Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I think there has been 3 times an intrusion in my computer.

Last week, I was listening music on my computer (ubuntu 12.04.1 LTS on a MacBook Air 4,2), my hands were far from keyboard and trackpad (on a real book) and Firefox had the focus. I'm not a geek and not a 'mum-and-dad' user.

I saw the web page I had opened self-scrolling a few (not reloading). I move the moose and 5 min later it happened again. I disable wifi. At that time aMule was running. Skype too. Some ports were open but not for my IP address. My system was updated 3 hours ago (but not the kernel) and so up-to-date.

10 min later, the ubuntu update manager prompt me updates for the linux kernel. One package was named using Russian (linux-image-generic). It never happened before, so I didn't applied it yet. Yes, I've added Russian language to keyboard-maps and Russian virtual/visual keyboard.

3 days later I saw again an open web page self-scrolling in Firefox. aMule wasn't running, but skype was.

One day later (now), I even find some packages' names translated in Russian in Ubuntu Software Center. Not apps, only packages.

1. How can I know if there has been an intrusion in my computer ?

2. How can I know if someone remotely changed/corrupted some packages or configuration in my system ?

3. Especially something concerning the update manager ? And Firefox profile ?

Latter, using (for the first time)

sudo lsof -i | grep ESTABLISHED

I didn't notice any strange connection (but I may be wrong).

And (the first time too)

chkrootkit

answer

Checking `sniffer'...

wlan0: PACKET SNIFFER(/sbin/wpa_supplicant[1052], /sbin/dhclient[21907])

Please don't answer me make a new Firefox profile or install a new system (I can take that decision and do it ;-) ) : I want to know, understand, fix and being protected next time.

Here is : the output of sudo lsof -i -n -P

share|improve this question
1  
Do you have remote desktop enabled? Let us see the output of sudo lsof -i -n -P. To answer the "how can I know" question, well, you can't, unless you have a backup to compare to. –  mikewhatever Feb 7 '13 at 19:58
    
The output on pastebin : link I have a DejaDup backup, but one month at least old (I moved, deleted, ... files since). Can it helps ? –  NicolasWeb Feb 7 '13 at 21:08
1  
No, an old backup won't help. Can you make our job a little easier and close all running programs before executing the command. –  mikewhatever Feb 7 '13 at 21:15
1  
Please in the future edit your question to provide additional information . I did it just now. –  guntbert Feb 7 '13 at 21:28
    
@mikewhatever : what about the result of chrootkit wlan0 ? Is that OK ? –  NicolasWeb Feb 8 '13 at 8:25

1 Answer 1

So to summarise your questions, these are the suspicious activities you've seen on your computer:

  1. Web pages on Firefox scroll automatically.
  2. An update entitled "универсальный образ ядра Linux" and subtitled "Linux-image-generic" was proposed in the Update Manager. All others are in the default Ubuntu language. Some packages' names are translated in Russian in Software Center. Not apps, only packages.

For the second activity, I would not consider this suspicious at all. Ubuntu is divided into thousands of packages, each one can receive updates. I wouldn't be surprised if not all the packages in Ubuntu's repositories get their meta-data translated into Russian on time before release, sadly. English is still by far the most used language in Ubuntu.

For the first problem, I would say this is much more likely to be a bug than a security breach. Even if you're aware from your touchpad and your mouse, it could well be that the hardware is problematic, sending signals to your computer when it shouldn't, or that the software is buggy, badly interpreting mouse signals.

The output of the commands you ran do not look suspicious to me, although I only glanced at it and didn't analyse it properly.

share|improve this answer
    
Thanks. OK for 1. Do my edits change something to the 2. please ? –  NicolasWeb Feb 7 '13 at 22:14
    
@NicolasWeb: I edited the answer after your suggested edit. –  Flimm Feb 7 '13 at 22:16
1  
@NicolasWeb: I had a look at your suggested edit and I don't think it would change my answer. –  Flimm Feb 7 '13 at 22:17
    
Should I field bug for these 2 issues to hope them to be fixed ? Where ? Is there a bug management system AND a simplified bug notification area ? –  NicolasWeb Feb 8 '13 at 11:18
1  
Instructions on filing a bug report are here. On Launchpad, you can subscribe to bug reports, and you can mark yourself as affected so that developers know which bugs to prioritise. –  Flimm Feb 8 '13 at 12:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.