I've reinstalled windows multiple times followed numerous manual ways to lock down windows and also tried a bunch of Secure Host Baselines they got past the crappy free router from my ISP... bought myself a expensive set of Ubiquiti security gateway router/switch/AP with Deep packet inspection reinstalled hardened windows. i found logs in my router the very next day and i wrote them down on a paper but the real logs are now gone from both my pc and the router.... but i got the paper and iv'e taken some courses to better understand the EventViewer and its evident there as well...wtf can i do my ubiquiti setup had a price point of 1025
USD well i can think of one last thing is a next-gen Unified Security Gateway which cost upwards of 769USD a year last hope i guess oh and something like Linux.. but i like Windows.
First, I believe you. I've been targeted and know many dozens of people that have, it's not as rare as people think these days - sadly.. Fortunately, I can help you with these matters and you appear to have the money to do what is necessary to stop the nonsense. One thing you need to realize is these people/govt/corporations - whoever is doing it are very patient. They'll carefully monitor what they can and then develop an attack strategy tailored for your setup. By altering setup and being unpredictable you can often throw a wrench into it by causing their TAO to have to refocus mid-stream - which is incredibly frustrating to them.
First thing is first.. They'll walk right through Ubiquiti gear... Unifi stuff isn't security hardened, not by a long shot. For example SSH is left open, you need to putty into each AP to CLI SSH off. Second, the product uses things like WebRTC and Java.. If you are really serious about stopping someone then you won't use Ubiquiti stuff. At least until Chris B. from PfSense is done totally revamping Unifi series in a couple of years. In the short term, a dead-man-switch on your PC's may help until you get your network fully locked down. Or you could use RollbackRX and rollback your systems every single day until everything is secured properly.
IF you are really being targeted you can find this out pretty easily via multiple methods.. But one thing I will tell you, they've successfully reverse engineered many AV products and they can also intercept the update process for some AV products. I don't want to name names, but we've seen this happen on several leading AV's. A crucial thing here IMO is to utilize an AV product that uses signed, encrypted update channels. The very second your AV is stuck in a loop or won't update it's time to uninstall it - we've found. If your AV's become compromised then you know you are being targeted and it isn't some script kiddie. Security through obscurity should be examined.. Sure, they can develop backdoors for major AV, but will they invest the time/resources in developing one for some random AV from some smaller but reputable firm? Probably not. If Comodo can reverse engineer Eset with Chinese contractors, you know our govt or proxies can do the same thing. Careful.
Get a real UTM on your network, maybe try a Fortigate 60E w/Sandboxing. SOC3 chip on it, extremely hardened, nothing happens with it unless you allow it. (Default-Deny Policy by default). Once deployed, you need to harden it even more.. Turning off SSH, Telenet, Remote Admin, closing the 541, 123 and other ports it does leave closed but visible. (Via quick CLI command) Run a port scan and CLI anything else to stealth/disable/noresponse. Turn on extreme IPS, blah blah blah. If not Fortinet, Try one of the higher end ZyXEL boxes, they use Kaspersky Gateway and are pretty decent. I'd avoid the common TAO devices like Cisco, Checkpoint, Juniper, etc. Sorry but Unifi stuff is crap in comparison.
Once your front door is closed, work backward, securing each part as you go.. Switches, AP's, etc. The key here is testing everything for holes yourself. Limiting logging/telemetry, etc. Wireless should be your next focus. Make your SSID's complex and use _optout_nomap, something like: 6;^~K(v87dXp_optout_nomap. If you can install a WIDS and RogueAP suppression mode AP - it depends on what wireless controller your UTM has and if you can do this - research it. This will suppress all rogue AP's with a local DDOS. It will suppress all attempts to spoof, clone and pineapple your SSID. Look into advanced WiFi security like digital fences and other stuff.. Learn about wireless security, apply that knowledge. On your wireless computers use a device that disables the NIC when the device shuts down so they never have standby NICs, ever..
Keep all firmware updated throughout your network. If a firmware won't apply factory reset whatever the device is. If it still won't apply, return the device or throw it out. It's been compromised.
Lockdown your network. No traversal unless a device must. If it must, examine 'windows' where it can. For example Tivo's update in a small window and only really need to talk out the WAN during that window. Schedule them to be off WAN until that window is needed to reduce threat surface. Turn off all external port forwards unless needed and if needed try to put them into windows of use. (Schedules)
Once you reach the endpoints everything else on your network should be locked down.
Other guys on this forum can help you with locking down endpoints.. Default Deny programs/policies, reducing threat surface by keeping crap like Java and if possible .net off your systems. Installing what is needed and only what is needed. Don't leave crap like Origin or Steam running unless needed. Lock down windows settings. Limit/eliminate logging/telemetry. Password managers. changing passwords, not using popular insecure email services. Chrome lockdowns, the list goes on and on and on.
If you really are targeted and become a total jerk to them with your security then they'll take it to level 1.. Fake door repair vans while you are on vacation, utility guys asking to inspect your internal electrical panel, fake rebates for home inspections or whatever.. If that happens you'd better be prepared with cameras, locks they can't walk through in 7 seconds, alarm system, etc.
PM me if you have any questions. I was purposely vague in this response believe it or not. I avoid detailed public disclosures these days.
