Stalking/Harrassment

I have reason to believe I have been hacked. In particular, a certain group of people posted lots of images from my phone, and revealed knowledge of my location. I assume they got such information through iCloud or some sort of exploit related to that. What is more concerning is that these people sent messages to me directly related to things I was doing IRL, while my phone was in my pocket. For example, they mentioned things related to personal conversations that I had, and in real time. For example, I talk to someone in real life about xyz topic, and these people begin sending me messages about xyz a minute or two later. It happened enough times that I am certain it can't be mere coincidence. For these reasons, I am fairly certain my phone is compromised. Does anyone know of how such a thing is possible? These people would never have had physical access to my phone. Is there some way to remotely install monitoring software on an iPhone (not jailbroken). I have looked into it and found a lot of websites selling software that claims to be able to do so (mspy, iKeymonitor, Xnspy, a dozen others), but none as far as I could tell would allow someone to listen to my conversations in real time. And yet I have evidence that they were doing so, somehow. Maybe they still are. How can I secure my phone? I changed passwords for my accounts and factory reset the phone, but i'm unsure if that is enough. Any advice greatly appreciated.

>>15815 >I assume they got such information through iCloud or some sort of exploit related to that. It could be a data leak or someone working there plays with you. >Does anyone know of how such a thing is possible? There are many remote exploits and I guess you can buy them in dark net. >How can I secure my phone? I changed passwords for my accounts and factory reset the phone, but i'm unsure if that is enough. It would be best if you just threw it away or sold after resetting. Apple devices are a delusion of security and privacy also never keep essential data in a cloud or on a phone. Not sure how effective the police is but you could try reporting that to the cops.

>>15815 Change all your passwords. My advice would be to buy a laptop and do less things on your phone. People who live out of their phone are setting themselves up to be owned. Nothing is secure, no matter how much they tell you it can't be hacked don't fuarrrking believe them. The only thing that is like hacker proof and just barely is MS hypervisor on xbox.

>>15815 Are you a journalist? It's just another sophisticated espionage toolkit targeting journalists if you are one. Either they just could have broken into your stupid wifi connection or that you're using a device with has https://en.wikipedia.org/wiki/Pegasus_(spyware) If they're using your information against you at this point they're probably either mad that you're a journalist or they just want to extort money. If it's the former, run away while you can. NEVER use a password management app on a phone. Your phone has insecure clipboard regardless of iOS-android while apps have API to grab your clipboard. One thing you could do right now is set up an IP logger in another system and try to browse the IP logger into the phone which would then reveal some information from the attacker. This would be more effective if you can mask the IP logger dns name with either using direct IP or using a URL redirector/shortener which the unsuspecting human would open and reveal their system and source IP address and it's quite possible you would see a data center VPN/IP which is the usual case since these attacks are usually organized by the same corporations themselves or either it's a compromised data center or the agency has had enough resource to use disposable data center IPs for their line of work.

>>15823 Thanks. Yes I will stay away from phone for anything other than calls form now on. As the first anon suggested, I'm going to go ahead and sell the phone and get a new one tomorrow. >>15825 Not a journalist or any one of importance at all, nor am I even a worthwhile target for extortion. I made the mistake of hanging around on a certain social platform in a server based out of a certain board on a certain imageboard. All of the friends I originally joined to talk to left long ago, but I stuck around against my better judgement - probably out of loneliness - but I won't make such a foolish mistake again. I imagine they likely would have been able to crack my iCloud account through some kind of snooping, they probably gradually built a profile on my personal info just from reading chat logs over a long period of time. I don't think they would try anything drastic or extreme, probably they just were trying to scare me/joke around with me for a laugh. However I am concerned as I have no clue exactly how much information they actually collected on me. Moving forward I will be more secure. Hopefully this will be the end of it.

>>15826 So you tried to hang out with IRC schizos or altchan schizos? Literally the type of people who would archive IRC logs or altchan post logs and even only communicate with you in hopes for de-anonymizing you or maybe you've become a 'lolcow' target (if you're an internet figure) since these people have a lot of free time to begin with. >how did I know? Obviously a hacker's mind is about guesswork or is it hacker to begin with? It feels more like being an intelligence agent minus the work, I guess it's the kind of stuff that interests me, it's easy to tell people's motives even with just plain observation and the little information they provide themselves, communicate with you, or the information they would later reveal (which you should've predicted by intuition alone).

>>15815 >I changed passwords for my accounts and factory reset the phone, but i'm unsure if that is enough. Wrong move, you could've set an IP logger like I've said. Make a text file "here's my bank account transaction https://_someurlshotener,wew/12341234" which redirects into an IP logger, or you could literally visit the IP logger with the device assuming its been compromised royally. Offensive security is better, at least you could reveal some information, and at least try to document these kinds of stuff with screenshots.

>>15826 OP, also do not discard the possibility of people IRL eavesdropping and trying to frame it as a phone hack (or even your friends), unless you have strong evidence on it. Occam's razor 101.

>>15829 I could certainly see it being a malicious group that targets people as "lolcows", which is ironic because they're the biggest lolcows of all to go to such extreme to harass people. Absolute cowards, anyone who does such a thing is the lowest of pathetic trash. Every time I ask for advice about this online, I get a flood of posts like >>15830 this one. On other chans maybe that makes sense, but it seems quite out of character to see such a post here. I wonder if it is one of the losers trying to harass me. Worth noting: ever since I tried securing everything I keep getting emails of people trying to log into my steam account. It is set up where no one should be able to sign in without the entering a code that is emailed to me. I have absolutely nothing in my steam account, nor do I even use steam (never have), so I don't really understand why they would keep trying to sign in to it. Any ideas? >>15835 I can completely rule this out. I was in a car with him and driving when this happened, and at other occasions I was in completely private places when I had conversations who's details they later discussed on their group. It has to be something being done remotely. >>15825 Pegasus seems to be the most likely culprit, from everything i've read. I'm sure they could've used some link and I clicked it without noticing and infected my phone that way. It was on an older version so that is definitely a plausible theory. I am now factory reset and updated to the newest version. Still, i'm getting rid of the phone today.

i've spent today trying to secure everything, setting up more security for my accounts etc, and changing everything over from my old number to a new phone. I will never use a spyPhone again. So far everything seems clear. I made sure to keep my old phone off and away from anywhere any details about what i'm doing could be recorded. I have 2fa on everything set to my new number. Finally, I went ahead and deleted the apple account that was associated to my old phone. I didn't manage to sell it, but I will do so first thing tomorrow. Hopefully this will be the end of it, although I am paranoid as all fuarrrk now. I checked my ssh logs, bash logs, active processes etc for any signs of intrusion. I didn't see anything that looked out of place, so i'm still working forward with the assumption that the hackers only had access to my phone, not my computer. I am a bit concerned since right after I deleted my apple account, my roommate said the internet had gone out in the house. It isn't the first time that happened so it could just be a coincidence, but i'm not overlooking anything right now. I will check out the router logs and make sure nothing looks strange. Finally, I have been getting bombarded all day with emails that people are attempting to sign in to my Steam account. I don't understand what they are attempting. Maybe it is an intimidation tactic, or just a way to harass me. It's from different ip address every time. I did notice in my search history that at 5 in the morning there was a single search for "steam account". I don't recall searching that; but according to the logs there hasn't been any access to my accounts from any other locations or devices, and I did wake up around that time, so it's possible I typed it in while I was still have asleep. Does anyone know why the intruders would keep trying to sign into my steam account? As far as I am aware, unless they can get the code from my email, they wouldn't be able to sign in. I don't use steam at all, so I can't understand what the meaning behind this spam. I also do not use that password for anything else. Any suggestions for how I can improve my privacy/security are greatly appreciated. -OP

>>15847 >Random people keep signing into my steam account Did you use a username/password combo for Steam similar to combos you have used on other websites?

>>15850 Many years ago, but i haven't used that username or password combo in probably 6-7yrs now.

any lains know of JS websocket exploit APTs? is that even a thing? schizo voice in my head says some Russians created software that makes backdoors in popular apps and that has kernel level access to most networks. I even think the entirety of GSM is bugged.

I regret even trying to sell the phone, now. The first place I tried said they couldn't buy it, but recommended another location. I was going to go today and get rid of it. As I was looking through everything before going to sell it, I checked the photos and noticed there was a video saved, about 3 minutes in length, from yesterday. I had turned my phone off before trying to sell it, but the lady turned it on briefly to check it out. As she was inspecting the phone, the video was recording everything. Unfortunately, while she held the phone, she managed to angle it right down towards her table. The video stopped right as the camera focused on the box of the new phone I was buying. How worried should I be right now? Thankfully, she didn't say my new phone number out loud where the microphone could pick it up, but wrote it on a slip of paper and showed me. After seeing that, I went and smashed the piece of soykaf phone into a billion shards. But now I am even more paranoid. The fact that the video ends right as the new phone is in frame, and the way they had to have intentionally saved it for me to see is infuriating. I don't know if it is an intimidation tactic, or they are just that cocky. What do you guys recommend?

>>15856 Oh yeah, and as a bonus. Right after I smashed it, again my email is bombarded with steam sign-in attempts. I would change the password but I almost feel like that must be some sort of trap, since they keep spamming it. I don't want to play into these fuarrrkers hands.

>>15856 >>15857 Wow, I am intrigued as hell right now. What exactly is happening in your life that may have caused this? I mean that video thing i really fuarrrked up and smashing the phone is not a bad choice. Personally I would sell the battery and some other pieces for a couple of dollars. Assuming you do not have any credit card information and other important information linked to these e-mail accounts you could just make a new one. New accounts with the new e-mail, just renew everything and avoid anything that could link your previous activity to you.

Did OP forget to take xir schizo/estrogen pills again?

a month passed, OP update us on this

Piggybacking on this thread, I’m currently using keepassxc to store my passes, the .kbdx file is synced across multiple computers. I generate a new password for each account, and have migrated pretty much every account I otherwise have to be around 50 to 100 random characters. Anything else I can do to improve my opsec?

It sounds very much like OP was suffering from amphetamine psychosis. I find this much more likely than someone who has the ability to pull off such an attack using it to simply torment this guy

recycling the thread i use an old version of discord (9.8.5) without tor on a cellphone (i know). i was in my bed and pointed the camera to my feet. in this moment someone in the chat i was said "feet" and another person said "hot". no one posted a feet in the chat. what is the probability of my phone being compromised and a group having access to some features of my phone and laughing on my face together at a separated server and how to get rid of this? i always suspected this. one time my dad said something and a very distinct person (of a different contry though) said something about i being a man in my dm (i don't usually say my gender on the internet), and in the same server someone said my phone model (i sent some screenshots but not even the navbar was visible). this is only an example i only downloaded some photos and sometimes i check for suspicious permissions and apps but i usually find nothing

>>17245 if you didn't download some kind of rootkit or RAT, I wouldn't say so. Sounds like coincidence? Someone randomly posted "feet"?

>>17246 people likes to say random things in random moments but in my experience when someone says "feet" it's because they saw a feet. and i can't ignore the other happenings

>>17248 you could reset the phone by Factory Settings. If you dont have some tampered custom ROM it should be fixed.

>>17249 how to backup? i'm thinkin on zipping everything and uploading to catbox.moe or anonfile

I was part of such group when I was young, people like that will not let you go just so you know they want to fuarrrk with you until you go mental, best example is chris-chan just destroy electronics, move from town, change name and cut ties with everyone you knew that's my only suggestion

>>15815 Get rid of your phone you caveman lmao how hard is it to switch a phone

Just gonna interject into this thread. I had a situation where a special police unit pulled up and watched me for like half an hour as I was waiting to pick up an order once. I knew it was them because Id watched them arrest a couple guys a few days before, in fact I was the one who put them onto them. I didnt hang around though and gave them no details. Regular police dont have these skills (been in trouble and watched before) but these unmarked car guys did. Im thinking they looked on CCTV, ran my plate, found my phone, pinged my GPS. They probably thought I was some rival criminal or something but they were watching me, and it was strange that they found me.

Speaking from experience, you might be suffering from ideas of reference where you mistakenly believe things that you read online are narrating your every activity when, in reality, they have nothing at all to do with you. People on this site are paranoid, if not schizophrenic, and you are no exception.

>>17284 This is gaslighting. Just because you have no experience in such things doesnt mean they dont happen. From the details OP has given Id say its real. They tell you they are receiving direct messages and but you instantly think they must be crazy. You would give them same response if someone told you they were directly involved in terrorist activity. Telling someone this isnt even happening is a sick thing to do.

>>17277 I once called 911 and was flabberghasted when the operator asked me to tell my location. Found out afterwards that the operator turned on GPS location on my phone to find out where I am (I never NEVER turn it on). SO yea, police and others have ability to turn on your GPS and track you. I assume they're doing so through SMS commands of some kind

>>17289 People always jump to the most outlandish conclusion when they experience something they can't readily explain. Having a nervous breakdown is much more likely than being the target out of a coordinated harassment campaign. What OP describes sounds like him reading innocuous posts of 4chan or Twitter or wherever and believing that they must be talking about him because the posts coincidentally contain information related to his activities. It's very difficult to talk somebody out of this way of thinking or convince anyone to get help. Best of luck to him and you for that matter. I wound up in jail and later a psych ward and had to be heavily medicated before coming to my senses. There probably is a grain of truth to what OP is saying like maybe some people in a discord are making troll posts on an altchan but he has allowed his paranoia to spiral and now believes theres some kind of grand conspiracy.

>>17292 Well if you wound up in jail you would have been under investigation (watched) you had a reason to be paranoid, not everything you thought was them may have been them but some of it probably was. Theyd rather you thought you were imagining things than blowing their cover. There's hardly any police paroling the street in uniform in my town. IN fact one time me and a friend were at an all night diner and this guy lurking near us his radio went off "suspect has dropped a knife" and he quickly and embarrassingly went inside. We then realised we were right round the corner from the police station and they hang out there. Another time I saw the same guy walking around with an ear piece at night whilst me and another friend where going to score some coke nearby. Lucky I spotted him. Or perhaps it was all some wild figment of my imagination right?! Stay vigilant and fuarrrk the police.

LMAO I'm glad that I'm not alone in this but yeah, why can't they just let you go? >>17252 Like for how long?

Give me some advice /sec/. Somebody I love dearly has been the target of a coordinated harassment campaign by a certain community for months. They are deeply malicious and driving my loved one into a spiral of depression and self-doubt, drugs and attempted suicide. They don't know I've done this, but I claimed ownership over a dead domain linked prominently on one of their social media accounts. I did it at a whim, thinking somebody else might do the same and use it maliciously. But it made me wonder if now that I'm the owner of said domain if I can't somehow use it to my advantage? I have suspicions on who one of the harassers are, if I can get them to go to this website I would be able to cross reference the IP address with information that I have at hand elsewhere for verification. Any advice? I don't seek to hurt anybody, I'm just trying to identify if the harassers are who I think they are so I might take appropriate action .

>>18305 Yes, if you put a server behind that domain and they visit it, your server will be able to log their IP but IP addresses change regularly these days, what would you cross reference it with?

>>18305 I will just dump my offensive security idea. >I claimed ownership over a dead domain linked prominently on one of their social media accounts. >their One of them or your loved one? If later, you can buy another domain, set an IP logger and ask your love to link it on her(?) profile. No one will click a dead link twice. Keep in mind that they can use a proxy, so you should cloudflare the IP logger or something like that, so maybe they will turn off the proxy. Do not forget to make the link apealing. Something like toughts-of-[name].com, but never freesex123.000webhostapp.com/aHgqQguZ. Another option is buying a domain similar to a popular one, (cloudflared, of course.) like neocjties.com or NE0CITIES.COM. (if you are going to switch Os to zeroes, putting the domain all caps helps.) >I don't seek to hurt anybody Man, do not ever think like that. Every harasser should suffer in the worst ways possible. At least call the police when you doxx one of them.

>>18308 >what would you cross reference it with One of the people who I suspect is involved with this harassment has self-doxxed before and has really soykafty opsec. If I know he's involved, it will tell me a lot about who else I'm up against. >One of them or your loved one? The loved one. They put a purposefully dead domain up quite recently as a joke, so I don't think too many people will have visited it yet.

>>15815 I don't mean to take away from OP's thread, but after reading up on missing people's cases I remembered a weird occurrence where my ex and I were in a mall in Bogota and she got a weird call that basically insinuated someone was following us. This got me to thinking how in the fuarrrk they would have got her number as I don't think she used it any place in the mall and this was 2014 and she was using an iPhone. Then again the fact they save full credit card numbers on their system (long story) it would not surprise me at the level of system failures that may happen there. Just was thinking about this but did not want to make a thread on it.

>>15815 IIRC the Saudi prince hacked Jeff Bezos using an exploit where all he had to do was send him an unsolicited text message. Once you have access to a device, you can install 3rd pary apps and stuff which can compromise the device. Your passwords may have been compromised if you changed them before resetting. Might want to do a reset and then change them. I would agree with other lains to get rid of your phone. >>15823 >like hacker proof and just barely is MS hypervisor on xbox. And that one american fighter jet that uses custom version of MSDOS that can't communicate with any remote systems

>>18472 That's the iMessage GIF exploit you're talking about *IIRC* The complexity of that single exploit is just fuarrrking amazing

>>18472 >IIRC the Saudi prince hacked Jeff Bezos using an exploit where all he had to do was send him an unsolicited text message. I know it was a exploit by NSO group. They offer their 'services to anyone with money, mostly nation state actors.

>>18459 A lot of companies got beacons from google to help support IRL telemetry and customer analytics. It is unclear how much these have been exploited. I remember circa 2011 someone telling me his GF kept getting a strange messages from some guy at a ball game who "hacked her phone" and apparently was trying to show off in order to get her to acknowledge him. IIRC the guy was able to pull the system/phone data and then was able to get her number that he used to start texting her. I was not well versed in mobile phone security of over a decade ago so plz no bulli if this makes no sense.

>>18503 >"hacked her phone" and apparently was trying to show off in order to get her to acknowledge him. That would get my pussy pretty wet to be honest... unless he was a little cretin about it.