4 ms·

Government/FBI hacked my MacBook Pro

17 points by codeninjajosh 9y ago

The FBI hacked my MacBook with a firmware loader that I couldn't use chipsec to remove it because the firmware wasn't available to download to make a whitelist they used hacked exploited versions of dmproxy and windowserver. Use 4 shadow to detect intrusion.

DigitalSea 9y ago
Where is your proof? More importantly, why would the FBI want to hack your MacBook Pro in the first place? If that's the case, they know you posted this and they'll just have to find another way to spy on you.
- codeninjajosh 9y ago
  I'll post screen shots tomorrow
  - codeninjajosh 9y ago
    Another important note is they used a dns tunnel.
  - Mandatum 9y ago
    > 3 hour old account > No proof given to claims I'm certain this is breaking rules, do a write-up and re-post tomorrow with proof under a new account (you'll likely be flagged for a dupe if under the same one).
    - codeninjajosh 9y ago
      I have a new account because hacking and cyber security are new to me. I been in it and a programmer for 17 years so traditional methods of intrusion detection didn't work because I must of been rooted. I came here for help in fixing the problem.
    - codeninjajosh 9y ago
      http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr...
- codeninjajosh 9y ago
  Because I made a website for a dangerous person unknowingly and sold perfectly legal products online for years. Then it turns out the guy was in the mafia he got popped for drug trafficking and for 2 years after that I been followed and harassed by the Feds. Multi agency task force busted him. For my own safety I can't say anything else on it.
cuchoi 9y ago
What is 4 shadow? Tried googling without much success.
- deleted 9y ago
  [deleted]
- geoah 9y ago
  Seems to be this http://4shadowapp.com/ http://4shadowapp.com/
  - codeninjajosh 9y ago
    http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr... and my proof http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh
marcsm 9y ago
quite improbable, unless you are a high target, which is doubtful.
- danielmain 9y ago
  Why not? there are so many people out there buying/selling child or necrophilia pornography in the darknet. I hope they get caught by the police. But, please I'm not saying that @codeninjajosh is on target because of that.
  - codeninjajosh 9y ago
    Read comments above
cryptarch 9y ago
What makes you think it's a state actor and not regular malware, or even just a bug? I once got pretty noided by my hard drive reporting to be empty once, thought I encountered a cryptolocker in progress. Proceeded to hard shut-down the PC and forensically inspect my HDD, turns out the HDD's USB firmware was starting to fail but my data was fine. Do you have a CO detector in your living space and is it working? Do you have any reason to doubt your judgement here? Your theory seems far-fetched to me and the way you mention details raise my paranoia/mental illness/troll alarm.
- codeninjajosh 9y ago
  See comment below. I have screen shots from the intrusion took me along time to detect it.
  - cryptarch 9y ago
    So why are you not posting them?
    - codeninjajosh 9y ago
      http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh
    - codeninjajosh 9y ago
      http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr...
bomdo 9y ago
I'm not doubting in any way that someone hacked your PC, but just in case you are currently suffering from CO poisoning [1], please try to take a day off and go outside for a walk. [1] https://en.wikipedia.org/wiki/Carbon_monoxide_poisoning https://en.wikipedia.org/wiki/Carbon_monoxide_poisoning
codeninjajosh 9y ago
Does anyone know how I can fix this problem? The notices started to go away I used express vpn only with option allow access to local devices unchecked. So this tells me they attacking me from a point on the local network and they are able to get past the nat on my personal firewall from hacker warehouse using open wrt

17 points by codeninjajosh 9y ago

DigitalSea 9y ago

Where is your proof? More importantly, why would the FBI want to hack your MacBook Pro in the first place? If that's the case, they know you posted this and they'll just have to find another way to spy on you.

codeninjajosh 9y ago
I'll post screen shots tomorrow
- codeninjajosh 9y ago
  Another important note is they used a dns tunnel.
- Mandatum 9y ago
  > 3 hour old account > No proof given to claims I'm certain this is breaking rules, do a write-up and re-post tomorrow with proof under a new account (you'll likely be flagged for a dupe if under the same one).
  - codeninjajosh 9y ago
    I have a new account because hacking and cyber security are new to me. I been in it and a programmer for 17 years so traditional methods of intrusion detection didn't work because I must of been rooted. I came here for help in fixing the problem.
  - codeninjajosh 9y ago
    http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr...
codeninjajosh 9y ago
Because I made a website for a dangerous person unknowingly and sold perfectly legal products online for years. Then it turns out the guy was in the mafia he got popped for drug trafficking and for 2 years after that I been followed and harassed by the Feds. Multi agency task force busted him. For my own safety I can't say anything else on it.

cuchoi 9y ago

What is 4 shadow? Tried googling without much success.

deleted 9y ago
[deleted]
geoah 9y ago
Seems to be this http://4shadowapp.com/ http://4shadowapp.com/
- codeninjajosh 9y ago
  http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr... and my proof http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh

marcsm 9y ago

quite improbable, unless you are a high target, which is doubtful.

danielmain 9y ago
Why not? there are so many people out there buying/selling child or necrophilia pornography in the darknet. I hope they get caught by the police. But, please I'm not saying that @codeninjajosh is on target because of that.
- codeninjajosh 9y ago
  Read comments above

cryptarch 9y ago

What makes you think it's a state actor and not regular malware, or even just a bug? I once got pretty noided by my hard drive reporting to be empty once, thought I encountered a cryptolocker in progress. Proceeded to hard shut-down the PC and forensically inspect my HDD, turns out the HDD's USB firmware was starting to fail but my data was fine. Do you have a CO detector in your living space and is it working? Do you have any reason to doubt your judgement here? Your theory seems far-fetched to me and the way you mention details raise my paranoia/mental illness/troll alarm.

codeninjajosh 9y ago
See comment below. I have screen shots from the intrusion took me along time to detect it.
- cryptarch 9y ago
  So why are you not posting them?
  - codeninjajosh 9y ago
    http://imgur.com/a/pbAbh http://imgur.com/a/pbAbh
  - codeninjajosh 9y ago
    http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-privilege-chameleon-on-macOS-Part-2/ http://keenlab.tencent.com/en/2016/07/28/WindowServer-The-pr...

bomdo 9y ago

I'm not doubting in any way that someone hacked your PC, but just in case you are currently suffering from CO poisoning [1], please try to take a day off and go outside for a walk. [1] https://en.wikipedia.org/wiki/Carbon_monoxide_poisoning https://en.wikipedia.org/wiki/Carbon_monoxide_poisoning

codeninjajosh 9y ago

Does anyone know how I can fix this problem? The notices started to go away I used express vpn only with option allow access to local devices unchecked. So this tells me they attacking me from a point on the local network and they are able to get past the nat on my personal firewall from hacker warehouse using open wrt