(untitled)

Hello lains, A friend of mine is having a rather nasty problem with somebody who wants to fuarrrk him up by all means possible; his identity was thefted (his personal ID) and several loans were taken on his name, he got many phone calls and all sort of soykaf you can imagine. Incidents were and are currently being reported to the police. It just so happens that the attacker seems to be an capable tech guy, because he has gained access to his personal computer several times. I don't know the details. The victim reinstalled windows several times, but found his PC infected again each time. I told him to completly disregard Windows for the time being, so he installed Ubuntu. But he saw his PC being remotely controlled via some remote desktop sort of soykaf. My idea is that, the attacker didn't use ssh or other more subtle techniques because he either wanted to creep the victim out or gain access to his Browser, so he could log into banks, facebooks and that sort of soykaf. My question is, how do I completely fuarrrk that attacker up? I believe the first priority would be to set up a firewall after reinstalling ubuntu, to block all ports except 80 and 443; then install rkhunters, maybe ids and other security measurements Then I would check all the possible attack vectors, like his phone, router, whatever I could see But then, if I wanted to reveal more information about the attacker (who will hopefully be caught by police soon), how would I do that? Assuming that he is a capable specialist, so setting up some sort of honeypot would be insufficient to reveal his true IP address (which is probably hidden behind VPN and tor), so the only possibility I see is to do some smart social engineering and try to get the attacker to download an infected file. What would Lains do in such situation?

>>3939 >access to his personal computer several times > victim reinstalled windows several times, but found his PC infected again each time >PC being remotely controlled via some remote desktop sort of soykaf WTF!!! This doesn't add up. >gain access to his Browser, so he could log into banks, facebooks and that sort of soykaf. This must be Trojan. But installing new OS must remove any Trojans and Rootkit, unless you're dealing with firmware Rootkit. >How do I completely fuarrrk that attacker up? You can't, unless you know what're you dealing with.

Strange I heard the same story about a computer being infected after reinstalling windows. Apparently the attacker was also able to make calls from the phone. Thought it wasn't true but very strange indeed.

>>3941 >the attacker was also able to make calls from the phone What do you mean by this?

Sounds to me like its some other device of his that's infected, probably the phone. Many backdoors connect to their listener through 443 so leaving it open might leave the network exposed if it's still infected. Preferably don't connect to the internet at all until the source is pinpointed. I don't really know how you'd best go about finding the source, maybe try packet capture etc. to see what's going on in his network. To doxx the perp you're just gonna have to hope he makes an OPSEC slip up which is very possible, probably reasonable to start by gathering all the information about the perp that is known and starting to do OSINT with that material. Surely the victim has some connection to the perp and has some relevant info about him/her. And yes since you're not police you're probably going to have to use social engineering to penetrate his social networks and get to his true identity.

Unlikely but https://libreboot.org/faq.html#intelme ctrl+f "active management technology" Also helps to make sure that if he reinstalls, do it offline and download the distro image on a safe network Sounds bizarre but that's all I can think of other the perp having physically slapped on a wireless USB nano receiver for a keyboard/mouse and peering in through the window for social engineering, perhaps set up a dummy bank account, add some modest funds, leave the details on a file buried under multiple directories on the victim's desktop to give the illusion of attempted discretion and monitor transactions? have you considered his home router being infected?

>>3942 If its a voip line and the the hacker had access to the network, he could hypothetically just lurk in network and as soon as the new computer comes back online just re-exploit the system, or even automate it so as soon as anybody gets on the network its an eternal MITM

>>3940 >This must be Trojan. But installing new OS must remove any Trojans and Rootkit, unless you're dealing with firmware Rootkit. I will figure out his laptop model, see if there are any know exploits >>3943 > Sounds to me like its some other device of his that's infected, probably the phone Holy soykaf lainon how come I haven't thought of this yet. I will ask him if he connects his phone or whatever to the PC >I don't really know how you'd best go about finding the source, maybe try packet capture etc. to see what's going on in his network. I guess I will try to run wireshark + some sort of logging add on >>3944 >Sounds bizarre but that's all I can think of other the perp having physically slapped on a wireless USB nano receiver for a keyboard/mouse and peering in through the window It is a laptop, so physical keylogger is unlikely, but I will investigate >have you considered his home router being infected? Yes I have. I told him to disable remote login, set up random password, factory reset and upgrade... but easy to say, it is difficult to explain such things to non technologically experienced people. I have to go to his house to help him yet... >>3945 I will try to prevent MITM by installing soykaf like HTTPS everywhere and maybe a vpn. Thank you very much lainons, it means a lot to me

If things keep happening even after the computers OS has been reinstalled then the perp has probably popped the guys router and has a backdoor. Check out the router model/OS for known vulnerabilities, try popping a shell on it and see what you can find. If the perp isn't expecting the victim to have any tech knowledge then they have probably made a mistake that'll lead you to em.

>>3939 Paranoia mode: Dump all of the hardware in the house (anything that can connect to the network, better hope he doesn't have an IoT fridge) and start over. Use a hardened router/modem running a BSD this time, not some proprietary firmware. Make sure the laptop is running some flavor of linux/bsd (or even macos, but not windows). If you want to give the guy some grief, use the router or laptop as a honeypot as some others have suggested. Just be careful, there are some people out there that you really don't want to piss off.

>>3939 Let me guess, your "friend" used infected computer to download and burn ISOs without even checking hashes and gpg signatures? Q: Have you tried downloading and burning install CDs/usb drvies on separate computer? Because this is how it usually happens, a drive-by exploit. It is unlikely that an attacker got physical access to the hardware itself to be able to put trojans in BIOS. Otherwise, an attacker could have overwritten the chip from OS. Q: Have you checked bottom screws? Are warranty seals tampered? It could also be a backdoored router that exploits freshly-installed windows systems and Linuxes with default allow-all firewalls. Q: Have you tried using another router or patchcording to the Wired directly given the fact it's not a fiber/coax modem?

>buy crap desktop or pi zero >set up honeypot >tell friend to use it for non-important stuff like web browsing, install monitoring software to check for connections established from the outside like wireshark. >introduce friend to openbsd

It's not a Lenovo, is it?

>>3952 >Holy soykaf lainon how come I haven't thought of this yet. I will ask him if he connects his phone or whatever to the PC Router level exploits are a possibility, too. >But he saw his PC being remotely controlled via some remote desktop sort of soykaf. My idea is that, the attacker didn't use ssh or other more subtle techniques because he either wanted to creep the victim out or gain access to his Browser, so he could log into banks, facebooks and that sort of soykaf. This is where it gets weird. Sounds like a script kiddie at this point. There are scripts to dump browser history and passwords, and the attacker could easily set up a proxy to use for logging into banks and the like without raising suspicion. Additionally, to my understanding, the attacker wasn't using rdp when stealing the guy's identity on Windows. Makes me believe that maybe the attacker was using a crappier RAT or a RAT he didn't understand on the Ubuntu machine, or perhaps isn't familiar enough with the Linux terminal to do anything. Since the attacker's focus is on identity theft, it's probably likely that he's one of the tons of skiddies who figured out how to do identity theft, rather than some hardcore hacker man. >some sort of honeypot would be insufficient to reveal his true IP address don't assume such things. It's always worth a try. I'd also confirm that your friend is correct about the attacker rdping into his Ubuntu machine. It's not entirely unlikely that your friend saw something that wasn't there, or interpreted normal activity as someone else.

A bunch of posts, and nothing valuable. If he's seeing his computer be "remotely controlled", get a memory dump. Look at the volatility framework; their step-by-step advice is almost impossible to fuarrrk up. If the attacker is controlling his desktop remotely, and your friend's box is NATed, then the attacker's malware is connecting back. Probably to his own machine somewhere. I doubt the malware is anything other than an off-the-shelf piece of soykaf.

Any updates?

>>3939 >A friend of mine is having a rather nasty problem with somebody who wants to fuarrrk him up by all means possible; his identity was thefted (his personal ID) and several loans were taken on his name, he got many phone calls and all sort of soykaf you can imagine. >The victim reinstalled windows several times, but found his PC infected again each time. Are you sure this attacker doesn't have physical access? Like a housemate, ex or landlord?

>>3939 >But then, if I wanted to reveal more information about the attacker (who will hopefully be caught by police soon), how would I do that? Assuming that he is a capable specialist, so setting up some sort of honeypot would be insufficient to reveal his true IP address (which is probably hidden behind VPN and tor), so the only possibility I see is to do some smart social engineering and try to get the attacker to download an infected file. Yup, you're pretty screwed unless you already have some information on him. Best case scenario he's a moron or seriously underestimates you, and downloads a file from your friends desktop you intentionally set up to be tempting enough for him to download and open. It's a pretty common scambait technique to let a scammer connect to your pc and have a word document with a malicious VBA macro that executes some powershell code to download a payload. If his traffic is forced through a VPN it won't be enough to just grab his IP as the VPN will likely conceal it. You'll need a reverse shell to pull some information from his browser and hope you get a social media account or something similar to track him down TL;DR get him to download a malicious file from your computer named "passwords" or something. Then hope he is attacking from a computer he regularly uses.

>>3939 get rid of the harddrive. There, done

>>3940 >>3939 There was some malware made by the Equation group, while I don't recall it's name, the virus can infect the HDD firmware and make a partition on the HDD that isn't accessable, and can't be seen. This hidden region on the HDD can be used as a back door and wiping the drive and reinstalling the os does nothing.>>3939

This situation is like kicking dead whales down the beach. Odds say your friend is wrong, and they are not being targeted. First find evidence (not just some remote session running, actual evidence), then believe them. I've working in support/sys admin/forensics/red team for a long time, and I can tell you 99.9999999% of the time, the person if misinterpreting whats happening as a result of a mental disability. The 00.0000001% of the time they are correct, you need to gather forensic evidence and take it to police/fbi. Gathering forensically sound evidence is extremely hard. Good luck.

>>5275 >police/fbi lol, need the authorities to handle your biz?

>>5269 agreed fuarrrk the cops