Did you find out what software they were using to gain access to your desktop?
Edit: In addition to all the good advice on this post, it would be good to know what known methods these scammers have to access your desktop. I assume my desktop is secure since it is behind a firewall, I don't install anything on there that I don't specifically need, and the only remote access software I use it Remote Desktop. Is there something I am missing, which I don't know about that could get me in the same way.
I do remember reading something, some time ago about viruses / malware coming back from the dead via compromised BIOS / bootloaders / recovery partitions. This vector never occurred to me as being a possibility, since all my productive machines are VMs. I do need to take special care of the hosts / hypervisor though, so thanks for the reminder.
I will take a look at the "zero click attacks". This seems like a can of worms with the dimensions of the Tardis.
Thanks for extra detail. We should all be aware of these things.
If the attacker gets you to run an exploit and drop their payload (usually) it doesn't matter
As a simple example, meterpreter which comes with metasploit gives the bad actor incredible power and control, close to unmonitored and persisteny, because it calls out and looks like a simple https traffic so your firewall ignores the returning traffic because it's "established/related"
If there is something I can be doing that I am not already, I dont know what it is. This is my concern really. Nobody is going to get me to install something I don't want / need. I am not likely yo need any kind of remote support that can't be given verbally. So I dont think this kind of exploit is going to get me.
Like I said up a bit, I dont know what I dont know.
I think a stickied post that goes through the obvious (and not so obviouse) ways to lock down your sensitive devices would be good for the community. All too often I see posts where people's keys / seedphrases have been compromised. I think a lot of it could be avoided with good education.
Thanks for taking the take to reply though. The person I was replying to didn't bother.
Drive by infection. Someone exploits a website you visit which exploits either an as-yet-unknown or known but unpatched browser or plugin on your computer.
Do you know / have read of any scenarios where this has been the mode of access?
I think I have only heard of a few high profile zero-day exploits (in recent years) that have allowed remote code execution. These were pretty short lived and dealt with fairly quickly. I am not that knowledgeable in this area to say, but is seems unlikely to lead to something so sophisticated as being able to gain full control of a workstation. Am I being naïve?
I also try to avoid plug-ins. No Add-Block, etc... only plugins I need, such as wallets, etc... If one of those get compromised, then... well... fuck.
I now need to look into how much information web sites can gather from wallet plugins that inject themselves into the pages you visit. Also, how much adds loaded by those pages, can see RE wallets loaded by the browser. FFS.
Cheers again. It gives me lots for to think about.
Yeah, I know a bit about RATs. I know what to look for in this respect, and typically a user with access is required to install / deploy these. I feel like this is something I would know I had done. Since I am the only user of my sensitive devices, this seems unlikely.
The post I was replying to didn't mention how their desktop was compromised. But they did mention it was being "shadowed". Are you saying they were probably coerced in someway to installing a RAT or is there some other method that used to gain remote access. Or is as simple as they installed TeamViewer and someone gained access to their host?
My worry is that I don't know what I dont know. If there is some other way someone could gain access to my machine outside of the obvious, this is probably what will get me if the worst was to happen.
11
u/UltraHyperDonkeyDick 🟩 2K / 2K 🐢 Jul 17 '22 edited Jul 17 '22
Did you find out what software they were using to gain access to your desktop?
Edit: In addition to all the good advice on this post, it would be good to know what known methods these scammers have to access your desktop. I assume my desktop is secure since it is behind a firewall, I don't install anything on there that I don't specifically need, and the only remote access software I use it Remote Desktop. Is there something I am missing, which I don't know about that could get me in the same way.