I've been hacked...

[eidairaman1]

Seriously, I'd just erase all the machines that may have been compromised (after getting important stuff off first, of course). Starting from scratch with a strong security policy (e.g. all admin accounts are passworded) is the only way to create a good foundation to work off of. Whenever a computer is compromised, only one hole has to be missed for it to be compromised again.

Id disconnect the ethernet cords, and the phone cord/cable and cycle power on the modem for a fresh IP.

 

[Kursah]

I dont allow my ssid to be transmitted. I have to tell someone what it is.

Even when SSID's aren't set to broadcast, they still send a transmit out at intervals and can be seen by those that are looking.

Want proof? Download Acrylic Wifi Free which is a wireless detection and monitoring program for Windows. You'll see whatever your wireless adapter does over the air.

There's also other programs and options that can do the same thing relatively easily. SSID hiding is a great supplement to other security measures though! Don't get me wrong I support it, but it is surely no solution on its own.

Also, double-posting are we?

 

[Frick]

Considering Teamviewer got badly hacked in June last year I wouldn't have that anywhere near my PCs (especially as the company initially denied any problems, then later admitted that something didn't seem right with how many accounts were compromised).

Off topic a bit, but I think that hack turned out to be a case of people reusing passwords.

 

[silkstone]

I dont allow my ssid to be transmitted. I have to tell someone what it is.

For anyone who wants to hack your network, not broadcasting your SSID will not hinder them in the slightest.
Most of the security blogs I have read say not to do this.

From my reading, again I'm no expert, the best way to secure a home network seems to be to set up an unbridged guest wifi for visitors.
Make sure that firmware is patched and use strong passwords and encryption.

@hat were you using WPA2-Personal with AES (No TKIP) for your wifi security? Anything else can be hacked from what I've learned.

 

[revin]

port scan or ping my IP

Steve Gibson has a nice online tool for that at GRC, ShieldsUp. This is just using COMODO thru my ATT router

what IP/machine is connecting and sending packets to what IP/Machine on the internet

For real time monitoring maybe Process Lasso or even Comodo Kill Switch good to watch and track what's happening also?

consider running standard user accounts and have a locked down admin account you use to enter credentials for when you need to install or modify something. That will help quite a bit.

This is what I have heard the most by far that is a real good defense to the hackers, and make sure in Explorer view properties check box's to "keep system files and folders Hidden" and "Hide protected operating system files"

 

[Ahhzz]

Steve Gibson has a nice online tool for that at GRC, ShieldsUp. This is just using COMODO thru my ATT router

For real time monitoring maybe Process Lasso or even Comodo Kill Switch good to watch and track what's happening also?


This is what I have heard the most by far that is a real good defense to the hackers, and make sure in Explorer view properties check box's to "keep system files and folders Hidden" and "Hide protected operating system files"

This, this, a thousand times this. GRC has been running this site forever, excellent tool, and excellent software.

 

[hat]

Yeah, I know about ShieldsUp! Nothing was open, everything reported Stealth. I've been busy doing this and that... changed my wifi password, checked all the computers (except the suspect laptop of course... I can never get a chance to get to it).

I flashed Merlin to my router, but I went back to stock firmware because I like manually assigning DHCP addresses and Merlin won't do that. There's an option for it, but as soon as I hit apply, the circling "Applying Settings" just stays forever. If I refresh the page, log back in to the router settings... the settings don't stick. I'm still not sure what security advanced firmware might offer me though...

 

[Solaris17]

It looks already pretty covered but what you need is more secure practices not more secure hardware.

 

[silkstone]

It looks already pretty covered but what you need is more secure practices not more secure hardware.

Yeah, I know about ShieldsUp! Nothing was open, everything reported Stealth. I've been busy doing this and that... changed my wifi password, checked all the computers (except the suspect laptop of course... I can never get a chance to get to it).

I flashed Merlin to my router, but I went back to stock firmware because I like manually assigning DHCP addresses and Merlin won't do that. There's an option for it, but as soon as I hit apply, the circling "Applying Settings" just stays forever. If I refresh the page, log back in to the router settings... the settings don't stick. I'm still not sure what security advanced firmware might offer me though...

I'd say that getting to the laptop is a priority. It is highly unlikely that you were hacked via WiFi, assuming you were using WPA2.
It's just as unlikely that you were hacked over WAN, with no ports showing and the built-in firewall and (i'm guessing) non-default router pw.

One more thing to do is to disable uPNP, it's been a known exploitable feature in the past and, though it should have been patched, you won't generally need it and make sure that you keep your router's firmware up-to date.

The security that open source firmware grants is that exploits are patched pretty quickly and generally, it just doesn't have many when compared to stock.
DD-WRT has a huge user base and anything exploitable is usually caught and patched quickly. You also get other security features, like only allowing certain MAC addresses to connect over wifi as well as the ability to set-up a guest (unbridged) wifi connection for visitors. You might like to try a slightly older Merlin build to see if the problem is persistent in that and report the issue as a bug on the forums.

If I had to guess what happened, and assuming the laptop comes back clean, you might have given a friend/visitor your home wifi password who then went on to share it with the person that hacked you.
It is a very good idea to set up a separate signal for guests.

 

[hat]

UPNP is always disabled, as are guest networks. Nobody would have had our password either... but I changed it anyway, just cause. Non-default router password as well... changed that also.

I did go back a few versions with Merlin... the problem persisted. :/

 

[silkstone]

Then I highly suspect that there is something on the Laptop. Possibly a R.A.T. or even just a key-logger.

It would take a lot of skill, and knowledge of 0-day exploits, to hack a home network with non-default admin password and WPA2 wifi protection.

One other thing that is recommended is to choose a subnet other than 0 or 1. For example, choose something like 192.168.x.13 for your router. Some malware works on the principle that your router's address is 192.168.0/1.1.
I doubt that was the problem in your case, but as you are re-securing your network anyway, there's no reason not to.

Guest networks are actually set up for security. They aren't bridged with your LAN so giving out the password to it, wouldn't compromise security. If you never have any need for visitors to use your wi-fi connection, then I guess there is no reason to set one up.
If you ever think you will though. You should.

Also what you said here:

"I'm thinking it has to be some sort of exploit or sneaky virus... the kind that might be hidden in something else (like an image). Apparently there's spooky things going on with that laptop that sounds like remote control to me. I have an RTN66R. I'm sure it's capable of nifty things with a custom firmware... but most of that stuff is over my head, at least at this time."

Tells me that you need to take a look at your fiancee's laptop ASAP. All the work you are doing now to secure your network will be for nowt, if they have got a remote access tool on your other half's computer.