2

Suppose I have some important text data on my computer, like a plain text password y5278dhk28ds and I have malware on my PC that periodically searches for sensitive data and sends that data to anothersite.com. I want to block the transfer of this sensitive data.

I'm searching a simple to use packet sniffer which I would run in Windows 10 (also using external script such as PHP, Python, Perl..) which should be able to

  • detect if the password y5278dhk28ds is exiting (unencrypted) from my computer to my network (ethernet) and report where it is going (ip address, URL)
  • possibility/option to automatically block this traffic from my computer if I do not recognize the remote address.

Does exist something to do these tasks in an easy way? Or where I can find a guide to do these tasks?

6
  • Detecting on the machine is simple, and standard programs are a search away. However, you want a solution to then automatically respond. You are looking for a firewall or an IDS that can break encryption and inspect traffic.
    – schroeder
    Jan 27, 2020 at 8:37
  • Alternatively, you could create a proxy on your machine to do the inspecting. So, you need a certain kind of firewall, an IDS, or a custom proxy. "Easy" for all these things is a matter of perspective.
    – schroeder
    Jan 27, 2020 at 8:39
  • 1
    What you're looking for is data leakage prevention. This is usually implemented at the network boundary.
    – ditrapanij
    Jan 27, 2020 at 8:46
  • 2
    The Wireshark tool tshark can at least detect a string going over the network: tshark -Y "frame contains y5278dhk28ds"
    – Luc
    Jan 27, 2020 at 8:54
  • 3
    What you are looking for is complex. You are assuming that the malware doesn't encrypt the data and you are assuming that you can configure this solution with all the potentially sensitive things you don't want leaked. It is far simpler to block unknown connections out to unknown locations from strange local processes, regardless of whether it has sensitive data or not.
    – schroeder
    Jan 27, 2020 at 9:45

2 Answers 2

1

It's somehow possible, but it does not scale, not even with effort. It only works if malware is not using encryption nor encoding (a simple ROT13 would blind you). The strings you want to look must be small, or packet fragmentation can cut the string and you won't get a match.

You would need to have a database with all private data you want to inspect, and that database itself would be a huge liability. Any attacker that can get this database will be very happy.

If you are doing this to prevent malware leaking data, you are doing it wrong. You need anti-malware to prevent infection, a password manager for, well, managing your passwords, and if the system is already compromised, reinstall from scratch and recover backups.

If you are thinking on data loss prevention, there's a whole range of software specialized at this. They are GDPI/HIPAA complaint, can cover databases, email, can decrypt connections at the gateway, and have lots of customized reports and alerts.

0

If you assume that your computer has malware, then there is no way to keep yourself safe except for nuking everything from orbit, rolling over all your passwords and using Hardware-backed 2FA wherever possible.

Staying "safe" on a system you consider compromised is not possible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .