Cryptojacking, home-network intrusion, stalkerware, and identity theft recovery

guides/home_network_intrusion/phase_0.md

@@ -0,0 +1,54 @@
+---
+profile: home_network_intrusion
+phase: 0
+title: "Before You Touch Anything"
+automatable_steps: []
+human_only_steps: [1, 2, 3, 4]
+estimated_time: "15 minutes"
+---
+
+## Step 1: Decide whether this is a safety situation first
+
+If the person who may have got in is someone you know — a partner, an ex, a
+housemate, a family member — stop and read this before doing anything else.
+
+Cutting off someone's access tells them they have been found out. If that
+person has ever frightened you, the safest order of operations is different
+from the technical one, and it is worth getting help planning it. In the US,
+the National Domestic Violence Hotline is 1-800-799-7233. The Coalition
+Against Stalkerware (stopstalkerware.org) lists services in other countries.
+
+If it is a stranger, a neighbour, or you have no idea, carry on to Step 2.
+
+## Step 2: Write down what made you suspicious
+
+On paper, or on a device that has never been on this network. Slow computers,
+fans running constantly, a hot laptop doing nothing, unfamiliar devices in the
+router's list, logins from places you have not been, someone knowing things
+they should not. Note dates if you have them.
+
+This matters for two reasons: it is what tells you whether the problem is
+fixed afterwards, and it is the beginning of a record if this ever becomes a
+police report or a legal matter.
+
+## Step 3: Find a device and a network you can trust
+
+You will need somewhere safe to change passwords from, and it cannot be a
+device on the affected network. A phone on mobile data — with mobile data on
+and Wi-Fi switched off — is usually the easiest option. Use it for account
+changes throughout this guide.
+
+Do not change important passwords from a machine you have not yet cleaned. If
+something on it is recording keystrokes, you are handing over the new password
+as you type it.
+
+## Step 4: Understand the order and why it matters
+
+The rest of this guide goes: reclaim the network, then clean the devices, then
+rebuild the accounts.
+
+That order is deliberate. Cleaning a laptop first and then reconnecting it to
+a network someone else still controls means starting again. Changing passwords
+first, on an unclean machine or an intercepted network, means handing over the
+new ones. It is slower to do it in this order and much faster than doing it
+twice.

guides/home_network_intrusion/phase_1.md

@@ -0,0 +1,62 @@
+---
+profile: home_network_intrusion
+phase: 1
+title: "See Who Is On The Network"
+automatable_steps: [1, 2]
+human_only_steps: [3, 4, 5]
+estimated_time: "45 minutes"
+---
+
+## Step 1: Inventory the devices on the local network
+
+Run the profile's local-network checks. `lan_device_inventory` lists every
+device that has recently talked to this computer, with the manufacturer behind
+each hardware address where it can be identified.
+
+Two things to know before reading the list. It only shows devices that have
+been active recently, so it can be incomplete — the router's own admin page is
+the authoritative list. And modern phones deliberately use a different,
+randomly generated hardware address on every network, so a phone will not
+match the address printed on its box. That is privacy behaviour, not an
+intruder.
+
+## Step 2: Check whether anything is intercepting traffic
+
+`arp_spoof_check` looks for the specific pattern that traffic interception
+leaves behind: one device answering for addresses that belong to others,
+usually the router's.
+
+If it reports gateway impersonation, treat the network as actively monitored.
+Stop using it for anything sensitive until Phase 2 is done — no logins, no
+password changes, no banking. Switch to mobile data for those.
+
+Mesh systems and Wi-Fi extenders can produce the same pattern legitimately. If
+you have one, that is the likely explanation; confirm it before panicking.
+
+## Step 3: Name every device on the list
+
+Go through the inventory one line at a time and say what each device is out
+loud: phone, laptop, TV, printer, thermostat, doorbell, games console, smart
+plug. Most households are surprised by the count — twenty is normal now.
+
+For anything you cannot name, unplug or power off a suspected device and
+re-run Step 1. The entry that disappears is that device.
+
+## Step 4: Cross-check against the router's own device list
+
+Sign in to the router (Phase 2 covers how) and open its list of connected
+devices — it may be called Attached Devices, Device List, Client List, or
+DHCP Clients. It shows devices your computer has not spoken to, which the scan
+in Step 1 cannot see.
+
+Compare the two lists. Anything on the router's list that you cannot account
+for is the thing to focus on.
+
+## Step 5: Do not bother blocking devices by hardware address
+
+Most routers offer MAC filtering, and it feels like the obvious answer. It is
+not: a hardware address can be changed in seconds, and blocking one only tells
+the intruder which address to stop using.
+
+The change that actually removes everyone you have not authorised is a new
+Wi-Fi passphrase, which is Phase 2.

guides/home_network_intrusion/phase_2.md

@@ -0,0 +1,88 @@
+---
+profile: home_network_intrusion
+phase: 2
+title: "Take The Router Back"
+automatable_steps: [1]
+human_only_steps: [2, 3, 4, 5, 6, 7, 8]
+estimated_time: "1 hour"
+---
+
+## Step 1: Audit what the router is offering to the network
+
+Run `router_security_audit`. It checks which administrative services your
+router is offering to every device on the Wi-Fi — remote login services, the
+admin page, provider management interfaces — and whether UPnP is enabled.
+
+Everything after this step happens in the router's own settings, because the
+settings that decide whether someone can get back in are not visible from
+outside it.
+
+## Step 2: Sign in to the router, ideally over a cable
+
+Connect a computer to the router with an Ethernet cable if you can, so the
+next steps do not travel over a network someone else may be watching. Then
+open the gateway address the audit reported in a browser.
+
+If the admin password is still the one printed on the underside of the router,
+assume the router has already been reconfigured by someone else, and read
+every setting below rather than trusting any of them.
+
+## Step 3: Update the firmware first
+
+Look for Firmware Update, Router Update, or Administration. Install whatever
+is offered and let it reboot.
+
+Do this before anything else. If the router has a known vulnerability, new
+passwords do not help — the way in was never the password.
+
+## Step 4: Change the admin password and the Wi-Fi passphrase
+
+Two different passwords, both long, neither used anywhere else:
+
+- The **admin password** protects the router's settings.
+- The **Wi-Fi passphrase** is what devices use to join.
+
+Set the wireless security mode to WPA3. If the router does not offer it,
+WPA2-AES (sometimes shown as WPA2-PSK AES) is acceptable. Never WEP, never
+WPA/TKIP, never open — those are broken and can be cracked in minutes by
+someone parked outside.
+
+## Step 5: Turn off WPS
+
+WPS lets a device join using an eight-digit PIN instead of the passphrase, and
+that PIN can be broken offline. Leaving it on makes the strong passphrase you
+just set irrelevant. Turn it off.
+
+## Step 6: Turn off remote administration, and check the DNS servers
+
+Find Remote Management, Remote Access, Web Access from WAN, or cloud
+management, and turn it off. The router's settings should only be reachable
+from inside the house.
+
+Then open the Internet or WAN page and look at the DNS servers. They should be
+your provider's, or a resolver you deliberately chose (for example 1.1.1.1 or
+9.9.9.9). Anything else means someone redirected every device in the house to
+a name server they control — every phone, TV, and laptop, without touching any
+of them. Reset it if it is not what you expect.
+
+## Step 7: Clear out port forwarding, DMZ, and the guest network
+
+Delete every port-forwarding rule you did not create yourself, and switch off
+any "DMZ host". These are open doors from the internet to a specific device
+inside the house, and UPnP can create them automatically on a program's
+request.
+
+Check the guest network too. An open guest network with no password is a
+second way onto the same hardware.
+
+## Step 8: If the settings will not stick, factory reset
+
+If changes do not save, or old settings reappear, the router itself is
+compromised. Hold the reset pin for 30 seconds to factory reset it, then set it
+up again from scratch.
+
+Do not restore a saved configuration backup — that restores the intruder's
+changes along with yours. Set it up by hand.
+
+When the router is done, re-run Step 1 and Phase 1 to confirm the network
+looks the way you expect.

guides/home_network_intrusion/phase_3.md

@@ -0,0 +1,92 @@
+---
+profile: home_network_intrusion
+phase: 3
+title: "Clean The Devices"
+automatable_steps: [1, 2, 3, 4]
+human_only_steps: [5, 6, 7]
+estimated_time: "1-2 hours per device"
+---
+
+## Step 1: Look for cryptocurrency mining
+
+Run `crypto_miner_detect` (macOS) or `win_crypto_miner_detect` (Windows).
+These look at what is running right now: miner process names, command lines
+containing a mining pool or a wallet address, and live connections to mining
+pool ports.
+
+Mining is what a hot, loud, slow machine usually turns out to be. It is also
+rarely the first thing that happened — it is what someone does with access
+they already had, which is why the rest of this guide exists.
+
+## Step 2: Find what restarts the miner
+
+Run `crypto_miner_persistence`. Killing a miner achieves nothing if a startup
+entry launches it again a minute later, and that is the normal arrangement.
+
+This check looks at startup items, scheduled tasks, cron entries, service
+definitions, and shell startup files for mining commands, and for the miner's
+own configuration file — the one containing the pool address and the wallet
+being paid.
+
+Note down the wallet address before deleting anything. It is the clearest
+evidence of what was happening.
+
+## Step 3: Check the browser
+
+Run `browser_cryptojacking_check`. Mining does not need to be a program: a
+browser extension can mine for as long as the browser is open, and process
+lists will only ever show Chrome.
+
+This checks installed extensions for mining code, startup pages set to mining
+sites, and hosts-file entries pointing mining domains somewhere unexpected.
+
+## Step 4: Check who else has access to the machine
+
+Run `stalkerware_scan`, `remote_login_check` (macOS) or
+`win_remote_access_audit` (Windows), and `process_scanner`.
+
+Three different things come out of this, and they need to be told apart:
+
+- **Monitoring software** sold for watching another person. If nobody told you
+  it was there, someone installed it to watch what you do. Re-read Phase 0
+  Step 1 before removing it.
+- **Remote access tools** — TeamViewer, AnyDesk, VNC, ScreenConnect. Ordinary
+  software that gives someone complete control of the screen. Common leftovers
+  from "tech support" phone scams.
+- **Adware and fake cleaners**, which are a nuisance rather than surveillance,
+  but tend to arrive by the same route.
+
+## Step 5: Remove in the right order
+
+For each thing found:
+
+1. Record it first — a screenshot, the file path, the date.
+2. Remove the startup entry, then reboot.
+3. Delete the program itself.
+4. Re-run the checks.
+
+If something reappears after a reboot, stop. Something else on the machine
+still has enough privilege to rebuild it, and removing symptoms one at a time
+will not get ahead of it. That is the point at which a full operating-system
+reinstall is the faster and more certain option.
+
+## Step 6: Do every device, not just the interesting one
+
+Everything that was on the network needs looking at: every laptop and desktop,
+phones and tablets, and the devices nobody thinks of as computers — the TV,
+the streaming stick, the cameras, the printer, the smart speakers.
+
+For the ones you cannot scan, the practical action is the same: install
+pending updates, change any password associated with them, and factory reset
+anything that behaves oddly. Cameras and video doorbells deserve particular
+attention, because access to them is access to the inside of the house.
+
+## Step 7: Consider a clean reinstall for the worst device
+
+A full reinstall is the only way to be certain, and on the machine that was
+most affected it is often less work than repeatedly chasing things that come
+back.
+
+If you do it: back up documents and photos only, never applications or system
+settings, and never restore a full system image made while the machine was
+compromised.

guides/home_network_intrusion/phase_4.md

@@ -0,0 +1,69 @@
+---
+profile: home_network_intrusion
+phase: 4
+title: "Rebuild Accounts And Keep Them Out"
+automatable_steps: []
+human_only_steps: [1, 2, 3, 4, 5, 6]
+estimated_time: "2 hours, then 15 minutes a month"
+---
+
+## Step 1: Only now, change the passwords
+
+The network is reclaimed and the devices are clean, so a new password will not
+be captured the moment it is typed. Work from a device you trust.
+
+Order matters: email first, because it is the reset path for everything else.
+Then banking and payment accounts, then anything storing personal data, then
+the rest. Each password long, unique, and stored in a password manager rather
+than remembered.
+
+## Step 2: Turn on two-factor authentication, starting with email
+
+Use an authenticator app rather than SMS where the choice exists — text
+messages can be redirected by someone who can talk a phone company into moving
+a number.
+
+Save the recovery codes somewhere that is not the device you are protecting.
+
+## Step 3: Sign out everything else
+
+Every major service has a page listing active sessions and connected devices —
+look for "Where you're signed in", "Devices", or "Security activity". Sign out
+of everything, everywhere, and check the list of connected apps while you are
+there.
+
+A password change does not always end sessions that are already open. This is
+what actually removes someone who was still signed in.
+
+## Step 4: Check the accounts attached to the house, not just to you
+
+These get missed, and they are how people get back in:
+
+- The router's own cloud or mobile-app account.
+- Cameras, doorbells, thermostats, smart plugs, and speakers.
+- Streaming and TV accounts.
+- Any shared family account, and any account where the recovery email or
+  phone number is someone else's.
+
+For each, change the password and look at who else it is shared with.
+
+## Step 5: Separate the things that do not need to be together
+
+Two changes that make the next attempt much harder:
+
+- Put smart-home gadgets and cameras on the guest network, with its own
+  password. Cheap devices are the usual way in, and the guest network keeps
+  them away from your laptops and files.
+- Keep the router's admin password different from the Wi-Fi password, so
+  giving a visitor the Wi-Fi password does not give away the router.
+
+## Step 6: Set a date to check again
+
+Put a reminder in the calendar for a month's time and re-run this profile.
+What you are looking for is whether the device list has grown, whether anything
+is intercepting traffic again, and whether mining or monitoring software has
+come back.
+
+If it has come back after all of this, the entry point was never found. That is
+the point to bring in a professional rather than going round again — and if the
+person who got in is someone you know, to go back to Phase 0, Step 1.