How to stop the "mitmf" tool on my home network?

Question

Okay, so I am basically an electronics student so I have limited knowledge on the subject. So please help me out here.

The thing is that one day, as I was browsing, I opened up Google and instead of the Google logo, a "You have been hacked" image came up. I share a flat with 5 people and one of my flatmates came up and told me that he had performed an "Image replacement" attack or something. He didn't tell me how he did it. I did some research and stumbled upon the mitmf's GitHub page. I was quite impressed with the capabilities of the tool. However, the question here is, how do I protect my computer against the attack? My flatmate and I are on the same network (using our home router). We have a broadband connection. How do I protect myself from this tool?

Also, please inform me whether it is possible to install viruses on my machine via this tool? I also saw that this tool (mitmf) has screenshot and keylogger capabilities. In that case, will my anti virus detect these? And will the screenshot and keylogging work one the attacker's machine is turned off (Meaning can he still receive my screenshots and keystrokes even after he disconnects from the network)?

NB: I know that he won't use this tool to cause any harm to me, but one can never be too cautious. Please help me out here.

EDIT: I am looking to prevent all kinds of attacks that this tool can do, not just the keylogging and screenshot attacks in particular.

Answer 1

The type of attacks you can suffer from depends to what your flatmate has access.

Understanding the attack

There are a couple of ways that your flatmate could have pulled this attack and understanding them will help you to understand how to protect yourself.

Google usually use https for its pages. This usually means that your flatmate can't do MitM attack on your communication with google and if they do your browser will give you a big scary warning warn you that your communication was tampered.

The first way to counter the https protection is to remove the https by redirecting to http. We call this attack ssl stripping. By doing that, he can now modify anything on the page and your browser will not give you any warning, except that the address will be in http instead of https.

The second way to counter https is to counter https is to install a CA certificate on your computer. Your browser is able to warn you when someone tamper with a secure connection because of the CA certificates. If your flatmate, is able to access your computer and install CA certificates, he can tamper any and every of your connections and your browser won't give you any warning. The address will even be in https. You can sometimes detect this type of attack by looking at the certificate that is encrypting the current connection. Right click on the padlock in the address bar and look for the certificate information. If you are on google.com but the certificate is issued by "flatmate", then you have a problem.

Also, with physical access his possibility are limitless. For example, the easiest way for me to do this attack would be to install a custom made browser extension on your computer.

Restrict his physical access

You need to restrict the physical access of your flatmate to your computer. If you can lock your door, do it. Then you need to make sure your computer is protected with a good password. It's the first step.

In the previous section, I talked how your flatmate could install CA certificate if he had access to your computer but this is just the tip of the iceberg. If he has physical acccess, he can install any type of malicious software.

Your system might already be compromised

There are good chances that he installed something on your computer. In this case, you need to do a fresh install. Antivirus won't help you here.

The router / modem is compromised

You can probably assume that he has complete control over the router/modem. This means that anything that you access from the internet need to be encrypted or he can tamper it. Using extension like httpseverywhere can help or you could also use a secure VPN.

Answer 2

I'm surprised that the Google image could be replaced.

This would only be possible if you weren't using the HTTPS version of the site. This is the mitigation for Man-In-The-Middle - ensure the sites you visit are accessed over HTTPS. HTTPEverywhere browser extension can help with this.

HTTPS employs SSL/TLS to encrypt your connection to the server so it can't be Man-In-The-Middle'd with such a tool.

The keyloggers and screenshot capabilities are within the browser only, and are accomplished by injecting a <script> tag into the page. If using HTTPS then this is also not possible.

Anti-Virus won't detect it because it is an attack on the wire, not on your machine.

(Note all the above assumes your flatmates haven't installed their trusted root certificate on your browser - that would make it possible to intercept HTTPS sites if so. Check this with the GRC tool.