I'm running ubuntu on my laptop and while i was watching some videos, someone logged into my computer and started using it. I saw the mouse pointer starting to move and they started clicking things. I sort of panicked and unplugged the power cable straight away. I'm not sure if they got anything, is there a way to check if I've been compromised, and what should I do? Thanks.
Asked
Active
Viewed 1,555 times
0
-
4What applications do you have installed that somebody could login using? SSH server? Desktop-sharing software? – user535733 May 13 '17 at 21:16
-
4Are you sure it wasn't your palm on the touchpad? – You'reAGitForNotUsingGit May 13 '17 at 21:26
1 Answers
0
Disclaimer: not an expert, this is what i would do.
- start by disconnecting your laptop from the internet
- power up
- check all ports open with
nmap -PN 127.0.0.1(and close them later if unneded) - get which services/apps are using ports with
sudo netstat -tulpn - check which services are running on start
with that info i will start looking for anything suspicious.
You can take a look at rkhunter.
If it's only your account which is compromised (and not the root account), i will try to create a new one with sudo access and work the process from there.
bistoco
- 1,531
- 15
- 23