4 ms·

I was contacted by someone who was involved in terror incidents in several countries. They admitted several things to me but I no longer have the record. They

I was contacted by someone who was involved in terror incidents in several countries. They admitted several things to me but I no longer have the record. They are part of a white supremacist group. They do not want me to let the information out, but I have already sent in tips. They continue to harass and stalk me. Who can I talk to? edit: I will add that I was hacked while I was working at an energy trading company, which dealt with critical energy infrastructure. I told the CEO and CTO and they both ignored it, and brushed it aside every time it was brought up.

hayst4ck 3y ago
Taking you at your word, that's a tough position to be in. Energy is a hot sector to be attacking, so that is points in your favor, but unless it's some extension of Russian military/Wagner I'm not sure white supremacists make sense. It really doesn't make sense that they would contact you unless it's ransomware. Frankly the question I'm asking myself most right now is "is this some kind of phishing?" followed by "is this schizophrenia?" A CEO or CTO might prefer denial. If you want to pursue that route, then perhaps find a CISO or head of security of some sort, perhaps an administrator in IT. Were I in those positions I would definitely want to at least perform a few sanity checks. Politics can be awful if you don't have competent people around you. A competent security person would definitely be concerned about compromised employees. Corporate environments are likely to punish someone for coming forward greatly disincentivizing that behavior while sane companies would be happy someone took responsibility and came to them despite the risks of getting blamed. Mandiant and Crowdstrike are two entities you might consider, they are big and corporate, so hard to know how that would turn out. https://www.mandiant.com/contact-us https://www.mandiant.com/contact-us https://www.crowdstrike.com/services/experienced-a-breach/ https://www.crowdstrike.com/services/experienced-a-breach/ You could try to send e-mails to individuals, either people who have given talks at security conferences or people in local colleges. You could try people working in journalism, they might have contacts or an idea. You might try to mail your local represenatives, at least in the us a rep can expedite your requests. You might try to see if you can find names related to the colonial pipeline attack: https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_attack https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_a... and directly contact them. I doubt the FBI would be much different, but you could try them too. Unfortunately, I suspect many of those things are responses to actual damage caused. For every person dealing with problems like yourself, there are probably 10 companies dealing for the same problem. That requires prioritization. The real problem is that from a technical perspective, I would assess your situation as most likely explained by a successful phishing attack resulting in ransomware placement. Nobody institutional is interested in looking into or investigating problems like that, particularly in absence of real realized damages. You will either have to pay money or mine your personal network to get something technically compelling. New phones, new devices, new password manager, new passwords, etc is probably the most sane approach to your problem. > All of our devices have been hacked and are being monitored, but I don't have the ability to prove this. From a technical perspective you need to provide more info. If you don't have the ability to prove it, I don't think you have the ability to affirmatively say you've been hacked and are being monitored. If you can prove you are hacked or are being monitored, then you still have to prove you were an explicit target rather than a target of opportunity (opportunity meaning you got phished or got a Trojan by some automated system). It's also important to understand that to you this is a big deal because it's about you, but to the average security person, you're probably a 30 minute meeting on their calendar. I haven't read anything so far that makes me think this isn't a "geek squad" problem. It's common to phish people by sending them a known password (usually gotten from a password dump from a hacked website), or telling them a scary story. If one person's computer gets compromised, then the information in e-mail can become a vector for making more convincing phishing e-mails. Just to give you a really good metaphor of what you're up against, it's like you think you have been poisoned with polonium and are trying to convince your doctor. Possible? Yes. Likely? no. Most likely diagnosis? Problem with patient, not polonium poisoning, maybe food poisoning.

hayst4ck 3y ago

Taking you at your word, that's a tough position to be in. Energy is a hot sector to be attacking, so that is points in your favor, but unless it's some extension of Russian military/Wagner I'm not sure white supremacists make sense. It really doesn't make sense that they would contact you unless it's ransomware. Frankly the question I'm asking myself most right now is "is this some kind of phishing?" followed by "is this schizophrenia?" A CEO or CTO might prefer denial. If you want to pursue that route, then perhaps find a CISO or head of security of some sort, perhaps an administrator in IT. Were I in those positions I would definitely want to at least perform a few sanity checks. Politics can be awful if you don't have competent people around you. A competent security person would definitely be concerned about compromised employees. Corporate environments are likely to punish someone for coming forward greatly disincentivizing that behavior while sane companies would be happy someone took responsibility and came to them despite the risks of getting blamed. Mandiant and Crowdstrike are two entities you might consider, they are big and corporate, so hard to know how that would turn out. https://www.mandiant.com/contact-us https://www.mandiant.com/contact-us https://www.crowdstrike.com/services/experienced-a-breach/ https://www.crowdstrike.com/services/experienced-a-breach/ You could try to send e-mails to individuals, either people who have given talks at security conferences or people in local colleges. You could try people working in journalism, they might have contacts or an idea. You might try to mail your local represenatives, at least in the us a rep can expedite your requests. You might try to see if you can find names related to the colonial pipeline attack: https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_attack https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_a... and directly contact them. I doubt the FBI would be much different, but you could try them too. Unfortunately, I suspect many of those things are responses to actual damage caused. For every person dealing with problems like yourself, there are probably 10 companies dealing for the same problem. That requires prioritization. The real problem is that from a technical perspective, I would assess your situation as most likely explained by a successful phishing attack resulting in ransomware placement. Nobody institutional is interested in looking into or investigating problems like that, particularly in absence of real realized damages. You will either have to pay money or mine your personal network to get something technically compelling. New phones, new devices, new password manager, new passwords, etc is probably the most sane approach to your problem. > All of our devices have been hacked and are being monitored, but I don't have the ability to prove this. From a technical perspective you need to provide more info. If you don't have the ability to prove it, I don't think you have the ability to affirmatively say you've been hacked and are being monitored. If you can prove you are hacked or are being monitored, then you still have to prove you were an explicit target rather than a target of opportunity (opportunity meaning you got phished or got a Trojan by some automated system). It's also important to understand that to you this is a big deal because it's about you, but to the average security person, you're probably a 30 minute meeting on their calendar. I haven't read anything so far that makes me think this isn't a "geek squad" problem. It's common to phish people by sending them a known password (usually gotten from a password dump from a hacked website), or telling them a scary story. If one person's computer gets compromised, then the information in e-mail can become a vector for making more convincing phishing e-mails. Just to give you a really good metaphor of what you're up against, it's like you think you have been poisoned with polonium and are trying to convince your doctor. Possible? Yes. Likely? no. Most likely diagnosis? Problem with patient, not polonium poisoning, maybe food poisoning.