4 ms·

I feel really bad for you, and for her. Is there any chance she had a document (government application, tax forms etc) with social on there? Did she store anyth

I feel really bad for you, and for her. Is there any chance she had a document (government application, tax forms etc) with social on there? Did she store anything online in dropbox and google drive and were those passwords stored? I would do the following: -- Cancel all credit cards -- Change all bank accounts -- Put a credit lock on her social security number -- Change all passwords, prioritizing any kind of banking software or software with access to wires and accounts -- Change all the email and online files After doing that you can file a few forms with the local police and this federal ID theft site. Then when the credit people start calling in a few months (hopefully the credit lock will prevent this), you can present the information.

vonklaus 10y ago
yes. She is not my grandma, very close family friend. Her son is my fathers very good friend. I edited above, but there is a folder called [ his name ] which was on desktop. she can't recall if it is usually there but had full credit report and also several job apps, sales agreements, and other fin data. he now runs branch of a financial firm, so he is concerned. Some files were in formats I didn't have ability to read(not nefarious just some older microsoft format or something) and I didn't want to go his full private data, but needless to say, I personally would be super uncomfortable if I knew they took this data, if it was my data, i would be concerned. edit: also, thanks for the compassion, cheers. ;)
optimiz3 10y ago
After doing this, on the technical side: 1. Disconnect the hard disk, and image it using a clean host machine. Since the attackers had full admin-access, you'll want an image in case they deleted anything (and to perform forensics if you care). 2. Wipe the hard disk and re-install Windows 10, there is no other best practice here. As others have said, there are too many places to hide trojans and malware, and all bets are off now that the machine was compromised.
- vonklaus 10y ago
  hahah thanks. It's funny, i look at it the same way. I am fairly technical. I feel confident I could fix the issue technically(install new reformatted HD & RAM, security programs, ect) but I am more concerned with: * Was this the whole attack? Or was this stage 1, and they are going to sell/use data for identity theft. * Use contacts info to try and scam friends/family * Worth reporting to build narrative for the future if needed to prove identity theft leter? * What a 'typical' scammer business model is * If there is a simple way to check if they have active malware installed. I could never be comfortable with the old hardware, but I would suggest credit monitoring ect if I could verify 100% they either downloaded all the data or backdoored it. I could do this on mac/linux and probably figure it out on windows, i just don't want to freak her out. Do you think it is worth trying to tcpdump and look at the sys logs and stuff and trying to diagnose that they did more than just scam? If I knew they did, I would get lifelock for her or something, but when the friendly support rep(the hacker) told her there were 26 hackers currently on her computer and he was fixing it for her, she was obviously super concerned.
  - optimiz3 10y ago
    You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate something after the hard-drive is wiped. This way you can also put the image on a flash drive or Blu-Ray so you don't have to keep physical possession of hard drive/data which sounds like it is important. I believe tcpdump only helps you if the attack is ongoing, since this is after-the-fact, having an image you can analyze later is probably your best bet.
    - vonklaus 10y ago
      yeah that was my thought. I don't have a sata, but I do have a compatible HD with a windows install laying around, so I put as much of her data as I could into the cloud and maxed out a MS OneCloud 5gb for backup, then swapped drives. she couldn't handles the windows 10 upgrade, so I had to swap back, but I was thinking that keeping the drive as a backup/diagnostics would be best bet. Also, I wanted to replace the ram chips incase they persisted malware to them, but I was holding off to see how serious everyone on here thought it was. What is the windows equiv of stuff like: $ tcpdump $ ps aux ect. and the system level process directories like /Library/PrivilegedHelperTools /Library/LaunchDaemons ect. I guess, i'll just take a peak now. It would be worth spending an hour or so if I could know without a reasonable doubt that they did install malware. If I can't find something obvious, I'll still do clean install.

vonklaus 10y ago

yes. She is not my grandma, very close family friend. Her son is my fathers very good friend. I edited above, but there is a folder called [ his name ] which was on desktop. she can't recall if it is usually there but had full credit report and also several job apps, sales agreements, and other fin data. he now runs branch of a financial firm, so he is concerned. Some files were in formats I didn't have ability to read(not nefarious just some older microsoft format or something) and I didn't want to go his full private data, but needless to say, I personally would be super uncomfortable if I knew they took this data, if it was my data, i would be concerned. edit: also, thanks for the compassion, cheers. ;)

optimiz3 10y ago

After doing this, on the technical side: 1. Disconnect the hard disk, and image it using a clean host machine. Since the attackers had full admin-access, you'll want an image in case they deleted anything (and to perform forensics if you care). 2. Wipe the hard disk and re-install Windows 10, there is no other best practice here. As others have said, there are too many places to hide trojans and malware, and all bets are off now that the machine was compromised.

vonklaus 10y ago
hahah thanks. It's funny, i look at it the same way. I am fairly technical. I feel confident I could fix the issue technically(install new reformatted HD & RAM, security programs, ect) but I am more concerned with: * Was this the whole attack? Or was this stage 1, and they are going to sell/use data for identity theft. * Use contacts info to try and scam friends/family * Worth reporting to build narrative for the future if needed to prove identity theft leter? * What a 'typical' scammer business model is * If there is a simple way to check if they have active malware installed. I could never be comfortable with the old hardware, but I would suggest credit monitoring ect if I could verify 100% they either downloaded all the data or backdoored it. I could do this on mac/linux and probably figure it out on windows, i just don't want to freak her out. Do you think it is worth trying to tcpdump and look at the sys logs and stuff and trying to diagnose that they did more than just scam? If I knew they did, I would get lifelock for her or something, but when the friendly support rep(the hacker) told her there were 26 hackers currently on her computer and he was fixing it for her, she was obviously super concerned.
- optimiz3 10y ago
  You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate something after the hard-drive is wiped. This way you can also put the image on a flash drive or Blu-Ray so you don't have to keep physical possession of hard drive/data which sounds like it is important. I believe tcpdump only helps you if the attack is ongoing, since this is after-the-fact, having an image you can analyze later is probably your best bet.
  - vonklaus 10y ago
    yeah that was my thought. I don't have a sata, but I do have a compatible HD with a windows install laying around, so I put as much of her data as I could into the cloud and maxed out a MS OneCloud 5gb for backup, then swapped drives. she couldn't handles the windows 10 upgrade, so I had to swap back, but I was thinking that keeping the drive as a backup/diagnostics would be best bet. Also, I wanted to replace the ram chips incase they persisted malware to them, but I was holding off to see how serious everyone on here thought it was. What is the windows equiv of stuff like: $ tcpdump $ ps aux ect. and the system level process directories like /Library/PrivilegedHelperTools /Library/LaunchDaemons ect. I guess, i'll just take a peak now. It would be worth spending an hour or so if I could know without a reasonable doubt that they did install malware. If I can't find something obvious, I'll still do clean install.