iOpus Starr keylogger/spy - how to investigate this hacking?

Hi,

I just found out that someone has installed the iOpus Starr system monitoring tool on my computer. Apparently, this is a fairly advanced software that runs silently and logges everything (keystrokes, passwords, screenshots) and then sends it as an encrypted html file.

Now, this sure seems like a targeted effort to spy on me personally; so I'm more than curious to find out who's behind this... The software can only be installed by a system admin (which would be myself, this is my private computer) or by someone accessing the computer.

Is there any way to find out where the logfile is being sent? Can I at least figure out when this was initiated/installed? Any tips on this would be greatly appreciated...

Regards,

TMM

If you have a spare computer and a hub put Ethereal on it and have it monitor all traffic to and from the machine. Then look for stuff that is happening that you didn't do, email, web access at 03:00am etc. If that doesn't find the traffic, (too much to filter), then we can either add filters to Ethereal or try a different route.

Just remove it. I wouldn't bother trying to track down the culprit.

If he has half a brain it will be being ftp'd to some anonymous half way house.

Mark: Your no fun...... ;)

Now we know he's there we can start f'ing with him...... Much more fun since we can turn him on and off as we please so he won't know what's real and what's not.......

Thanks, guys...

I have a second computer, connected through a WLAN using an SMC Barricade router. The router also has a buildt-in firewall, I wonder if the logs there would do any good?

Quote:

---

Originally posted here by mark_boyle2002
If he has half a brain it will be being ftp'd to some anonymous half way house.

---

I doubt he has "half a brain"... :D Most likely, it's someone who aren't too familiar with hacking, probably someone I know. I'll look into Etheral.

Oooh... Oooh.... If it's someone you know you can _really_ mess with their brain because you know personal details about them. If they have any dirty little secrets you can pretend to be emailing them to others and so on....... You can pretend to be reporting him to the authorities for a computer crime...... Then when you meet them act _really_ friendly and be the best guy in the world to them..... Then watch them..... Funnier than hell...... :D

The possibilities are endless...... Your imagination is the only limit...... And if it limits you drop a line here.... I'm sure some of the people here have a wonderful sense of humor...... ;)

Sounds like a good idea :)

I'd just like to know what the intentions were, I'm not sure if this is a out-of-curiousity kind of thing, or if someone's actually trying to f'k with me somehow. Anyway, I really don't like the idea that someone has passwords etc. and monitors conversations (both personal and business)...

BTW, I discovered this using Webroot's Spysweeper, and it referred to traces in the files zipdll.dll and unzdll.dll in the windows/system directory. Can anything be gathered from these? I wasn't able to upload the .dll format though.

Well.... According to their website, (here ), you can't see what it is he is monitoring or the contents of the log file without his/her password since it is held in an encrypted file. It seems quite sophisticated insofar as it has some nice little features like backdating the log file so poeple who are looking to see if they are being logged by looking for files that have changed in the last x hours won't see the logfile because it's date is much older than that.......

If he is using the built in email then you won't be able to identify him without threatening the company with a lawsuit - reading their site they may be susceptible to a threat since they already state that they can alter or remove the built in mail at will - implying that they understand their risk of lawsuits. If he is using his own email then an Ethereal capture with a filter "port 25" will capture the email address of the recipient since it is sent in clear.

If he is using the LAN option then you need to trap all traffic on ethereal and then determine what _isn't_ your activity - that'll be his - then you have to start tracking from there which is harder.

My guess is he'll be using the email system..... The problem is which one?

I am with you Tiger, back door infections (outside of spy ware) on my personal computers at home, warrant supreme prejudice at the attacker. It's a personal attack on me and the comfort and safety of my home. Messing with this person would be more fun than a nice juicy steak and ice cold Fosters at the Outback Steak House.

I would ask myself this. Do my friends have access to my computer? Have I opened any email attachments lately? Who were they from? Do my friends have any knowledge of this program or Trojans in general? Have I been to any "out of the way" websites lately? Have any of my online buddies asked me for my IP or email? Have any of my online buddies directed me to their "awesome" "l337" website lately? etc etc. And finally IS my wireless LAN secure and DID I take precautions in setting it up or just Plug n Play right out of the box?

I have found a couple real back door programs over the years and EVERY time the loser used a valid email address to mail information back to his account. Tiger_Shark has covered those paths to success.

Road: This is no backdoor "infection"..... This is a paid for, keylogging and spying program that has been deliberately installed by someone with administrative rights to the computer. Now, aside from the "usual suspects", (wife or kids), this narrows down the field quite significantly insofar as it wasn't some nice little attachment in an email that put it there.

What this does say is one of three things:-

1. TMM has done something to make wifey suspicious of him.
2. TMM has placed restrictions an his kids and they want the password to unlock them
3. TMM has someone he knows that wants something that TMM has.

In all these cases I absolutely agree with you..... _extreme_ prejudice is the order of the day. This is no different then placing hidden microphones or cameras in my house. It's an utter invasion of my privacy without a care for me or anyone else who uses the computer. That's a very bad thing....... If it's the wife spying on him then that's easy to catch - wives are easily "baited" into giving the game away with a few suitably typed lies..... The kids are a little more difficult - you could start by sending a fake email about selling them into slavery and see how thier behaviour changes.... ;) but the last option is more difficult and certainly requires a mich greater level of prejudice since they are an outsider.........

As Mr. Deeds would say, "My Bad" I didn't read up on the program and in truth I know nothing about it. I assumed that this program was a Trojan. The fact that is a commercial program installed through administrator privy makes it even WORSE. There are a lot of paranoia adds that directly sabotage the trust between spouses. They show a picture of one spouse doing naughty things that catch the attention of another spouse and make them question why someone spends so much time online. They are as bad as those X10 adds.

A kid wanting access to something is definitely a possibility. Unless they are like 4 and play Bob the Builder games all day. My neighbor’s kid is constantly trying to unlock the DVD adult codes. I don't blame the kids; I would have done the same thing. :D

The 3rd party part is scary. It would make one start to suspect everyone around him.... You definitely have to find out who did it though.

Now before we jump the guy we need to ask this person if they have a wife and/or children and if so they I say go ahead with tigers idea but instead of the whole slavery thing...I would scratch that its not too believeable. I would go more along the lines of military school or boot camp or something. If its an outsider I need you to think about all the confrontatiopns you have had in the past 2 months or so... think of anyone who would believe that you have wronged them in one way or another. Also think of anyone who has asked you for some form of information. I also experienced that people who play game have alot of enemies or just people who want their character, like in runescape if you have a decent character someone would try to get your pw and steal all your stuff, it has happened to me before. So i suggest you step back and take a look at your life and see things a little more clearly. Thats just my idea and yes if you cant uninstall it or trace the program threaten to sue the company who made this program for aiding someone in invasion of your privacy.

Alright so i downloaded this software and im still learning stuff about it but try this...go to your start menu and then run type starrcmd and the program should come up asking for the password if there is one...if not go to the settings tab and click uninstall...if there is a password click search under the start menu and search for the starrcmd file then after you locate it delete it...the program should stop working unless this person found out a way to password protect this file...but i doubt it

Dark: I apologize if I misunderstand you but it isn't TMM we are jumping on..... It's whoever installed the keylogger that needs jumping on. If it's his wife then there are serious problems in the household and I don't even want to go there...... Who knows what or why and it isn't any of my business. If it's his kids then they should be grounded for an appropriate amount of time, (they'll look pretty silly to their friends when they still aren't allowed out to play when they are 35..... ;) ). If it's an outsider then let's have at it....... While the wife and kids can claim some right for doing what they are doing, however tenuous that "right" may be - an outsider has no rights whatsoever and should be taught that lesson in a way that they will never forget it........

I also wouldn't limit myself to confrontations etc. He mentioned that he had work/business stuff on that machine so we need to think about "fellow" businessmen. It does mention on the site that the program is small so it is possible that it was installed remotely but I would still lean towards physical access until I get more info.

Gentlemen, this is the best thread I have followed so far! This epitomises what AO is all about!
We do not like people who do this sort of thing.

I am no expert on this type of software, but I think I know a bit about people. If it is a family member, they would need a reasonable degree of computer literacy?...also, I wonder why they would want to send it out, when they must have local physical access?...anything going out risks interception at the firewall doesn't it?

OKAY, they may have hired a private detective or enlisted the co-operation of a school buddy?

I guess that I am cynical but this looks more like a business associate/rival.

I am very impressed, and glad that I subscribed to AO

Regards

Thanks everyone for your insight, I really appreciate your help on this!

Well, to adress some key points: I live alone, no wife and no children. That means that the only ones with direct access to this computer are my friends and occatinally friends of friends; although the extent of this "friendliness" remains to be seen...

As for the security of my WLAN, I've enabled WEP encryption along with MAC access control; so only approved MAC addresses should be able to gain access. However, the WLAN did run unprotected for a while at first, a little more than a year ago. I've been trying to scan the computer with a couple of anti-spyware utilities (like Ad-Aware) on a regular basis, but this software wasn't detected there, so who knows how long it's been there... What made me try other scanners this time, was that my computer sent out virus-infected e-mails (a worm) the other day, even though I have Norton AV installed (with automatic updates and full e-mail scanning activated). I thought it was strange, because my friends' Norton stopped the very same virus. Also, my computer goes out of stand-by mode by itself during the night...

Does anyone know for sure if this program has to be installed with physical access, or if it could have been placed there using another normal-looking file that I downloaded somewhere?

Quote:

---

I am very impressed, and glad that I subscribed to AO

---

Me too, it's great to get some support concerning this problem, both technically and on the mental level... :)

I'll try the suggested actions, and report back soon...

Thanks,

TMM

TMM: Ok, we can rule out the wife and kids.......

I'm a lot uncomfortable with the unprotected WLAN early on. Having said that, I'm pretty sure that one would need desktop access to install a program like this. If I already have desktop access, (not physical but through PCAnywhere, Terminal Services, RDP or worse some form of RAT), then I'm not sure I would need to go through the trouble and risk of installing a program like this. I'm sure I could come up with something "quick and dirty" to grab the odd password etc.

I'm also uncomfortable with the waking up at night...... I do it all the time myself and it's a pain...... ;) ..... I think we need a little snort box on an old hub to this machine and run a single rule to start with

alert tcp any any -> any any (msg: "Traffic Detected"; Flags: S; classtype: bad-unknown;)

if you have only the snort box and your PC on this hub it will capture all traffic inbound and outbound to it. We can then filter through the alerts to see what was valid, what was questionable and what was definitely invalid. It will also tell you if the WLAN is compromised and the guy is connecting to your machine - which is a possibility.

Do you have the equipment to run a snort box in stealth mode?

TigerShark, what equipment would I need to do this?

Concerning the WLAN, my gut feeling tells me that it's unlikely to be the problem, at least if MAC access control is what it's supposed to be. Although it was wide open for a couple of months (won't happen again!), back then hardly anyone knew what WLAN was around here...

An old computer and a small hub, (not a switch - and remember your WAP probably acts as a switch as well). The go to www.demarc.com , download and install PureSecure on the old computer per the instructions in their documentation section.

Go to the network interface and unbind all the services from it so it cannot respond to anything and therefore will most likely not be detected.

A thought just struck me...... Are you doing this, (chatting here), from the keylogged box??????????

LMAO, not to be a pessimist but if he is that is just funny. Let's plan a plot to catch this guy and tell him all about it. The person must be laughing all along while TMM is typing all this info here. Sorry, I couldn't help but think about it and laugh. Even though I wouldn't be laughing if it happened to me but would have definitely just have said forget trying to catch this guy and reformat reinstall.

Quote:

---

A thought just struck me...... Are you doing this, (chatting here), from the keylogged box??????????

---

No, from my laptop - which according to Spysweeper is clean :) I did of course run that program on my "infected" computer, and spent an hour or so researching the spy software before moving my search (& destroy) efforts to my laptop.

Hmm, I'll try and get a hold of a hub, and I guess the laptop should do...

Phew..... So.... As I was saying...... :D

The laptop will do fine and so that you can use it when you want you should be able to simply disable the interface when you aren't using it and enable it for the short periods that you are to minimize the risk of it's detection. Snort should still work through the disabling of the card because WinPcap doesn't seem to care about what windows says about the card.... It still listens.

In the snort.conf file comment out, (with a #), all the include lines for the rules and add the rule I put in my post above. Move the snort.conf file to c:\pursecure\sensor\bin for simplicity.

The go to a DOS prompt and change to C:\pursecure\sensor\bin and type:-

snort -W

This lists the interfaces. Determine which interface is the active external LAN connection. Running snort -v can help if you have a bunch. The one that shows the traffic is the one to use and then type

snort -iX -T (where X is the interface number you determined was the active above).

If snort doesn't abend..... (quit with an error), then you are good to go. Restart the machine, go to your regular box and try to get to the web. You should see an alert on the laptop saying Traffic detected...... If all is well with that you can sit back and relax and see what little fishies we can catch..... It might take a few days..... so be patient and keep us updated...... We are especially looking for either, odd outbound connections to uncommon ports or outbound smtp, (port 25), connections that you did not initiate. We are also _very_ interested if we see any inbound connections where your box is the destination 'cos the SYN packets we are trying to capture should only be going outbound if you are properly firewalled.

Tiger, thanks a lot, I'll see if I can get it to work when I get up tomorrow - have to go out and consume some beer right now :)

Really appreciate your help on this...