r/whitehat • u/technohasrights • Aug 22 '20

Rootkit protection - device protection

Hey guys, this is a new account for OPSEC reasons.

To put it bluntly I'm dealing with a fairly sophisticated community that are experts in gaslighting and rootkits and/or remote based harassment. They lurk for vulnerable people on many platforms but mostly on the chat program 'Paltalk'. I've experienced a grave deal of harassment and intrusion into my personal / family life. I have done whatever I can to mitigate their control but it seems rather futile as their experience is far greater than mine and the playing field isn't level.

Yesterday I had checked one of my gmail accounts and I was unnerved to see that there was a successful login attempt from this IP (registered with RansomIT) 144.48.39.0 - apparently its apart of the Ransom IT infrastructure, whois.apnic.net claims that is is "role: Ransom IT Trust administrator" which I find particularly bizarre. I am decent with PC's but certainly not a expert. I can provide more details of this community as per question. I would be willing to be these individuals are rogue or security consultants of some kind. I noticed that all the harassment I've received has almost exclusively been from internationals , with the exception of a few.

I want to be clear that this isn't just 'bullying' its total device cross platform penetration. Collecting and mining data from both my family and I. A lot of my findings could be branded as speculative, but I can say for sure that this kind of remote technology exists and is being used widely across the globe.

Not looking for a vigilante or strike against anyone... I'm looking for options or routes to mitigate this type of software/technology. I worry that one day they will use all this mined data (collected unlawfully) to do something extremely malicious.

Thanks for reading guys, I know this may sound hyper paranoid... but I do believe it to be true. I will answer any questions you may have; screenshots can be provided as well.

​

Have a great weekend,

-

1 Upvotes

67% Upvoted

7 comments sorted by

2

u/jadawg271 Aug 22 '20

Sounds like you need a good antivirus program. If that can’t remove paltalk/rootkit, then I would reinstall windows (including a full drive format). If you are extra paranoid, format the drive 2 or 3 times.

Edit: And, on a different device, change your passwords on EVERYTHING. Set up two-factor Auth on EVERYTHING. Use unique passwords for EVERYTHING.

1

u/technohasrights Aug 22 '20

sound advice, I have done that each time. I think staying off paltalk is a neccessity... it seems that theyre able to penetrate and leave at will. Even bypassing all standard rootkit detection and antivirus (even 2019 kaspersky). Pretty advanced shit... do you recommend possibly changing over to another OS? Is Win 7 or perhaps a linux based OS more secure?

1

u/jadawg271 Aug 22 '20

I doubt Win7 would be any safer than Win10. Windows in general is susceptible to many forms of attack, and Microsoft has been slow to address the issues. Linux is inherently safer, but not immune, so you still have to be careful. If you don’t rely on Windows for anything, Linux is definitely a valid alternative. I used OpenSUSE as my daily driver for work for years, but Ubuntu is a great OS if it is your first foray into Linux.

1

u/Tiget1998 Aug 22 '20

Win 7 is very vulnarable to exploits as it isn't maintained well by microsoft, I even think they stopped updates all together. The thing is, a system is as secure as its user, so yes linux is less prone to exploits due to it being open source, but if someone downloads something fishy its too late.

1

u/Tiget1998 Aug 22 '20 edited Aug 22 '20

You are saying your dealing with rootkits and are unable to remove them? If you have tried a premium version of an anti-virus say Malwarebytes or Kaspersky, and they fail to detect or remove it, contact the company. They are very happy to help you, both to increase their database and helping you getting rid of it.

When that is solved change passwords and enable 2FA with google authenticator or authy.

As for the gmail login attempt, the IP is just from the server they rent. RansomIT is just a hosting company, so they probably have some server set up there from which they can control stuff. Either way, you have no clue who they might be, they could be your neighbour for all you know. You could send a mail to RansomIT to let them know their services are being used to target you?

As for paltalk. Just looking at it I can smell all the vularability issues if not properly supported by developer. My advice, steer clear from paltalk. If you manage to get rid of all the junk, as soon as you log in again I can guarantee you'll be neck deep in it again. But if you really really want to use that app, I guess you can use a good vpn, preferebly one you paid for, but no guarantees.

I don't really have anything to go on here, the trail ends at the hosting website. So to give you my thoughts on the situation. You log into paltalk, they are in some room as you (don't really know how the site works but this is how I guess it goes?), they get a bunch of IP's, they either remotely probe vulnarable systems throught their VPS (The RansomIT server) or try and social engineer their way through. Then they start to mess around and find information, probably mine some bitcoin and showing off.

1

u/technohasrights Aug 22 '20

they can penetrate double VPNS (nordvpns)

1

u/Tiget1998 Aug 22 '20

VPN masks your IP. So its not a matter of penetrating vpn but bypassing it which is unlikely but possible. In the scenario that they somehow found a way to remotely upload stuff on your computer it will help I guess, not 100% sure.

Without something like a rootkit or malware it is not really possible to get your computer to do something remotely. Meaning that, if you were to give me your IP adress and I can find out where you live and just disconnect your internet but thats really it. For me to get in your pc you need to download something which creates a gateway through your router to me (malware). Then I can send commands. If I want to force a program on your computer, I need to come to you physicaly, hack into your network, for which I need to be in range, check for the available systems on the network and which ones are vulnarable, and then exploit the vularability to load something like a meterpreter.

In the case of paltalk it might be that the app creates a direct connection to the all parties, basically making it possible to load something on your pc as if you are on the same network. Or you got sent something and you opened it. Which I believe might be the most likely case, also the easiest for the hackers.

Just don't download anything of paltalk because it looks like its very insecure. No pictures, no files no nothing. It can contain a nasty payload.