Now everyone can take advantage of AI, how do we protect our computers?

General
, , ,
1

The problem

Sadly, as my earlier article today showed, anyone, including criminals can easily use AI to ‘crack’ our PC’s, and obtain our banking details etc.

AI-driven attacks automate phishing, malware generation, exploit chaining, and
social engineering at near-zero cost. Realistic adversaries: supply-chain
compromise (AUR/malicious packages), credential phishing, drive-by browser
exploits, malicious attachments, and remote exploitation of networked services.

What Can We Do ?

Written for Arch Linux, but the same principles apply. So far I have installed AIDE, and now I have a BASELINE of this machine stored offline for regular use.

Unfortunately the AIDE-PC homepage is in French, fortunately my AI reads French :slight_smile:

The advantage of a known CLEAN PC

1 Establish a Trusted Baseline Now

Because the machine is uncompromised, capture a verified-clean state.

  • Full disk encryption (LUKS) — if not already in place, back up data and
    reinstall with LUKS-on-root. Prevents offline modification if stolen.
  • dm-verity / AUR trust anchors — record hashes of critical binaries.
  • AIDE (extra/aide) — initialise its database now, store it read-only or
    offline, run periodic integrity comparisons.
  • Arch ISO verification — always verify the ISO PGP signature
    (gpg --verify) before any reinstall.
  • Package snapshot — pacman -Qe > clean-state.txt for later comparison.

2 Lock the Package Supply Chain (Highest Arch-Specific Risk)

AUR is user-contributed and the primary Arch attack surface. AI can trivially
create malicious-looking PKGBUILDs.

  • Read every PKGBUILD before building; never makepkg -si blindly.
  • Prefer official repos (core, extra) over AUR.
  • pacman.conf set SigLevel = Required DatabaseOptional TrustedOnly.
  • Pin a small set of trusted HTTPS mirrors.
  • Run pacman -Qkk periodically via pacman-contrib.
  • Subscribe to https://security.archlinux.org/ advisories.
  • Remove AUR helpers that auto-update without review.

3 Reduce Network Attack Surface

  • Firewall — nftables or ufw: default deny incoming, allow outgoing only
    on needed ports.
  • Disable unused services: systemctl list-unit-files --state=enabled, audit
    each.
  • If SSH is required, use key-only auth, non-standard port, fail2ban, and
    tunnel over WireGuard / Tailscale.
  • MAC randomisation on Wi-Fi; disable Bluetooth when unused.
  • Browser hardening — LibreWolf + uBlock Origin (medium mode) + NoScript +
    arkenfox prefs; disable WebGL/JS where feasible; separate profiles for
    banking vs general browsing.
  • DNS over HTTPS/TLS — systemd-resolved or stubby pointed at a trusted
    resolver.

4 User & Access Control

  • Separate daily (non-wheel) and admin accounts; sudo requires password.
  • sudo hardening:
    Defaults timestamp_timeout=0
Defaults use_pty
  • Lock root: passwd -l root.
  • PAM limits (/etc/security/limits.conf) resource caps against fork-bombs.
  • 2FA for sudo — pam_u2f (YubiKits dead easyey) or pam_totp. Defeats credential
    phishing, a major AI vector.
  • Strong disk passphrase + recovery key stored offline.

5 Kernel & Userspace Hardening

sysctl (/etc/sysctl.d/99-hardening.conf):

net.ipv4.tcp_syncookies=1
kernel.kptr_restrict=2
kernel.dmesg_restrict=1
kernel.unprivileged_bpf_disabled=1
kernel.yama.ptrace_scope=2
fs.protected_hardlinks=1
fs.protected_symlinks=1
  • AppArmor — kernel cmdline apparmor=1 security=apparmor, install
    apparmor, enable apparmor.service, load profiles for major daemons.
  • linux-hardened kernel (AUR — review PKGBUILD).
  • CPU microcode — intel-ucode / amd-ucode.
  • Disable SUID on unused binaries: find / -perm -4000.
  • Run untrusted apps (browsers) in bubblewrap or Flatpak with restricted FS
    access.

6 Malware / Integrity Detection

  • ClamAV — signature scanning for downloads/attachments.
  • rkhunter / chkrootkit — periodic rootkit scans.
  • AIDE — daily cron comparison (strongest integrity signal).
  • USBGuard — whitelist known USB devices; blocks malicious USB attacks.
  • auditd — watches on /etc/passwd, /etc/sudoers, /usr/bin.

7 Backups & Recovery

  • Borg / restic — encrypted, client-side, offline external drive + remote.
    Immutability beats ransomware (AI-generated ransomware is real).
  • 3-2-1 rule (3 copies, 2 media, 1 off-site, 0 connected by default).
  • Test restore quarterly.
  • Verified Arch ISO on USB stick for bare-metal rebuild.

8 Behavioural OpSec

  • Treat all emails, DMs, “password reset” links as suspicious — AI phishing is
    now indistinguishable from genuine.
  • Never run scripts from the web without reading them.
  • Keep pacman -Syu current — staying patched is the single best exploit
    mitigation on a rolling release.
  • Use a password manager (keepassxc or pass) with unique random passwords.
  • Separate “admin” and “general” browser profiles / accounts.

9 Tool Reference

Area Tool
Disk encryption LUKS / cryptsetup
Integrity AIDE, Tripwire, pacman -Qkk
Firewall nftables, ufw
MAC AppArmor
Audit auditd
USB control USBGuard
Backups Borg, restic
2FA pam_u2f, YubiKey
Rootkit scan rkhunter, chkrootkit
AV ClamAV
Browser LibreWolf + uBlock + arkenfox
Passwords KeePassXC, pass
VPN WireGuard
Kernel linux-hardened

Priority Order

  1. Verify clean baseline + AIDE snapshot (do this first while uncompromised).
  2. Full disk encryption (LUKS) — biggest single win.
  3. Strict pacman.conf SigLevel + AUR review discipline — Arch-specific top risk.
  4. Firewall + disable unused services.
  5. Browser hardening + YubiKey 2FA on sudo.
  6. AppArmor + sysctl hardening.
  7. Offline encrypted backups + tested restore.
  8. Ongoing: weekly pacman -Syu, monthly AIDE compare, monthly rkhunter.