Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 5 down vote favorite

The intruder started opening windows and in firefox opened the search prompt and start typing in some commands I didn't capture.

Then he opened Google and searched for:

&fs:ik &del ik &svcnost.exe &exit

What is this command?

How did someone get into my machine? In Windows this has never happened and this feels like a huge breach of security of my personal PC.

I've already went ahead and disabled remote desktop, but when it was enabled it clearly mentioned:

enter image description here

So does this mean that ANYBODY could have entered and messed with the machine? Thank god I set the option to notify me when someone entered otherwise I wouldn't have been the wiser.

The internet is a scary place, god damn.

share|improve this question
Check your wireless settings and if you do not have any security enabled for it then set it to WPA2 – scouser73 May 9 '11 at 16:18
2  
Why would you allow other users to control your desktop anyway, it's basically begging for trouble. – scouser73 May 9 '11 at 16:20
@scouser73 Being on a well-secured wireless network doesn't protect you from others on the network (who you don't necessarily want to allow to remotely administer your computer just because you're on the same WLAN as them!). And being on an open wireless network does not expose you to this problem unless Remote Desktop is configured very insecurely, as is the case here. Changing wireless settings is often not a good solution, but your second comment (about how it's a bad idea to configure Remote Desktop like this) is spot-on. – Eliah Kagan Sep 1 '12 at 12:19

2 Answers

up vote 13 down vote accepted

They got access because you had Remote Desktop enabled for some reason. You could do similar under Windows.

For security, no matter what OS you are running, do not allow incoming connections unless you know how to secure them, and then only allowing unprivileged usage limited to only those functions you need remote users to have.

svcnost.exe is associated with a number of threats so your intruder may have been looking at popping it onto your machine. Of course it is a Windows executable so that wouldn't have impacted you on this Ubuntu box.

share|improve this answer
What will happen If he already installed wine ? – Tachyons Apr 25 '12 at 8:05
Isn't it called scvhost? i never heard about svcnost. as I know svchost.exe is a service layer script and can connect with any type of network without informing the user(that's why I use Comodo firewall, It can identify those actions) normally, windows have a single SVChost.exe running always. Please let me know if I am wrong – aking ubuntu Apr 25 '12 at 10:42
up vote 10 down vote

As you can see from your screenshot, you have explicitly allowed unconfirmed, passwordless login. All desktop sharing is disabled by default, and if you enable it, you must confirm each connection. As you unmarked the confirmation box, you granted access for all.

Security measures only works when they are enabled. The same would have happened if you granted access for all on a Windows box.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.