Frustrated

Question

Ok so, I am a newbie to the tech world by about 10 years. Self taught and have a ton of learning left to go. My question is...

I have been hacked, took a long time to figure out how it kept happening again and again, with new devices accounts passwords new home networks etc etc.. HOW do I locate the hacker?? The person in question is someone I know, has taken administrative control of all my devices, has remote root access and uses multiple accounts on their visited sites, which normally sends me to a redirect when I get to close. I have now gotten passed the sherad, and know who it is. I just want to catch this person. Please someone guide me in the right direction.

Andrew J · Answer

If you know who it is, the police should be your first port of call. Second should be an IT expert who can help you protect your network at its border and recover control of your devices.

Jan Cumps · Answer

This community is focusing on designing and making. For help with a computing system and network under active attack, I would expect you 'd get more skilled help on a forum for administrators (OS / Network).

cstanton · Answer

You're not giving a lot of information to go on, or what behaviour is happening exactly.

The first port of call is typically to disconnect from the internet, put your devices into airplane mode.

Then reset devices to factory defaults.

I mean it depends how 'deep' you're thinking this 'hack' to have happened to, it's not common that hacked devices can survive being reset to factory defaults, but it also depends on what devices have been 'hacked' and what behaviour you're seeing.

To find out what's happening you need a way to monitor your devices using a 'known good' or 'known safe' setup that can monitor network activity, view all traffic, and effectively 'hack' your setup to see how it's behaving.

Though I'm guessing you're on a typical home setup, with a gateway/router provided from your internet provider, and home devices/mobile phones.

Any lost accounts should be taken up with the respective providers/companies and any unknown or foreign devices from your network and home should be removed/unplugged.

If you're unsure how to do any of this, disconnect everything and hire an 'infosec' company to check it out for you, or a 'penetration tester' to do a security audit of your kit, at the very least hire an Information Technology specialist that can isolate, identify, backup and clean your equipment.

Law enforcement obviously varies depending on your country and state. If you want to take action against whoever's doing it, you need 'digital forensics' to capture and analyse what's going on with your equipment, which'll be a specialist law enforcement team or again, infosec.