Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources.

Also, I understand if not all of my parameters can be met, but having more facts and knowledge is just as helpful as a silver bullet, as I'm dealing with two challenges: 1) Finding the right equipment, 2) Selling (convincing) the user that this equipment is as comprehensive as possible without hiring a full-time security consultant.

I have a very close friend who believes (with some evidence) that his entire life is being hacked. Examples:

  1. He believes that on any given day that any or all of his passwords have been compromised, including gmail, laptop user account, anything else of value.

  2. He believes strongly that any A/V (build in webcam on Mac, microphone, Android cam) and any other I/O method (keyboard, mouse) is being hijacked and that they have no privacy, since everything is being recorded.

  3. He believes that the hijacking is bound to all devices on his network to the extent that they are compromised on other networks (at the coffee shop, in other cities).

  4. I have had shouting matches, fighting hard not to call him totally paranoid and crazy, that most of this is not worth the time and effort of someone capable of such intrusion and that devices like his Roku, even if hackable, at best could only reveal what he's watching, and that his TV can't be used to watch him.

This friend is scared, obviously, and has been for some time. It started off small and probably with real evidence, or at least very clever persuasion from an outsider (Look, I can make your web results change; Hey, isn't power of suggestion scary?)

I have installed security software on his phone, enabled every recommended end-user security software on his Mac (Firewall, ClamXAV) and on his own he discovered ToR which he uses almost exclusively.

Every month or so I do full clean install of OSX using the Remote Reinstall option, and within days I see the electrical tape over the webcam and mic and am told stories of how this website or another had bits and pieces of his conversation from the day before or how his phone keeps "untyping" his texts halfway through.

This person is not stupid, nor computer illiterate. He is scared to the point where he believes all of the above is possible (and for all I know, it is) and anytime he asks someone other than me that knows a thing or two about hacking, they always have the incredibly helpful side note of "It's scary just how easy it is."

I know a bit about XSS and not enough but some about TCP/IP and the basics of OSX and Linux. But just not enough to show him that this is not happening, and even if I could, he wouldn't be convinced.

I have looked a SOHO routers, NSAs, NIDS, NIPS, HIPS, HIDS, every permutation of Snort, etc. All of it is either too involved, too expensive, or (believe it or not) too overkill for his needs. Can someone please recommend a device that meets the following specs:

  • Runs on its own -- I can set it up, I can help make sure it gets any auto-updates, but it needs to essentially be running in the background, working.

  • More-or-less meant for home use -- SoHo is okay, but he doesn't need a VPN, he isn't running a true LAN, and it doesn't need to scale beyond 2 or 3 laptops and a a couple of smartphones.

  • It is network intrusion prevention, not detection. He does not need to (nor would it benefit him at this point) to have to review log files or make up dynamic rules every week.

  • It can detect suspicious and/or malicious activity, including keyloggers, hardware hijacking, non-locally defined users (or attempts to create them remotely) in addition to the usual firewall, virus scanning, etc that a NAS with subscription service provides.

  • It can (if possible) detect XSS like activity (if this is a host-based requirement, I understand, and any good suite of sorts is welcome advice). Including, if feasible, being able to detect man-in-the-middle snooping, such as where they go on Google, etc.

  • Comprable in price to a really nice home router (so between 100 - 400 dollars US). If that's too low, give me a realistic baseline.

  • Decent LAN-WAN throughput, so having all of the amazing-ness above doesn't throttle his WAN port below, say, 50mbps (the standard mid-range speed package these days).

  • Going back on my "no logs needed and better off without them," it would also be preferred if the device kept a log of any and all activity that might be considered intrusive or malicious so that if he starts getting creeped out, I can show him a day or weeks worth of how no one is going to the trouble.

At the end of the day, I want to wipe everything one last time, make him cough up the cash for a dedicated piece of hardware, set it up for him, and: best case, he calms down, worst case, I can show him proof on a weekly basis that no intrusions have occurred.

This has gone beyond educating him as a user. He is smart and gets the idea of "don't click random links, don't eat stuff off the sidewalk, don't download free apps in back alleys" as well as "keep super private stuff in Tor or privacy mode. Don't leave your bank account site open, don't save passwords to text files, etc." He needs a .45 Magnum and a pitt bull at the door so he can go back to chatting on boards or watching YouTube without fear.

Thanks for reading.

Short Addendum:

What I find most frustrating, outside of trying very hard to be compassionate and even considerate of this friend's fears (ie I'm sure there must be some grain of truth, and he was truly being harassed and persuaded on more than one occasion that he was being watched via web) is that in all my searches I haven't found something remotely close to the above. But I have found lots of bits and pieces, or high-end enterprise solutions, or DIY approaches, which leads me to believe that either Cisco and its competition have no idea the market for a home-sized security appliance or that they don't realize that they could market existing devices that meet most of the above by saying "this will protect you from everything but yourself," and listing the specs above as selling points. What I mean to say is this could be something very simple that just isn't being explicitly spelled-out for me and others looking for such a device, so if that's the case, I hope a great answer or 3 is provided that goes beyond fixing my situation alone. Thanks again.

share|improve this question
    
Security takes effort. The same adage that freedom isnt free, you must constantly fight towards a secure system. Also, there is simply no way to fully secure against all attack vectors. –  Matthew Peters May 30 at 7:24
    
On principal, i understand and agree. And at a more sophisticated level of users, both in terms of the value of the target data and the sophistication of the target network, as well as the competence of the attacker and their resources, it makes sense to put in major time and effort to be close to reasonably protected. But as both the target and the attacker scale down, I would expect that the effort to detect and prevent attacks would scale down as well, so that a higher-end solution could exist that could cover most concerns. –  Anthony May 30 at 8:10
    
Your premise assumes there is a direct linear relationship between user-skill and attacker-skill. Take the recent SSL issue or Truecrypt for example, these exploited faults potentially effect all users (governments and average joe). –  Matthew Peters May 30 at 9:31
    
The exploit makes all users vulnerable, but the exploitation is likely to be done by attackers who know how to use it against targets that are worth the effort. Even if joe user has data stolen, its likely to be from an attack on a bigger fish's database. But really, for these broad spectrum cases, i would expect the "patch" to be easier to deploy for a home network. The underlying assumption I'm really making is that attacks on a home network are likely to be trivial in the scope of a higher end automated first line of defense in place on larger networks. –  Anthony May 30 at 10:03

3 Answers 3

While there are some IDS/IPS devices which are marketed as 'minimal' setup, in reality IDS is one of the most setup-intensive devices in a typical network. In your situation, I would strongly suggest that you avoid this type of device as there is a high likelihood that false positives would further convince your client that he is being targeted.

I would suggest instead, that if you really want to go down the route of demonstrating what is happening on his network, then implement an invisible logger on the network. You can link a device invisibly by only using one pair of an Ethernet cable and set it up to log all data promiscuously (this is often done for honeynets, to prevent attackers realising they are being logged)

Let it log for a couple of weeks then have a good analysis of the logs, looking for odd traffic or connections the client hasn't made.

Based on your description, I am not sure that your client will be convinced even by entirely clean logs...I think you have a difficult time ahead of you.

share|improve this answer
    
Here is the kicker...what can be done if he is right (even 20%)? It's still a home-network that does not justify the dedication you recommend. Sub-question, does SPI make a dent in network intrusion? Can I bluff my way through this? (it's worth noting that they have almost no hardware security in place beyond the basic settings of their wifi router). –  Anthony May 28 '13 at 11:02

Let's get to the root of the problem(s): Someone is accessing his network remotely, and its likely all his passwords are compromised. If someone does have a hook into his network, no matter what he types, there is a high likelihood that his password is being either written (stored) or watched (keystroke logger).

1) Someone is accessing his network remotely.

This can be discovered with a little bit of network analysis. Since it is a friend (not a company), unsure how much money/time he/she is willing to invest.

If you have an extra machine, you can use AlienVault OSSIM to monitor that machine. It WILL show you the ins and outs of all connections coming to and from that network.

AlienVault contains other supplemental applications (Snare, etc) that will allow you to have the logs from the infected/compromised machines, sent to another service for analysis and correlation.

Your other alternative would be to use an NSM (Network Security Monitoring) which usually comprises of Wireshark/TShark/tcpdump, etc. This will ONLY give you network based information.

2) File intergrity, incident response, minor forensics analysis... You could try and determine more or less when this started occurring and work from there. To do so, I would use either FCIV (Windows), Tripwire (Unix), or AIDE (Unix)

These will allow you to take a snapshot, and report any variances to files on the system, newly installed files and so forth. If you have another machine - say your friend is running OSX and you too are running OSX - you could run it on both machines, and look for the differences. Difficult but its a start.

Finally - sounds similar to the "rats and slave" issues booming. Either that, or someone REALLY dislikes your friend. Think about this for a moment: an attacker jumps through hoops and hurdles bypassing security measures, compromises a machine, then risks getting caught by staying on the same machine fiddling with someone. a) either its someone he knows who dislikes him or b) likely a rat/slave issue.

share|improve this answer
    
His money is on b, someone is targeting him. But this rats n slave looks very promising. My main headache with trying to help or disprove is that I can't read a tcpdump or ipscan to save my life. It all starts to look untoward, the longer I scan. How do you spot the creep vs the flash ad or spoof? Is that where snort or osssec joins in? I tried lil snitch for myself for a week and started thinking google was making a few too many unique requests. –  Anthony May 28 '13 at 14:28
    
Also, does a network hook actually run at the network? Which I mean does a clean os and ip still fall prey? –  Anthony May 28 '13 at 14:30

I know that my answer a bit late but Since we are talking about SOHO why not try a free UTM from Sophos?

It should provide a better security for the network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.