Getting back at a Cracker

My sister just got back from college, and guess what, she's got a keylogger on her computer! AWESOME HUH! Especially since she has entered credit card info, and bank info into the computer in this time that it has appearantly been installed. What i am hoping to do before i uninstall it is just type some BS, the let it try to either connect to a server to upload it's data, or connect to a mail server, when it does this i want either the e-mail he/she is using, or the server's ip adress. I thought it would be pretty easy to do this using a firewall that blocked everything, just look at the logs, if i didn't use the computer for anything, the keylogger should be the only thing that tried to access the network. Is there any way i can route all of my internet traffic through a proxy so that the cracker doesn't also get the IP adress of my home network when it uploads.

How about you change every password, call the bank and change the info and see if he did anything, and uninstall the keylogger and live in peace. Why all the hassle. Maybe he didnt use a keylogger thats sending e-mails, maybe he had physical access to the cmoputer, and if he did use an e-mail address, the e-mail should appear somewhere in the code or settings of the keylogger.

Just for the sake of starting at the beginning, how do you know she has a keylogger installed?

Then the next question would be, how do you know for sure there isn't anything else installed on there that you don't know about?

Rule of thumb (my thumb anyway), if the system has been compromised by something like that...best policy is to format and reinstall... for all you know, what ever it is that you think may be a keylogger may be just a decoy. That's what my evil twin would do anyway :)

There a dozens of sites with lists of proxies on the internet, just do a google search for them. One site I like that has a free somewhat up to date list is http://www.samair.ru/proxy/. I would do everything MemorY suggested.

Calling the bank and changing things is done, i just hoped to get the actual cracker into some trouble. No, nobody had physical access to the comp, she lives on an all girls dorm floor, i've met the girls they're not computer litterate, especially not her roomate. She said that the people who take care of the computers at her school needed to check hers out before they would allow it access to the network again, at first they though she had sasser but then said she had a keylogger. Memory, my first thought was to get a look at the code, but if it's compiled how would i do that, i don't know much about reverse engineering could you help me out here?

Depends with what language it was written....

http://www.google.com/search?hl=en&l...2B+decompilers
http://www.google.com/search?hl=en&l...VB+decompilers
http://www.google.com/search?hl=en&l...23+decompilers
http://www.google.com/search?hl=en&l...on+decompilers
http://www.google.com/search?hl=en&l...esource+Hacker

HOw can i find out what langauge or is it just kindof trial and error?

Quote:

---

Originally posted here by groovicus
Just for the sake of starting at the beginning, how do you know she has a keylogger installed?

---

I kind of think Groove has a good point here.

Good luck.


Edit- I misread the post, as thinking the PC was at home not at school. Sry.


:eek:

Im not much of a programmer....The Resource Hacker may help you there...

visit
http://www.programmersheaven.com/c/M.../grouplist.asp

for more help, it's a forum for programmers, they can help you out more....

I'll try to elaborate just a little more, and hopefully we can help you out.

I still stand by the rule of "If the system is haxored, you need to reformat it." But if you were me, the first thing to do would be to find it. As Galdron said, a virus scan, or whatever. You have to, at the minimum, at least know what you are looking for.

As far as reversing the offending application, that's a bit of an art IMHO. Once I found out what the keylogger was called, I would Google for every bit of info I could find. Chances are that the source code is available somewhere. That would give you a little insight to how the app works.

You are correct in that a firewall set to block everything outgoing would probably nab the logger, if it happens to be one designed to "phone home", as it were. I've tracked down spyware that way before. Some times though, these things are just passed around (email attachments). In that case, a cracker doing random scans would run across it by pure accident. Then they could possibly get the information.

As far as reversing, you would need a disassembler or debugger, of which there are many to choose from. Ollydebug, and W32dasm come to mind, along with IdaPro, or even SoftIce. But in order to understand the output, you are going to need some knowledge of assembly, and of programming in general. If you are so inclined, there are tons of websites dealing with reverse engineering. Although they often deal with reversing software for the purposes of pirating them, the techniques are the same for reversing malware.

For tutorials on assembly, do a Google for Randall Hyde Art of Assembly. His guides have served many well, myself included.

:)
Apart from getting rid of the 'bug', you said you wanted to get even, provided there is someone to get even with. I'd be careful. What you may want to do, is collect as much information about the system and what is installed on it, lets say by ghosting the image.
Quarantine the drive that the image is on. Now you can do a clean install, and have a record, should you be able to track an IP.

I'm not an authority on this, just an idea, albeit the fact that you'd need some resources.
Plus I would contact the authorities if you have a case. You just might help in nabbing someone that has done this to others. But you'll need proof, hence the need to document everything.

Sounds like your sis should have a word with her bank as well. They may be able to give both of you more advice, if at least to protect her account.

edit: sorry, you already contacted the bank....I'll pay better attention...

Hmmm,

What is the name of the keylogger?

I am thinking that before you consider dissembly and anything fancy, it might help to know what it is, how it works, and potentially, how it got there?

There are two basic sorts of keylogger: skiddie stuff and professional software. If it is a professional app, then your sister may have a bigger problem that either of you appreciate at present?

If it is a skiddie tool then there is a reasonable chance that you could pick up the generator toolkit and find out how it works............it may even contain its own decompiler?

Cheers

Maybe you could pick up the packets going in and out with ethereal? That would give you an IP possibly. Nmap for open ports, maybe the keylogger has one opened. Then hit it with a display filter in Ethereal.

Doesn't necessarily mean that anyone connected to it is the person that placed it. If this is college we are talking about, use a display filter to see what ip's in the same network are communicating with the box. Then see which packets are malicious. Hopefully (or not) you can see the logged keys in plaintext in the packets being sent.

She's on a ResNet (residents network), on my ResNet last year it was a constant battle to prevent attacks, I had attempted DoS and Intrusions most days, which was fun :-)

It really wouldnt surprise me if someone had had physical access to her computer, especially at my place I figured out a way to open any corrdior door within about 4days of arriving.....which led to them "patching" the doors, because some plank used it in front of some offical...I wasnt arsed cos it needed doing (We only did it for pranking the girls corridor..once my corriodor made ice cubes in 2 curver box's that were about 2ft x 1.ft x about 1ft deep to place in someone elses toilet....(don't ask me why uni's such a random place)), people also took great pleasure in reversing the program called virtual gay and placing that on the desktop so it couldnt be removed, which led to a little bloke dancing around naked on your screen, and also changing the desktops was a common "trick".

so anyway back to my point! your sisters security needs to start at a physical level, this is key...set up a BIOS password and logon password, turn the computer off when its not in use. Then get a spyware (ad-aware) removal program, AV (norton anti-virus), firewall (sygate).

The ones in brackets are programs I would recommend and have used personnally.

Has she turned off network sharing?? Its easy to create a batch files to scan an entire campus to find people with network shares open, so she needs to switch this off.

i2c

Okay right now the computer is sitting downstairs, with zone alarm running, not allowing ANYTHING to access the network, i ran antivirus and it found nothing. If i actually do get the ip adress of a server out of this (and it's not just a proxy) what are the chances of me actually being able to get the kid back. (i assume it's a kid because you've got to be a pretty big lamer to install a keylogger on some random girls computer)

Quote:

---

If i actually do get the ip adress of a server out of this (and it's not just a proxy) what are the chances of me actually being able to get the kid back. (i assume it's a kid because you've got to be a pretty big lamer to install a keylogger on some random girls computer)

---

0 Chance

Please answer some of the questions that we asked you earlier, perhaps we can get somewhere once those questions are answered.

new_

Just some food for thought. Some animals hunt in packs. If you decide to take action on your own. Your skill set better be pretty good or you'll find all kinds of challenges awaiting you. Additionally, you will most likely get hit from all sides so to speak.

Some great advice has been passed onto you. Heed those previous posts about isolating, cleaning, and prevention etc.

cheers.

Quote:

---

what are the chances of me actually being able to get the kid back

---

Judging by the level of your questions, Zero. If you do happen to get an IP, how will you be able to tell if it's a proxy or not?

Keyloggers are, for all practical explanations, not viruses. They have perfectly legitimate uses such as workplace monitoring. Hence, I'm not surprised an anti-virus turned up nothing. And since you don't even know for sure what it is you are looking for at this point, you may have the horse pushing the cart at present.

Try going to your cmd window and run <netstat -an> and see what ports are open and listening...post back your results..(If I got that wrong, someone please correct me, I hardly ever use it)

As for actually getting back at the person who did it, unfortunately, unless an actual crime has been comitted, you are S.O.L.. If it was bonced through a proxy, you will need to be able to procure search warrants for the proxy, and they don't just sell 'em at Wal-Mart. Even if you were able to trace it back to a specific ISP, again, the search warrant issue comes into play.

As nihil stated above, depending on the "strength" of the application, your results are going to vary anyway. If it's a kid, nothing is going to happen. Chances are you are the one that is going to get in trouble. If it's a professional type keylogger, then it may have a means for tunneling through the firewall, and may at this moment be transmitting data back. And if it is professional strength, you will need law enforcement involvement.

I'm sure others herer are willing to help you track down your 'nasty'; we all love a good puzzle, but as far as getting back at anybody, forget it. It just isn't going to happen.

EDIT: I can understand your enthusiasm though, it's just we need to be realistic. You have an entire cavalry here to help you find and remove your malware, but as far as helping you get back, the cavalry knows better, and will leave you with boots swinging in the breeze. :D

Groovicus has the correct answer.....

If you have to come here to ask how to find your enemy then you probably don't have the level of skill to protect yourself properly when you do. That being the case, you create two victims rather than one.

Best to use the old adage of the First Aider, (responder), here..... Don't put yourself in danger.... Add to that Sun Tzu.... Know your enemy...... You are missing stuff in both areas IMO.... Thus, format the box, reinstall from trusted media, protect it for the future and move on..... It isn't really worth the grief......