LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 07-04-2017, 09:31 PM   #1
mazinoz
Member
 
Registered: Mar 2003
Location: Mansfield Queensland Australia
Distribution: Linux Mint - Tara
Posts: 497

Rep: Reputation: 35
Persistent destructive Hacker


My problem is a neighbour who keeps running the same destructive scripts, although they add countermeasures to my efforts as well. The problem seems to be they attack wirelessly by both wireless and bluetooth during my first boot from a live DVD. So I''m lucky if I turn off radio beforehand. I'd like to add more security measures but am impeded from the 'get-go'.

I feel the only option is to use a desktop without radio hardware or move to the chilly garage, which may not stop them anyway.

They are connecting to my laptop faster than I can block network connections!

https://www.linuxquestions.org/quest...1&d=1499178535

I can't disable wifi or bluetooth in the BIOS.
Attached Thumbnails
Click image for larger version

Name:	Screenshot at 2017-07-03 10-28-24.jpg
Views:	124
Size:	48.9 KB
ID:	25377  
 
Old 07-05-2017, 05:34 AM   #2
camp0
Member
 
Registered: Dec 2016
Location: Dublin
Distribution: Fedora
Posts: 70

Rep: Reputation: 4
You can do two approaches:
- Invite your neighbor to some beers and discuss about his super hacking powers.
- Drop all your incoming connections on your firewall before you connect to your network and continue the fight with him.
 
Old 07-05-2017, 05:36 AM   #3
hazel
LQ Guru
 
Registered: Mar 2016
Location: Harrow, UK
Distribution: LFS, AntiX, Slackware
Posts: 7,574
Blog Entries: 19

Rep: Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453Reputation: 4453
Have you any idea why he's doing it? It seems an odd thing to do if there isn't an ongoing feud.
 
Old 07-05-2017, 06:00 AM   #4
descendant_command
Senior Member
 
Registered: Mar 2012
Posts: 1,876

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
What makes you think they are "connecting to your laptop"?

What "destructive scripts" are they running (and how do you know)?
 
1 members found this post helpful.
Old 07-05-2017, 09:20 AM   #5
Habitual
LQ Veteran
 
Registered: Jan 2011
Location: Abingdon, VA
Distribution: Catalina
Posts: 9,374
Blog Entries: 37

Rep: Reputation: Disabled
Install it offline.

Last Used: Never

I think the setup has detected your blutooth.

Last edited by Habitual; 07-05-2017 at 09:40 AM.
 
Old 07-05-2017, 10:14 AM   #6
justmy2cents
Member
 
Registered: May 2017
Location: U.S.
Distribution: Un*x
Posts: 237
Blog Entries: 2

Rep: Reputation: Disabled
You can learn to use Kismet; it's an IDS (intrusion detection system) for wireless, and take a look at Lynis which is a tool to audit your system. Then possibly you can make something kind of Wi-Fi kill script based on what Kismet finds (i.e. shut off your wireless if an intrusion is detected)..

Last edited by justmy2cents; 07-05-2017 at 10:17 AM.
 
Old 07-05-2017, 10:15 AM   #7
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
If you have good cause to believe that your neighbor – or, his children – are maliciously interfering with your wireless network, then I would suggest several options:

(1) Change your wireless WPA2 password frequently!

(2) Use OpenVPN on your router to secure your internal network. Make sure that none of your computers will accept a connection.

(3) Contact your local police department on their non-emergency contact number to discuss the situation. Unless you know your neighbor well, the police can act as a well-known community authority who can contact your neighbor officially and mediate as necessary between the two of you to help resolve your problem.

It is against the law to use radio for "malicious interference" of any type.
 
1 members found this post helpful.
Old 07-05-2017, 11:37 AM   #8
TB0ne
LQ Guru
 
Registered: Jul 2003
Location: Birmingham, Alabama
Distribution: SuSE, RedHat, Slack,CentOS
Posts: 26,636

Rep: Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965Reputation: 7965
Quote:
Originally Posted by mazinoz View Post
My problem is a neighbour who keeps running the same destructive scripts, although they add countermeasures to my efforts as well. The problem seems to be they attack wirelessly by both wireless and bluetooth during my first boot from a live DVD. So I''m lucky if I turn off radio beforehand. I'd like to add more security measures but am impeded from the 'get-go'.

I feel the only option is to use a desktop without radio hardware or move to the chilly garage, which may not stop them anyway. They are connecting to my laptop faster than I can block network connections! I can't disable wifi or bluetooth in the BIOS.
Sorry, but this not only seems unlikely, but plain wrong based on what you posted. First, bluetooth has about a 30-60 foot range, if it has clear line of sight. Walls/etc., drop that off a HUGE amount, so your 'hacker' would have to be within probably 20 feet of your system to start with...and could only connect via bluetooth if you:
  1. Put your system in pairing mode
  2. Gave your 'hacker' the pairing code and/or clicked "ok" when it asked you if you wanted to accept/trust a new device
  3. ...and configured services to listen/work over bluetooth. Which isn't an easy thing.
Things like SSH, http, ftp, etc., typically don't work with bluetooth at all, and if they do, there are several configuration steps to go through first. Bluetooth supports basic file transfer and other 'easy' things, but scripts and interactive logins?? Nope.

And the whole "connecting faster than I can block network connections!" is even MORE unlikely. Even if you were using very weak encryption, getting a decent packet sniff using your run-of-the-mill tools, decrypting it, etc., would take a good amount of time...certainly hours, if not longer. There's not much you're saying here that seems plausible.

What is more likely is what others have pointed out: you're mistaking device configuration for "there's a hacker!" And if you truly believe this is the case, then contact the police and let them deal with the perpetrator.
 
2 members found this post helpful.
Old 07-05-2017, 11:50 AM   #9
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 4,278

Rep: Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694Reputation: 1694
Let me reply to the Bluetooth part:

Reference:
https://www.sans.edu/cyber-research/...icle/bluetooth

Quote:
Since Bluetooth devices operate in the 2.4 GHz spectrum, they use the same commodity antennas designed for WLAN devices. While vendors don't design Bluetooth dongles with external antenna connectors, some Bluetooth dongles such as the Linksys USBBT100 can be modified to accommodate an external antenna connector. By soldering on an external antenna cable, the range of a Bluetooth Class 1 dongle can be extended, allowing an attacker to connect to class 2 devices (intended for a range of 10 meters) from a range of over a mile.
Of course, this is only transmission. But DOS attacks need not wait for replies.

There are DOS tools contained in many of the Pentesting suites that seem to be able to make bluetooth useless in an area.
 
1 members found this post helpful.
Old 07-05-2017, 12:32 PM   #10
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
I agree that there is a strong possibility that the OP is mistaken. I am healthily skeptical that any neighbor would actually do that, even if they could.

Another possibility is – write a letter, and mail it. Be sure to sign it, and to include your return address and phone number, and say that you're the next door neighbor. Describe what you are seeing and invite the neighbor to respond to you however s/he sees fit. Be sure not to be accusatory in any way, just factual (as you see it), and knowing in advance that you could be utterly mistaken. For instance, describe what you are seeing and ask what your neighbor thinks might be the problem. (Who knows, your neighbor might be a brilliant network engineer!)
 
1 members found this post helpful.
Old 07-06-2017, 09:07 AM   #11
0siris
LQ Newbie
 
Registered: Sep 2011
Location: IL, USA
Distribution: Absolute Linux
Posts: 8

Rep: Reputation: Disabled
Quote:
The problem seems to be they attack wirelessly by both wireless and bluetooth during my first boot from a live DVD.
Right when you boot? And this neighbor is already on your WLAN?

Or, is it not your WLAN to begin with? Is it his?

Granted, scripts could be running constantly. But it seems to me more likely that we're not getting the whole story here.

Why would a user knowledgeable enough to run a live DVD not think of changing his WLAN passphrase? Likely: He can't. Because it's not his WLAN to manage.

Why would a neighbor run such a selective script? Likely: Because he's trying to keep an intruder (perceived or real) off his WLAN.

I don't know either the OP or his neighbor. But this situation doesn't feel real as posted. We don't know something. That something may change what I see. But right now, this is what I see.

And if I see correctly, then the solution is for the OP to get his own Internet connection. The situation that I see qualifies as theft of service, which is a crime in many jurisdictions.
 
Old 07-08-2017, 02:50 AM   #12
mazinoz
Member
 
Registered: Mar 2003
Location: Mansfield Queensland Australia
Distribution: Linux Mint - Tara
Posts: 497

Original Poster
Rep: Reputation: 35
Basically I suspect it is a former work colleague who gets his kicks this way. I know this sounds a bit crazy, but if it is him, well let's just say he has seen a lot of psychiatrists. They are not helping him. Alternatively it is a long time resident in the suburb. Cheap fast internet. I don't know who is doing it.
 
Old 07-08-2017, 03:47 AM   #13
mazinoz
Member
 
Registered: Mar 2003
Location: Mansfield Queensland Australia
Distribution: Linux Mint - Tara
Posts: 497

Original Poster
Rep: Reputation: 35
Here is a link to what I have captured of their activity.

https://www.dropbox.com/sh/rh7cyuzyu...O_eHM9sUa?dl=0

There is also an interesting paper on this sort of hacking included. It has been estimated that bluetooth can reach 300 feet when an antennae is used.

"There are DOS tools contained in many of the Pentesting suites that seem to be able to make bluetooth useless in an area."

Thanks, I will look into it.

Just a few points. I no longer use wireless or bluetooth. Is there a way of booting without it being turned on? Also installing without it being turned on. I'm currently using Linux Mint 18.2 MATE version and opt to not turn on wireless. "rfkill block all" is run immediately on booting. Then I disconnect and delete their connection. They then DOS me, and / or delete drivers so I cannot use keyboard, touchpad, etc.

At the moment I'm actually getting good speeds using a 16Gb USB boot stick and running "dd if=/dev/zero of=/dev/sda.and firewall and rfkill. Of course they can't write a rootkit to unpartitioned hard drive.

They are using bluetooth and sniffers to connect to me - posing as an ethernet connection. I have reported it to ACORN - a govt body here in Australia, and Telstra and they have actually acted on it but this only bought me a respite for a few days. The hacker changed or were forced to change their SSID / provider and kept downing me several times one morning. They are simply a t..d who thinks they have some divine right to my computer and internet and to make it generally impossible for me to use the internet productively, and it is damn hard to get on with your life these days without using the internet. As a person with a multisystem disorder of connective tissue, I don't want to be traipsing here and there to do things, I should be able to do online. Also use my bluetoothed hearing aids with TV. They hacked the connection between my remote control unit and the bluetoothed transmitter on the TV and changed dates and times of preset recordings.

You have no argument with me that they are crazy psychopathic dicks. Unfortunately, unless you have encountered such people in your life, they do seem unbelievable. They have no reason to do what they do, they just get their kicks out of damaging other people out of contempt and envy. As I said, I don't know who personally, in a possible 300' radius is doing it. If you don't believe people like this exist, do a reality check and visit the criminally insane ward of a psychiatric hospital some time.

But back to why I came here. Any technical advice? I will check out those programs. Also,if they are hacking on booting a live DVD or shortly thereafter, would a DOS VPN actually stop this part? Although very useful if I can get to that stage and install stuff.

Thank you Habitual, exactly. Sundialscvs, thanks again, I have actually done a lot of this already. At this stage, short of banning him from all internet access, or jail, or psych ward admission, I don't believe they will stop. I think Telstra and the AFP have been able to identify them. Though you could be right,a couple of burly Qld police officers paying this gutless coward a visit, may however do the trick. I don't know who they are for sure. But they may know this.

SzBoardStretcher. Thank you for supporting me on this. I'll try to read those articles.
 
Old 07-08-2017, 06:18 AM   #14
273
LQ Addict
 
Registered: Dec 2011
Location: UK
Distribution: Debian Sid AMD64, Raspbian Wheezy, various VMs
Posts: 7,680

Rep: Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373Reputation: 2373
A few things:
One, Bluetooth often doesn't even work under Linux and most certainly could be switched off before any issues occurred.
Two, if you change the password and SSID on your wireless router to something fairly strong it will take at least a few GB of traffic for your neighbour to find the password if at all. So, change it then install nd update the installed system immediately and you can install and use WiFi without fear of being intercepted, then you can change the password.
Three, if you have any actual evidence of this do as above and contact the police with the evidence.
I tend to think you're mistaken here and you've either some interference issues with WiFi and Bluetooth (such as a leaky microwave), you're not installing the chosen version of Linux correctly or you're mistaking a feature of your chosen distribution for an attack of some kind because you're not familiar with it.
 
1 members found this post helpful.
Old 07-08-2017, 05:58 PM   #15
mazinoz
Member
 
Registered: Mar 2003
Location: Mansfield Queensland Australia
Distribution: Linux Mint - Tara
Posts: 497

Original Poster
Rep: Reputation: 35
273

You obviously have not read the earlier posts eg:

1 I said I don't use wireless or bluetooth. They make a bluetooth to ethernet connection to me as shown in the above image and others I uploaded. Note also how quick the connection was made, even if on this occasion it had not been used yet.

I use ethernet over power line or ethernet including on my tablet. Besides what you say about wireless security reveals a distinct lack of knowledge on how it can be hacked by tools available in many distros of linux.

Bluetooth is most definitely available and usable in linux. If you can't use it, it doesn't mean other linux users can't. It is started by default in LM 18.1 and 18.2 at least.

It is far safer usually to not use wireless connection to change password on the router when ethernet is available. Sniffers.

As I said I have contacted the police, and together with other info they did act. I gave them the location in the street that my tablet would experience repeated DOS attacks and the SSID that showed the connection. One page on the router also showed the SSID of the neighbours connection, and with the tablet I was able to approximate their location.

What makes you such an authority on my experience and knowledge of linux. A microwave would not cause someone’s tablet to make a bluetooth to ethernet connection with my laptop. If anything it would cause disruptive interference.

Quite frankly, your lack of knowledge of linux and wireless technology hacking is astounding. Especially after you have been provided with articles about it. Either that or you are a troll.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Open Source History: Tracing the Origins of Hacker Culture and the Hacker Ethic LXer Syndicated Linux News 0 04-29-2015 08:40 PM
Persistent persistent Persistent Going Nuts Here Fcukinyahoo Linux - Newbie 6 11-17-2011 09:56 PM
is fips destructive? jmite Linux - Newbie 2 06-09-2008 02:25 PM
persistent static routes, not so persistent Hewson Linux - Networking 4 04-27-2007 05:09 PM
how to do a non-destructive repartitioning ? shemjaza Linux - Newbie 13 12-28-2003 01:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:23 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration