So my dad has been Mac filtering my internet access for about 4 years now, he tells me if I want more time I have to find a solution or way round his filtering. I hadn't put much thought into it until about 6 months ago. I decided to do some research and downloaded a programme that would change my MAC address so I was not filtered by my dads router, however he found out about this and while I was away he logged onto my computer and did something I think. Now everytime change my MAC address after a short while my computer shuts it's self down and wheat i turn it back on the original MAC address is back and my internet is limited again. It anyone could help me figure out what he has done to my computer or the network it would be greatly appreciated.

I would like to know the following.

  1. How could he have done this?
  2. If he used any scheduled tasks, how can I find and remove them?
  3. Is there any way to check for any other backdoors he may have installed?
  • 6
    With a tech savvy dad who want to learn you how to use your computer, a first step would be securing your computer so he can't do that. At least make it more difficult to him. (Good password + Full Disk Encryption is a good start) – DrakaSAN Oct 28 '16 at 9:56
  • This is the wrong forum to ask how to bypass security measures. But it would be the right forum for the tech savvy dad to ask how to enhance the security :) -> off topic. – Steffen Ullrich Oct 28 '16 at 10:10
  • Apart from the filtering bit, I like your dad's approach! "Hack or suffer!" – John Deters Oct 28 '16 at 20:58
  • Too bad answers are locked since the question is on hold. I was going to suggest socially engineering your dad. My parents had a big problem with me spending too much time on the family computer when I was younger. Him, being a robotics engineer, I asked him if I could get more time and less restrictions if I was was doing something more useful. He agreed and got me started on programming. Not only did I get what I asked for and eventually my own computer but I also developed a skill set that pays all my bills. – Bacon Brad Oct 28 '16 at 23:23
  • I'm kind of lazy today so, download vmware and start browsing from a virtual machine - if it works stay on that track. After you verify a VM works, make a new one before you take this virtual machine online - completely isolate it from the home network - put it on a separate subnet - I would even put it behind pfsense. @da_677 has a pretty good intro write up on VMs and securing them Latest draft is here : t.co/cdcnxgc5DT Also, its is stupid easy to change a password on a winbox that I have phys access to. Google syskey, duo is a decent option, 2fa. Also BIOS pwds/security. – Digital Shiba Oct 29 '16 at 0:42

Well, to this question anyone can give you a 100% sure answer.

But, the most probably action your pro-tech dad took is generating a task (maybe as a program or as a shell-script) that auto-executes every x minutes looking for mac-changing programs. So if this program/script detects any MAC-FAKING process executing, it sends the restart/shutdown comand.

Try taking a look on the processes, tasks, etc... to see if there's something strange/new running.

You can also try to find the modifications by date.

Hope this will help.

  • Adding to it: @Joeblogs never leave your laptop unattended: If you have to, use a good hard-drive password and a good password for your user account. Even though i dont think theres anything wrong if your dad limits your internet, i think theres a major privacy issue in logging onto s.o. machine without their consent. – marstato Oct 28 '16 at 9:57
  • Thanks for the help guys it's it's not a security issue thought because he forced me to tell him my password or he said he would factory reset my computer. For the processes I looked through the all the background ones and found no scripts running, he said a while ago that he was running it from his raspberry pi but I've tried turning it off and changing my MAC address and my pic still shits down, if he is sending the command from another computer is there a way I can block the command comming in or something like that? – Joe blogs Oct 28 '16 at 10:13
  • your dad seems to have fair tech and security knowledge. If he's using a raspberry PI to do that, that's pretty awesome. The way to block that command depends on how is it done, but you may be able to do it. If it is done by a remote command, try blocking the address. – KanekiDev Oct 28 '16 at 10:23
  • Too bad the wuestion is locked; you can see the process initiating shutdown in the windows system event logs:microsoft.com/technet/support/ee/… – J.A.K. Oct 28 '16 at 10:36
  • 2
    @Joe "factory reset computer" - This would be excellent lesson in deniable encryption, restoring from backup in case of wipe, and how to protect yourself from authority overreach. Don't cooperate more than bare minimum necessary and make it time consuming for authorities to do anything. I encourage you to never surrender your passwords, as you found out it can't help you, and consider setting up deniable throw-away accounts where you can pretend to cooperate without actually doing so. – Kirill Sinitski Oct 28 '16 at 13:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.