[j0n3s.daniel]

Hi I have some general questions regarding hacking, as I think I am a victim and I also find the topic very interesting.

I have a idea who is behind it but I believe my devices have been hacked, my Android phone keeps showing up a "arp poisoning attack". My phone is rooted. I have some questions.

1. how do I address this to keep people out.

2. How deeply infected can a windows machine be, how hard would it be to actually penetrate to a kernel level?

3. How do I actually sniff and monitor for Rat traffic. I'm guessing it's Natted traffic and would be using a dynamic port range to communicate.

4. As far as I see it, firewalls are pointless as long as there is a infected machine on the inside initiating a connection to the outside.

5. Using ntopng, I do a network scan and certain hosts show as on "ghost networks". This ghost networks icon jumps around periodically between hosts and sometimes switches to ipv6. Is this something to be concerned about?

Thanks in advance.

[Bastille]

Hello

1 - Didn't really understand the question, but if you ask how to protect your devices, and keep people out of them, that's not an easy question. The following are the headlines :
- keep your devices up to date
- don't download cracked program/software, cheat tools, don't root your android device
- use a password manager, don't use same password on too many websites, use strong passwords only

2 - Not sure to be able to answer this question, however the best way to infect the kernel I guess is probably through drivers and firmware.

3 - You can use Wireshark, and also more friendly-user tools, such as glasswire

4 - You are right, since you downloaded a malware and executed it with admin rights, the firewall will open the necessary ports of your system. If you have another appliance in your network, such as a physical firewall, and well configured to block everything except some usual ports, then the communication couldn't be established (except if the malware runs under common ports, like 443).

5 - Didn't know this tool, will take a look

Hope other members will be able to help you too.

With pleasure, and welcome to HF