Knowing that anything is possible for the many ways a hacker can break into a system, is it also possible that if I have an infected phone acting as a hotspot, my outdated computer could get infected after connecting to it for an hour?
I’m not a random target, the hacker knows me and is targeting me. The hacker is advanced, with many years of knowledge and experience.
Specifically, the case would be my Android/iPhone is infected with spyware, a rootkit, a backdoor for the hacker to maintain persistence, and a malicious DNS server is being used by the phone. Infection started because of an exploit kit taking advantage of a vulnerability to deliver the payload. The exploit kit was executed on a website from a link that was clicked on which was sent through SMS by the hacker spoofing a phone number of a contact.
Spyware is to know what I’m doing on the screen, through the microphone and camera, etc. Rootkit is to have full root control of the phone and alter any data to suit the hacker’s needs. Backdoor is for the hacker to be actively in my phone whenever he wants to execute new commands through the rootkit, such as to perform lateral movement to another device. The DNS server is for any redirection to malicious websites to download more malware at will.
The computer connecting to the phone’s hotspot is new out of the box and is using Windows 10 that is behind a year on updates.
Computer was ordered through the phone so the spyware has info that it shipped with Windows 10 preinstalled. Later, spyware sees that I’m creating a hotspot to connect to the computer and the hacker is notified through his C2 server. Hacker then enters backdoor and waits for the computer to connect to the phone.
Once connected, no web browsing occurs on computer so I assume he cannot do any malicious DNS server redirection to a website for a drive by download. Packet injecting malicious ads would not work either. No files are downloaded so there can be no packet injection to alter files and download malware. Only Windows updates are downloaded and installed a few at a time, but since they are signed, they cannot be altered.
The only way I see he could enter, is to scan open ports of default running services on the computer for vulnerabilities, and leverage his way in through an exploit to deliver Windows malware to the computer.
I’m thinking of two methods:
- Use the rootkit to run an exploit kit on the phone. I don’t know if this is even possible to do on phone architecture.
- The rootkit can alter hotspot traffic to create an outbound connection to an IP address that will execute the exploit kit.
Since it takes about an hour for all updates to download and install, that is the amount of time the computer is very vulnerable. Of course even after being fully updated, the hacker could use a zero day exploit but as with all devices that access the internet, it’s a small risk that can never be avoided.
So I would like to know if this scenario is even possible. Appreciate any advice on this. Correct me if I am wrong in anything.
