I'm running ubuntu on my laptop and while i was watching some videos, someone logged into my computer and started using it. I saw the mouse pointer starting to move and they started clicking things. I sort of panicked and unplugged the power cable straight away. I'm not sure if they got anything, is there a way to check if I've been compromised, and what should I do? Thanks.
1 Answer
Disclaimer: not an expert, this is what i would do.
- start by disconnecting your laptop from the internet
- power up
- check all ports open with
nmap -PN 127.0.0.1
(and close them later if unneded) - get which services/apps are using ports with
sudo netstat -tulpn
- check which services are running on start
with that info i will start looking for anything suspicious.
You can take a look at rkhunter.
If it's only your account which is compromised (and not the root account), i will try to create a new one with sudo access and work the process from there.