Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of friends hacked my laptop and now whenever I come online he can tell what tabs are opened in my browser, so I think he is remotely monitoring me. I don't know how he did this, since I didn't take anything from him.

I use Ubuntu, the firewall is enabled, remote connections are switched off, so how can he see what I'm doing? I can't even access my router on 192.168.1.1 any more.

share|improve this question
10  
Step 1: Remove and reinstall your operating system. Step 2: Get better friends. –  Adnan Nov 7 '13 at 18:43
    
Do you use FireFox? –  CyberJacob Nov 7 '13 at 19:35
    
    
i use chromium as well as firefox –  Raja Dey Nov 8 '13 at 4:09

3 Answers 3

up vote 1 down vote accepted

You are probably infected by a trojan. The first thing you should do is to change all your personal passwords (mail, facebook, gmail, etc) from another machine !

You can use the terminal to see what are the established connections :

netstat -anp --tcp --udp | grep LISTEN

See what are the processes loaded on boot and eliminate the useless ones. You can use Wireshark to monitor the ingoing/outgoing traffic.

You can install Clamav :

sudo apt-get install clamav

and scan your hole system :

clamscan -r --remove /

share|improve this answer
    
You don't know how a rootkit works do you? –  Lucas Kauffman Nov 7 '13 at 19:28
    
A trojan works on the same manner, no? With a tool like Njrat you can install a server on the linux victim machine and have a remote control of the hole system. Am I wrong? –  Bill Nov 7 '13 at 19:33
    
Nope you are completely right. Yet you don't seem to understand that you can't trust the system anymore, you can't recover it and you can't trust any commands you execute on it. –  Lucas Kauffman Nov 7 '13 at 19:54
1  
So our friend should reinstall Ubuntu? :) –  Bill Nov 7 '13 at 20:13
1  
@Raja Dey - after the re-installation, 1) make sure the first thing you do with your Ubuntu is to update and patch your system. 2) Do not open or use anything that this 'friend' has ever sent you. 3) Change your router's password, just in case. 4) Change all your passwords to services which you have logged using your home computer or home network. 5) Tell this person he is a worthless piece of <user-your-imagination> and don't ever trust him again. –  Lex Nov 8 '13 at 10:27

As the comments have noted, you can't trust a compromised machine to honestly report about itself. You could extract the hard drive for analysis on another machine, but that would involve lots of time and effort.

Faster and easier to just remove the attacker.

  • Reset your router to factory defaults - almost all will have a little button on the back that you can push and hold to do so. This will probably remove any config changes the attacker has made. Reconfigure the router using settings obtained from your ISP.

  • Rebuild your laptop from known good media. Download Ubuntu again and re-install it.

share|improve this answer

You seem to know who is behind this. Ask the person directly and threaten that you're going to the cops about it ?? This is definitely illegal and you could have a go at that route.

But there is no escaping the fact that a reinstall is due & a router reset.

share|improve this answer
    
he wont be bothered if i threaten him coz the cops out here know nothing abt cyberattacks and willn't give a ear over the matter –  Raja Dey Nov 8 '13 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.