I even have 3 wifi networks at home. Domestic, Home with tunneling for the company and for guests.
Unfortunately, the percentage of society is aware of the need to do something like this, and even less can do it. And few appliances with a good value for money can do it. Manufacturers of home appliances have done quite a lot in terms of security, resigning from admin / admin some time ago in favor of random passwords. But still not all of them.
... The manufacturers of home appliances did quite a lot in terms of security, giving up admin / admin some time ago for random passwords. ...
Seemingly so simple and effective.
I will not write you how many networks and what networks I have at home. Of course, this is not an ideal, but in my case even children have their own, separate network. Separating this network (apart from the safety of other users) is also the ease of parental control.
Unfortunately, in today's world, parental control is a serious problem and sometimes someone appears on the Electrode who asks about such things, but the others ... have no idea what the threats are and even if they are aware, they cannot protect their children against these threats .
Well colleagues guess. In a nutshell, I was sharing a wifi and router with someone. I was implicitly implied that he knew what I was watching. Due to the circumstances of my work, I did not take any radical measures. However, due to the situation related to the crown, the working conditions deteriorated, so I decided to quit. When I didn't care, I typed provocative content into google that I knew would interest the listener. Not only for adults. But about music and the current situation. So what? On the second day, of course, completely non-accidental comments about the search results also you can ....
Now I have another question. Now that we know what it looked like, are my social networks and online banking safe? Listening to an amateur, I suspect a wireshark program just like you wrote.
Well colleagues guess. In a nutshell, I was sharing a wifi and router with someone. I was implicitly implied that he knew what I was watching. Due to the circumstances of my work, I did not take any radical measures. However, due to the situation related to the crown, the working conditions deteriorated, so I decided to quit. When I didn't care, I typed provocative content into google that I knew would interest the listener. Not only for adults. But about music and the current situation. So what? On the second day, of course, completely non-accidental comments about the search results also you can ....
Now I have another question. Now that we know what it looked like, are my social networks and online banking safe? Listening to an amateur, I suspect a wireshark program just like you wrote.
Sooner you have a logger on your computer that records and sends to it what you type on the keyboard. Through a router or flying packets, such a man will not dig up the encrypted content flying via the https protocol to the google server. Such a logger on the computer will also suspect the banking password you enter or Facebook. The human factor is the weakest. I would look that way.
Do the test again, but download linux ubuntu for example, burn the boot disk to a USB, and run in test mode, without installing, it will ask on startup. And then search for something very characteristic in google.
Also check in the browser whether the opened pages have the correct certificates.
The certificates in the browser are important. Can a logger be localized with an antivirus? I scanned the computer and the smartphone, there is nothing.
The certificates in the browser are important. Can a logger be localized with an antivirus? I scanned the computer and the smartphone, there is nothing.
Each antivirus will locate what it can locate. It's worth using a few pluses in that case. Personally, I would reinstall the system from scratch in such a situation. Has changed passwords.
The certificates in the browser are important. Can a logger be localized with an antivirus? I scanned the computer and the smartphone, there is nothing.
Certainly not everyone. This depends largely on what mechanisms (how much 'invasive' -> reminiscent of antivirus heuristics known attack methods / contamination / etc) the author used. Besides - you should also take into account the optimization of all known antiviruses on the so-called 'Actual threads', i.e. that it is impossible to keep ALL known threats in the virus database (and virus-like mechanisms) in the database, so companies producing antiviruses make certain selection. What is currently "on top" in the world region - and these things are mainly recognized. Hence (also) a whole lot of frequent updates (even daily), with every thrust, as the situation and attack vectors change a bit - the company not only adds new signatures to the base but also profiles anti-virus behavior a bit.
Hence, as a colleague wrote
m.jastrzebski wrote:
Each antivirus will locate what it can locate. It's worth using a few pluses in that case. Personally, I would reinstall the system from scratch in such a situation. Has changed passwords.
- it makes sense to use several at once. Well, maybe NOT AT A TIME - but sequentially = HERSELF. So one that has a colleague installed "permanently" in the system, and EXTERNAL scan the disk with a few others running from another disk. this will greatly reduce the possibility of not catching something really nasty.
This is the first method.
Second (although not mutually exclusive with the first!) is the use of a few dedicated programs for tracking and / or removing all kinds of keylogger tracking software, etc. Unfortunately, I am currently not very up-to-date with the names of such programs, because I hardly use them. In the past, I did it sometimes, but sometimes (with some programs) I had suspicions that, on the one hand, they catch and remove a lot, but on the other hand, they add their own, not necessarily desirable 'add-ons' ... you have, unfortunately - everything is "No warranty" and "on your own risk".
UPD: and once upon a time - it was here on the Electrode forum - it was the custom of users who were concerned about their systems to throw logs from, for example, Hijackthis. Logs that some colleagues - then devotedly browsed and gave opinions on the basis of "I have nothing to fear or not".
and third method . The most difficult, requiring a bit of experience and knowledge of the "kitchen system", but probably the most effective. At least in many "weird, hard-to-define situations that not every antivirus is bathed in ... you know "
It is the use of a set of low-level tools specially created for this purpose (not strictly - chasing burglars, but taking care of the system and its mechanisms). I mean the software from the System Internalls Suite (Mark Russinovich) stables, previously released only under its own brand (www.sysinternalls.com) and currently in the colors and with official support of M $. (See https://docs.microsoft.com/en-us/sysinternals/, https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite). The package includes a lot and really "wonderful" if anyone is in it - tools for administrator developers and even security guys. I don't want to write about the whole package because that's not what I mean. I would like to focus on two (three) programs, the most useful for tracking what is happening in the system and for catching any anomalies.
1) Process Explorer
This is a great tool that allows you to track exactly WHAT is happening in the system in terms of running processes and their threads (when you select a process in the bottom pane, you can trace its threads, handles and in the new Properities window - practically most of the running environment with its runtime parameters, paths , threads, TCP stack, resoruce'ami and many other necessary information). This is the essential tool for tracking what's squeaking in the grass. At least roughly.
2) Process Monitor
This is the second, but great and much more accurate (detailed) tool mainly used to monitor processes and their behavior in the IRT mode - IN REAL TIME. This is very important, because even if we know, we recognize a specific process - using only Process Explorer we cannot say with complete certainty "what it is doing at the moment", it did and, sometimes, what it triggered (eg in the background). And here we have practically 100% control over these very matters - i.e. we can find out by analyzing thousands (even tens of thousands) of detailed calls, stack references, opening specific files, writing to them, transmitting between processes and networks - what a given process actually does in the system. Of course, in Real Time - it is practically not comprehensible for anyone (unless you have the data processing power at the Deep Blue level, and your eyes work with refreshing 1000+ fps ) - but you don't need to do this with an IRT. It is enough to run a process or even a program - about which we have serious suspicions that something is wrong "on the previously enabled Process Monitor - which tracks all calls and saves them on a long list - then stop monitoring after a while, disable the suspicious program and then on calmly look at what he was doing for the past fifteen seconds. then you see all the writing to files, reading, calling sub-deals (with their full information, network references and all that tasty rest And this way you can find, for example, how an application suddenly uses an encryption module (subroutine) and "writes on the disk" - and if we know it and know that it should not do anything like that - it is an automatic candidate to suspect "that someone may here he dropped something "and continued research. but then we have WHAT to research - because the logs from such an IRT scan are really plentiful! \
Suffice it to note - that in the second photo the records are ONLY about 0.03 seconds of "system life" .... And then I didn't do anything particularly burdensome on it - just a browser, a few applets in practical sleep, a few SSH sessions and that's all . You can imagine what happens when it really works ... :P
But back to the topic. Well, each of these entries is very well documented, you know what the process (or actually one of its sub-threads - it decided to do it and on what resources it did it), so if we know our browser at least a bit - we know where it keeps the configuration files , where the cache, and other mechanisms it uses - if during this recorded work we catch sudden references to some external files that we have never seen before referring to - then this is the basis for being interested in such files. When were they created? Or maybe you can see what they do (e.g. call them from your finger and see what errors they spit ...? And besides, having e.g. references to the TCP stack, or data from traffic performed by processes ( / threads) you can then, for example, monitor network traffic with Wireshark - check at least who they are talking to, probably such a keylogger will HAVE to somewhere data / reports on activity at Send the tracked user. Sometimes the authors of such cheap solutions do not put much effort into encrypting such transmissions even ...
And so slowly, along the thread to the ball. I do not promise that a colleague will immediately find his Eldorado, but sometimes you can find, for example, traces of an infection, or even someone's activity.
I wrote about 3 programs and here is the third:
3) Autoruns
This tool, in turn, presents virtually everything that is run automatically during system START. And not only from the appropriate folders / keys such as autostart, but in general with all mechanisms available in windows (mainly based on the system registry, but not only) It is really a very powerful "and helpful" tool, in tracking how some programs do themselves and without the knowledge of the user installing them - they can install various unnecessary services, 'auto-starters', mechanisms that make sure that the user does not disable something, etc. etc. With its help, you can sometimes catch some attempts to defend the program against deletion / deactivation - attempts that no such normal utility program should do ... Once I found in one of the soft software over 20 equal processes (subprocesses) that only ensure that none of them was turned off. And if it was left immediately under a new, random process name - they would run it. After all - they had some common features - such as the size of the executable code and some common references. Clever - but not much :)
Another time, I noticed a system brushing like this - strange processes resembling the deceptively known and respected symanteca toolkit at the time - but having nothing to do with it. these were also malware files / processes as I came later.
For my part - I can also recommend Mark Russnovich's blog - https: // techcommunity.microsoft.com / t5 / windows-blog-archive / bg-p / Windows-Blog-Archive / label-name / Mark% 20Russinovich - which in an accessible way teaches you how to use many of its tools efficiently and effectively. There are also attractive webinar materials or recordings from YT conferences, e.g.
Of course, the entire Sysinternall Suite - it's much more than just 3 tools - but due to the framework of this post, I focused on a short presentation of these.
[For now, this is where the Cat jumped on my desk and purrs attractively begging for tenderness ]
The discussion revolves around the ability to monitor search history and current connections of devices on the same WiFi network through router access. Key points include the potential for eavesdropping on unencrypted traffic using tools like Wireshark, the limitations imposed by HTTPS encryption, and the necessity of router configurations that allow logging of traffic. Users mention specific router firmware like OpenWRT and Tomato that can facilitate monitoring. The conversation highlights the importance of network security practices, such as using different passwords for WiFi and router access, and the risks associated with sharing WiFi with untrusted users. Concerns about privacy and the implications of network monitoring are also raised, particularly in shared living or business environments. Summary generated by the language model.
also you can ....
"
) - but you don't need to do this with an IRT. It is enough to run a process or even a program - about which we have serious suspicions that something is wrong "on the previously enabled Process Monitor - which tracks all calls and saves them on a long list - then stop monitoring after a while, disable the suspicious program and then on calmly look at what he was doing for the past fifteen seconds. then you see all the writing to files, reading, calling sub-deals (with their full information, network references and all that tasty rest 
