0

What is the best way to go about getting rid of hackers that have gained access to all my personal computers, (both old and recently purchased) phones, and even random computers I use to simply get emails out to my clients?

(Ive attempted to Explain my story below)

My current solution involves using Deriks boot n nuke for my windows computers to wipe out all of my computers, installing the latest operating systems for my machines + phones then optimizing my network settings, setting up firewalls, and using a less vulnerable email provider for my business.

I began to become suspicious when some of my clients started complaining that they weren't receiving my emails from my business account with AOL. When I had a computer repair place check out my main mac computer they found a large amount of startup programs that were scanning me from multiple sources watching my computer activity. He claimed to have fixed it but it seemed things got worse This continued with all of my other business computers, even new ones I got ahold of, After apples Genius' weren't able to figure out what was going wrong or how to fix it. I've starting to just try to find out ways to fix this on my own. Any suggestions on solutions that will work?? I'm relatively new to any sort of hacking.

closed as too broad by Philipp, Jens Erat, Scott Pack, Xander, RoraΖ Jan 11 '15 at 18:35

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • How many computers and what OSes are impacted? – GdD Sep 10 '14 at 12:02
  • 1
    Looks like the attacker has access to your network through a compromised machine or router and uses that as a "pivot" to compromise your other devices. Given how fast and easy he seems to do it I suspect that you reuse the same credentials everywhere and he just has to try them on each device to get access. – user42178 Sep 10 '14 at 18:06
1

First, use a known clean computer (not related to anything you had and not connected to anything you have now) to clear up all your online presence, especially various cloud storage services such as icloud/googledrive/dropbox/onedrive. Close up any unneccessary accounts and get your email in order - it often is the key point that must be secure. Set up two factor authentification where possible - if you believe your phones to be affected, you can get a cheap dumbphone for the 2FA sms'es and such. Don't login to the email from any of "your" systems before your cleaning is done.

Second, disconnect your computers and check up your network infrastructure. If all your devices are affected it may be that you have something like a wifi router that's compromised.

Third, nuke and reinstall the computers. And hope for the best.

1

The standard infosec response to complete compromise like this is to nuke it and start all over again, but this time from a security-hardened position. If you have many interconnected devices that are habitually insecure (they all have the same password, for instance), then you need to disconnect them from everything else, wipe them, secure them, then re-connect them to the network before moving on.

From a personal-computer standpoint, that means you need to create a new password, then install a firewall and virus scanner from a CD before you put it back on the internet or local area network. With Apple hardware, this typically means you also have to do this to your phone, tablet, and mp3 player since they like to share information with each other. And change every password you have, as they're all likely to be in someone else's hands now.

  • @Erie thanks for giving me insight on the problem I've began the nuke process using DBAN. – kyro Sep 12 '14 at 12:54
  • @Andre Daniel, yeah I wasn't able to get rid of the credentials and I can't pin point the exact creds that are affecting the network. Any insight on steps to take to secure my network from future attacks is greatly appriciated – kyro Sep 12 '14 at 12:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.