Out-of-the-box Network Intrusion Appliance for non-Power User

Question

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources.

Also, I understand if not all of my parameters can be met, but having more facts and knowledge is just as helpful as a silver bullet, as I'm dealing with two challenges: 1) Finding the right equipment, 2) Selling (convincing) the user that this equipment is as comprehensive as possible without hiring a full-time security consultant.

I have a very close friend who believes (with some evidence) that his entire life is being hacked. Examples:

1. He believes that on any given day that any or all of his passwords have been compromised, including gmail, laptop user account, anything else of value.

2. He believes strongly that any A/V (build in webcam on Mac, microphone, Android cam) and any other I/O method (keyboard, mouse) is being hijacked and that they have no privacy, since everything is being recorded.

3. He believes that the hijacking is bound to all devices on his network to the extent that they are compromised on other networks (at the coffee shop, in other cities).

4. I have had shouting matches, fighting hard not to call him totally paranoid and crazy, that most of this is not worth the time and effort of someone capable of such intrusion and that devices like his Roku, even if hackable, at best could only reveal what he's watching, and that his TV can't be used to watch him.

This friend is scared, obviously, and has been for some time. It started off small and probably with real evidence, or at least very clever persuasion from an outsider (Look, I can make your web results change; Hey, isn't power of suggestion scary?)

I have installed security software on his phone, enabled every recommended end-user security software on his Mac (Firewall, ClamXAV) and on his own he discovered ToR which he uses almost exclusively.

Every month or so I do full clean install of OSX using the Remote Reinstall option, and within days I see the electrical tape over the webcam and mic and am told stories of how this website or another had bits and pieces of his conversation from the day before or how his phone keeps "untyping" his texts halfway through.

This person is not stupid, nor computer illiterate. He is scared to the point where he believes all of the above is possible (and for all I know, it is) and anytime he asks someone other than me that knows a thing or two about hacking, they always have the incredibly helpful side note of "It's scary just how easy it is."

I know a bit about XSS and not enough but some about TCP/IP and the basics of OSX and Linux. But just not enough to show him that this is not happening, and even if I could, he wouldn't be convinced.

I have looked a SOHO routers, NSAs, NIDS, NIPS, HIPS, HIDS, every permutation of Snort, etc. All of it is either too involved, too expensive, or (believe it or not) too overkill for his needs. Can someone please recommend a device that meets the following specs:

• Runs on its own -- I can set it up, I can help make sure it gets any auto-updates, but it needs to essentially be running in the background, working.

• More-or-less meant for home use -- SoHo is okay, but he doesn't need a VPN, he isn't running a true LAN, and it doesn't need to scale beyond 2 or 3 laptops and a a couple of smartphones.

• It is network intrusion prevention, not detection. He does not need to (nor would it benefit him at this point) to have to review log files or make up dynamic rules every week.

• It can detect suspicious and/or malicious activity, including keyloggers, hardware hijacking, non-locally defined users (or attempts to create them remotely) in addition to the usual firewall, virus scanning, etc that a NAS with subscription service provides.

• It can (if possible) detect XSS like activity (if this is a host-based requirement, I understand, and any good suite of sorts is welcome advice). Including, if feasible, being able to detect man-in-the-middle snooping, such as where they go on Google, etc.

• Comprable in price to a really nice home router (so between 100 - 400 dollars US). If that's too low, give me a realistic baseline.

• Decent LAN-WAN throughput, so having all of the amazing-ness above doesn't throttle his WAN port below, say, 50mbps (the standard mid-range speed package these days).

• Going back on my "no logs needed and better off without them," it would also be preferred if the device kept a log of any and all activity that might be considered intrusive or malicious so that if he starts getting creeped out, I can show him a day or weeks worth of how no one is going to the trouble.

At the end of the day, I want to wipe everything one last time, make him cough up the cash for a dedicated piece of hardware, set it up for him, and: best case, he calms down, worst case, I can show him proof on a weekly basis that no intrusions have occurred.

This has gone beyond educating him as a user. He is smart and gets the idea of "don't click random links, don't eat stuff off the sidewalk, don't download free apps in back alleys" as well as "keep super private stuff in Tor or privacy mode. Don't leave your bank account site open, don't save passwords to text files, etc." He needs a .45 Magnum and a pitt bull at the door so he can go back to chatting on boards or watching YouTube without fear.

Thanks for reading.

Short Addendum:

What I find most frustrating, outside of trying very hard to be compassionate and even considerate of this friend's fears (ie I'm sure there must be some grain of truth, and he was truly being harassed and persuaded on more than one occasion that he was being watched via web) is that in all my searches I haven't found something remotely close to the above. But I have found lots of bits and pieces, or high-end enterprise solutions, or DIY approaches, which leads me to believe that either Cisco and its competition have no idea the market for a home-sized security appliance or that they don't realize that they could market existing devices that meet most of the above by saying "this will protect you from everything but yourself," and listing the specs above as selling points. What I mean to say is this could be something very simple that just isn't being explicitly spelled-out for me and others looking for such a device, so if that's the case, I hope a great answer or 3 is provided that goes beyond fixing my situation alone. Thanks again.

Answer 1

While there are some IDS/IPS devices which are marketed as 'minimal' setup, in reality IDS is one of the most setup-intensive devices in a typical network. In your situation, I would strongly suggest that you avoid this type of device as there is a high likelihood that false positives would further convince your client that he is being targeted.

I would suggest instead, that if you really want to go down the route of demonstrating what is happening on his network, then implement an invisible logger on the network. You can link a device invisibly by only using one pair of an Ethernet cable and set it up to log all data promiscuously (this is often done for honeynets, to prevent attackers realising they are being logged)

Let it log for a couple of weeks then have a good analysis of the logs, looking for odd traffic or connections the client hasn't made.

Based on your description, I am not sure that your client will be convinced even by entirely clean logs...I think you have a difficult time ahead of you.

Answer 2

Let's get to the root of the problem(s): Someone is accessing his network remotely, and its likely all his passwords are compromised. If someone does have a hook into his network, no matter what he types, there is a high likelihood that his password is being either written (stored) or watched (keystroke logger).

1) Someone is accessing his network remotely.

This can be discovered with a little bit of network analysis. Since it is a friend (not a company), unsure how much money/time he/she is willing to invest.

If you have an extra machine, you can use AlienVault OSSIM to monitor that machine. It WILL show you the ins and outs of all connections coming to and from that network.

AlienVault contains other supplemental applications (Snare, etc) that will allow you to have the logs from the infected/compromised machines, sent to another service for analysis and correlation.

Your other alternative would be to use an NSM (Network Security Monitoring) which usually comprises of Wireshark/TShark/tcpdump, etc. This will ONLY give you network based information.

2) File intergrity, incident response, minor forensics analysis... You could try and determine more or less when this started occurring and work from there. To do so, I would use either FCIV (Windows), Tripwire (Unix), or AIDE (Unix)

These will allow you to take a snapshot, and report any variances to files on the system, newly installed files and so forth. If you have another machine - say your friend is running OSX and you too are running OSX - you could run it on both machines, and look for the differences. Difficult but its a start.

Finally - sounds similar to the "rats and slave" issues booming. Either that, or someone REALLY dislikes your friend. Think about this for a moment: an attacker jumps through hoops and hurdles bypassing security measures, compromises a machine, then risks getting caught by staying on the same machine fiddling with someone. a) either its someone he knows who dislikes him or b) likely a rat/slave issue.

Answer 3

I know that my answer a bit late but Since we are talking about SOHO why not try a free UTM from Sophos?

It should provide a better security for the network.