• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Protect home network

S

slash

Weaksauce
Joined
Mar 5, 2004
Messages
108
A friend of a friend asked for help protecting their home network, which also contains their home business pc's. A family member setup and installed all the hardware. They since have had a falling out and comments have been made about corrupting their files/systems. The family member has a bachelors degrees in IT, although I don't know what field. All I know is they have 5 pc's, some using wireless, with cable broadband and a router. I think the os being used is XP. I informed the person that it was likely the family member had access to the network remotely, most likely without them knowing. I imagine someone with a degree would setup a VPN or such. To prevent access while they aren't in their office I suggested turning off the router, hopefully preventing access. I recommended they consult a professional to reinstall all the OS's and networking, however I don't think they will. Any suggestions to help them protect their network from the installer? Personally I'd just start over with all the hardware, OS's, routers, etc. I appreciate any comment to help the person out.
 
Hmm, similar experiences here with businesses letting go of their IT people... basically change all the passwords, take off remote access out of the routers and verify no remote programs are installed on the servers. But there can always be SOMETHING lurking around. Outside of formatting no 100% surefire way to keep em out. But definitly change all passwords.
 
Router | If you know the password, go in a check any port forwards and other related sections.
If you don't know the password, do a hard reset to erase all that and reset it back to factory settings.

Computers | Look for VNC software and just unstall it / change passwords.
I doubt they took the time to wirte some spyware, and just used TightVNC or Radmin.
 
Router...if wireless change security passphrase...WPA or higher..just change it. Also change web admin password of router.
If you're a dynamic IP account with your ISP...make sure there is no dynamic dns service setup on the router, if so, delete that setup. Also look for any dynamic dns update software on one of the computers. As mentioned above. while in the router, note any port forwards and find out what they're for. Find out if the account is static or dynamic. If it's dynamic, power off modem and router for a period of time after ensuring there are no dynamic dns services running...so next time it will come up it should be on a diff IP, and with no more dynamic dns updater running...less of a chance of bad person coming back in....depending on what he was using.

Ask the people if they're aware of any other remote access stuff. How about e-mail? Web mail? Change passwords on the account.

Also make sure they have control of the ISP connection, I'd go change passwords and verification hint phrase on that.

Where are backups being done, if any offsite, get control of that account and change settings. If any removable backup media, can all of that be accounted for?

Any other online services? Like Quickbooks? Payroll? If any, secure those accounts and change the passwords.

Now for the computers, change the Administrator password on all PCs. If the PCs were setup with other user accounts...change those passwords as well. And while in MMC, look for other user accounts that person may have setup for himself. Change that password...with the intent on deleting it later after you can determine there is nothing important in that users profile.

While you're in all the computers, look for any remote access programs...logmein is popular these days, teamviewer, look in the systray, look in add/remove programs, look in the registry, look in services, check the Windows Remote Access settings for RDC. If no remote access is needed by the remaining staff...uninstall whatever you find. If remote access is used by remaining staff...change the passwords.
 
I'd also check the wireless router for a MAC address filter. Make sure only the machines/ devices (printers, iphones, whatevs) that are supposed to use wireless are entered into that filter, and no others. If that is already setup, I'd probably redo it just to make sure.
 
If you want to check computer stuff, have a look at Sydi Project I use it at work and at home to document my Windows machines. Great way for finding stuff that shouldn't be there.
 
I spent a bit of time and made a HTA from the VBScript that was the original form for the Sydi-Project. Here's the link. I still haven't figured out how to embed the Stylesheet into the created XML without having to manually add each line of the stylesheet so the stylesheet is uploaded to my site and the XML file refers to that. :p

Edit: You have to be Admin to run, because of registry access for data.
 
Thank you for the great replies, your advice will be very helpful.
 
ShadowStriker said:
I spent a bit of time and made a HTA from the VBScript that was the original form for the Sydi-Project. Here's the link. I still haven't figured out how to embed the Stylesheet into the created XML without having to manually add each line of the stylesheet so the stylesheet is uploaded to my site and the XML file refers to that. :p

Edit: You have to be Admin to run, because of registry access for data.
Click to expand...

Awesome script but I found 1 error in your Reset and Deselect subs. You call for a Checkbox 16 but that checkbox doesn't exist on the form.

Code: 
Sub ResetSub
        checkbox_15.checked=True
	checkbox_16.checked=True
	checkbox_17.checked=True

Code: 
Sub DeselectSub
        checkbox_15.checked=True
	checkbox_16.checked=True
	checkbox_17.checked=True

You jump from 15 to 17.
Code: 
<input type="checkbox" name="checkbox_15" value="checkbox_15" checked=True> 
Local User accounts (on non DC machines)</input><br>&nbsp &nbsp 
<input type="checkbox" name="checkbox_17" value="checkbox_17" checked=True> 
Autorun Security Check</input><br>
Registry Options<br>&nbsp &nbsp

Easy enough fix to comment out the Checkbox 16 in the 2 subs but I just thought I'd give you a heads up.

I just ran the full Sydi script and it gave me a 208 page word doc, your HTA will be awesome in scaling that down to something a little more manageable. Great work. :D
 
Last edited:
Ugh, yeah, I took some stuff out because I was using it for work and you guys didn't need that stuff :p And re-ordering numbers is so annoying!
That's why you can output as XML :p Which is what the setting is, for the HTA.


Edit: Fixed!
 
Last edited:
You must log in or register to reply here.
Back
Top