freedesktop.RealtimeKit1' unit='rtkit-daemon.service' requested by ':1.119' (uid=1001 pid=1174 comm="/usr/bin/pulseaudio --daemonize=no --log-target=jo" label="unconfined")Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (proc-sys-fs-binfmt_misc.automount has 'stop' job queued, but 'start' is included in transaction). Mar 8 15:14:08 dbus-daemon: [system] Activating via systemd: service name='org.freedesktop.RealtimeKit1' unit='rtkit-daemon.service' requested by ':1.118' (uid=1001 pid=1174 comm="/usr/bin/pulseaudio --daemonize=no --log-target=jo" label="unconfined") Mar 8 15:14:08 systemd: Received SIGRTMIN+20 from PID 6533 (plymouthd). Mar 8 15:14:08 dbus-daemon: [system] Activation via systemd failed for unit 'rtkit-daemon.service': Transaction for rtkit-daemon.service/start is destructive (systemd-poweroff.service has 'start' job queued, but 'stop' is included in transaction). Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (systemd-poweroff.service has 'start' job queued, but 'stop' is included in transaction). Mar 8 15:14:08 dbus-daemon: [system] Activating via systemd: service name='org.freedesktop.RealtimeKit1' unit='rtkit-daemon.service' requested by ':1.117' (uid=1001 pid=1174 comm="/usr/bin/pulseaudio --daemonize=no --log-target=jo" label="unconfined") Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (systemd-tmpfiles-setup-dev.service has 'stop' job queued, but 'start' is included in transaction). Mar 8 15:14:08 systemd: Requested transaction contradicts existing jobs: Transaction for rtkit-daemon.service/start is destructive (systemd-tmpfiles-setup-dev.service has 'stop' job queued, but 'start' is included in transaction). Mar 8 15:14:08 systemd: Stopped Daemon for power management. Mar 8 15:14:08 systemd: upower.service: Deactivated successfully. Mar 8 15:14:08 systemd: Stopped GNOME Display Manager. Mar 8 15:14:08 systemd: gdm.service: Deactivated successfully. Mar 8 15:14:08 systemd: Stopped Switcheroo Control Proxy service. Mar 8 15:14:08 systemd: switcheroo-control.service: Deactivated successfully. Mar 8 15:14:08 systemd: Stopped Power Profiles daemon. Mar 8 15:14:08 systemd: power-profiles-daemon.service: Deactivated successfully. Mar 8 15:14:08 systemd: polkit.service: Consumed 1.693s CPU time. Mar 8 15:14:08 systemd: Stopped Authorization Manager. Mar 8 15:14:08 systemd: polkit.service: Deactivated successfully. Mar 8 15:14:08 systemd: Stopped Accounts Service. Mar 8 15:14:08 systemd: accounts-daemon.service: Deactivated successfully.Mar 8 15:14:08 gdm3: Gdm: Freeing conversation 'gdm-password' with active job Mar 8 15:14:08 gnome-session-c: Couldn't connect to session bus: Error sending credentials: Error sending message: Broken pipe Mar 8 15:14:08 systemd: Started Restart DBus after GNOME Session shutdown. Mar 8 15:14:08 dbus-update-act: dbus-update-activation-environment: error: unable to connect to D-Bus: Did not receive a reply. Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. Mar 8 15:14:08 systemd: Stopped target Shutdown running GNOME Session. Mar 8 15:14:08 pipewire: Asked to handle disabled watch: 0x5620ba4d0880 19 Mar 8 15:14:08 systemd: Stopping PipeWire Multimedia Service... Mar 8 15:14:08 systemd: Stopping PipeWire Multimedia Service... Mar 8 15:14:08 systemd: Stopped target GNOME Shell. Mar 8 15:14:08 systemd: Stopped target GNOME Session is initialized. Mar 8 15:14:08 systemd: Removed slice User Background Tasks Slice. Mar 8 15:14:08 systemd: Stopped Application launched by gnome-session-binary. Mar 8 15:14:08 systemd: org.freedesktop.IBus.session.GNOME.service: Consumed 1.120s CPU time. Mar 8 15:14:08 systemd: Stopped IBus Daemon for GNOME. Mar 8 15:14:08 systemd: Stopped Application launched by gnome-session-binary.Mar 8 15:14:08 systemd: app-gnome-update\x2dnotifier-2651.scope: Consumed 1.144s CPU time. Mar 8 15:14:08 systemd: Stopped Application launched by gnome-session-binary. Mar 8 15:14:08 systemd: Stopped Virtual filesystem service. Mar 8 15:14:08 systemd: Stopped GNOME Wacom tablet support service. Mar 8 15:14:08 systemd: Stopped GNOME power management service. Mar 8 15:14:08 systemd: Stopped GNOME keyboard shortcuts service. Mar 8 15:14:08 systemd: Stopped GNOME keyboard configuration service. Mar 8 15:14:08 systemd: Stopped GNOME color management service. Mar 8 15:14:08 systemd: Stopped Virtual filesystem metadata service. Mar 8 15:14:08 systemd: Stopped Portal service (GTK/GNOME implementation). Mar 8 15:14:08 systemd: xdg-desktop-portal-gtk.service: Failed with result 'exit-code'. Mar 8 15:14:08 systemd: xdg-desktop-portal-gtk.service: Main process exited, code=exited, status=1/FAILURE Mar 8 15:14:08 systemd: Stopped Portal service (GNOME implementation). Mar 8 15:14:08 systemd: xdg-desktop-portal-gnome.service: Failed with result 'exit-code'. Mar 8 15:14:08 systemd: xdg-desktop-portal-gnome.service: Main process exited, code=exited, status=1/FAILURE Mar 8 15:14:08 systemd: Stopped Tracker file system data miner. Mar 8 15:14:08 systemd: Stopped Service for snap application snapd-desktop-integration.snapd-desktop-integration. Mar 8 15:14:08 systemd: Stopped Portal service. Mar 8 15:14:08 systemd: Stopped Evolution address book service.Mar 8 15:14:08 systemd: Stopped Virtual filesystem service - Apple File Conduit monitor.