0

I'm running ubuntu on my laptop and while i was watching some videos, someone logged into my computer and started using it. I saw the mouse pointer starting to move and they started clicking things. I sort of panicked and unplugged the power cable straight away. I'm not sure if they got anything, is there a way to check if I've been compromised, and what should I do? Thanks.

2
  • 4
    What applications do you have installed that somebody could login using? SSH server? Desktop-sharing software?
    – user535733
    May 13, 2017 at 21:16
  • 4
    Are you sure it wasn't your palm on the touchpad? May 13, 2017 at 21:26

1 Answer 1

0

Disclaimer: not an expert, this is what i would do.

  • start by disconnecting your laptop from the internet
  • power up
  • check all ports open with nmap -PN 127.0.0.1 (and close them later if unneded)
  • get which services/apps are using ports with sudo netstat -tulpn
  • check which services are running on start

with that info i will start looking for anything suspicious.

You can take a look at rkhunter.

If it's only your account which is compromised (and not the root account), i will try to create a new one with sudo access and work the process from there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .