My Friend Was Hacked

[hpman247]

Hi All. My friend's network was recently hacked. He has Time Warner Cable Internet Service and uses their Modem/Wireless router combo.

His computer is Win 7 and it stays on 24/7 because it's an HTPC and he has a vast media library. Anyways, he called me the other night saying that his computer for the last week had been shows the "someone else is logged into your computer" whenever he would restart it. He also said that 2 new user accounts were setup that were not there before but He's not super technically inclined (I set all this up for him) so he just overlooked this.

Admittedly, I wasn't too worried with security, especially wireless because he lives in the middle of nowhere, but this wasn't simply a brute force attack on his wireless. I know WPA2 can be hacked with Reaver, but you'd basically have to be on his doorstep to get a signal and we know that's not the case. It had to be another form of an intruder.

He said he was in the middle of watching a movie on XBMC and all of a sudden the movie cut off and he was completely locked out of his computer. He said that his girlfriend also said that their network slowed down considerably and that she was unable to get on their network at all.

Since they're in the middle of nowhere, they use that box from Verizon to provide cell service to your home in a rural area, so I am also worried their calls/texts could be compromised. I truly do feel this is the work of a pro, and I am not sure what to do. I have his computer right now but I am wiping it clean at this moment.

I suppose this could be some form of malware as well, but it seems like someone was legitimately in his computer when this happened. I know he doesn't do anything on this computer but use XBMC to view his media library and to rip/encode/download media.

I don't want this to happen to him again. What should we do to prevent this from happening once I get him all setup again. I'd appreciate any help and insight concerning the protection of his network.

Thank you

 

[p4nz3rm4d]

Take a look at this.

Basic stuff, but might help. Has anything changed? Any files missing, or settings changed? I think you have misjudged WPA2 hacking a bit, as anyone with a Yagi antenna can hack from kilometers away... I know this from "experience."
First things first, change the wifi pass. maybe setup a VPN to avoid a MITM attack in the future. Remove all control software such as TeamViewer, because if there was any access to the pc, those ports are already opened to allow traffic through. A loophole for a hacker. Try checking all logs on the router and pc to check if there was indeed a breach of security. It is very difficult to hack through a public domain, so i think that this would be from a local attack.
And make sure that what he conveyed to you was indeed a hack. If someone is not "technically inclined" they might have misdiagnosed it...

 

[dbhosttexas]

Chances are better than good you will not like my answer here as it involves quite a bit of work, but the recommendations I am about to make are to insure that your friend and his network are restored to a good, non compromised status.

This is no small part of the reason that everyone should have good, trustworthy backups, with an offsite rotation of some sort. (Online backup should work fine as long as you are encrypted.). However there was no indication that was going on here, so lacking that, you have a bit more work to do...

To be completely certain that the hack / intruder / malware that allowed the intruder in is gone, you will need to wipe and reload the compromised hosts. I might even want to reset the router back to factory defaults and rebuild the network / router configuration.

Chances are they picked up a piece of malware from somewhere, and it spread within their network. The odds of a break in without an already compromised host are minimal at best. Not saying it doesn't happen, but malware is the typical attack vector. And yes, Malware can do things as simple as configuring backdoors for others to get into your computer and fish around / steal data / make configuration changes etc... The Malware may simply have been the vector to get to a compromised host. The fact he has an extensive media library just made it that much more tempting to a hacker to keep digging into his network. Financial information is another gold mine they are digging for... I hope like crazy he has some sort of identity protection plan!

So first things first...

#1. Isolate the hosts from the network.
#2. If you have reason to believe the router is compromised, isolate it from the internet.
#3. Re-flash the router back to factory defaults, and get the latest patches on it.
#4. Re-configure the router / WiFi / Access passwords. Set it up MUCH more securely this time. (Follow the MFG / Firmware vendors documentation for configuration and security).
#5. Any potentially compromised WiFi devices such as phones, primters, game consoles, etc... will need to be set back to factory defaults and patched up to date. I will have to defer to others on how to insure game consoles are backed up...
#6. Boot the machines involved to a "Live CD / DVD" type OS. Ubuntu should be fine. Run a full backup of the Windows partitions to an external HDD from the Live CD / DVD OS. This way you will not be able to execute any virus code. Depending on the Live CD / DVD you are using, you might just want to do a drag & drop copy from the local host to the removable drive. That way when you are looking at the backup set from the reloaded OS, you have your filesystem the way you expect to see it.
#7. Set the DVD, and HDD aside, then reload Windows on the compromised hosts. Patch them fully and get a GOOD anti virus / anti malware on them.
#8. Disable Autoplay / autorun on your client computers, and re-attach the external HDD, once it mounts, run a FULL scan on the backup set.

Set them to automatically update, and insure they don't forget to renew their Anti Virus subscription when it expires.

Once you are done with all of that, make sure you hand them over some intensive online "IT Security Basics" training videos. Just pick some good ones from Youtube.

Sorry this is such a long winded answer. But I did want to show you what is involved in getting that network clean. Mind you, this also assumes that the ISP isn't compromised.

 

[hpman247]

Thanks guys. My friend also wanted me to send his thank as well. I didn't plan to go as indepth a this, but I will do so to make certain that this is a one time event.

 

[dbhosttexas]

I hate using "Let Me Google That For you" as folks often use it in a snide manner, but honestly I felt the results here would be helpful. http://lmgtfy.com/?q=Home+network+security+best+practices

There are a mess of links there but the pdf on home network security best practices from the NSA is pretty good.... Although I bet they have some sort of backdoor that they won't tell you how to protect against...