Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was accessing my system (like cursor and other controls behaving weird as if someone else was controlling them, screen slightly blinking, etc).

Is there any way that we can find if someone is intruding on our system, or later search for any unethical access to the system?

share|improve this question

It depends on what exactly you were using.

Direct inspection

  • computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at the computer level might be impossible to detect. Even more so if the data is sent and used elsewhere (e.g. keylogging, screen capturers etc.). You may detect the presence of such software, though.

  • network: you can do zip, unless you have access to the management interface and/or hardware. Your access point might be cloning all your traffic for subsequent exploitation, and you wouldn't be aware of that (which is also a very good reason never to use "open" wifi networks more or less willingly supplied by more or less known parties).

  • facilities: very much like the network. You ought to have access to camera logs and the like; nobody would ever let you.

Indirect methods

Check out access patterns and access times to whatever services you're using. For example, GMail records the IP address of your last visit(s) to their systems.

Good practices

If you really had to use an insecure path, change your relevant passwords and every access code that may have been rendered insecure, as soon as you can. If you keep passwords and license codes on a cloud account, use two accounts with different passwords. That way the "password account" will only be made insecure if you actually have to use it, not just if you happen to be checking your email for other reasons.

(For holidays, etc., you might set up a "throwaway" write-only account: when going on holiday you can set up a forwarder from the real account to the throw-away one; when coming back, you can instruct the real account to also read any incoming from the expendable account (be careful not to set up a loop...!). That way, people sending you email on the throw-away account would still get read; at the same time, the expendable account has nothing worthwhile on it).

Social engineering

You could try and lay some bait. For example say that I have a web site of my own, whose access logs I control and can check. Then I happen to use a network where someone could be eavesdropping.

I could send an email to a nonexistent account, or an account that's mine only but not immediately recognizable as mine:

this is the documentation we talked about. The zip file is encrypted
and the password is 'shish-kebab'. Man, this is HOT. Keep it for yourself,
one could make real money here.

...ordinarily, nothing would happen. The email will never arrive, and if it did, I'm the only one who would read it, and I would do nothing. The zip is not even there - it never was: it never even existed.

So if I found a 404 error in my Web logs, stating that someone tried to access a file whose name ought to be known to no one, then this would tell me that someone snooped my email -- and would also tell me his IP address, time of day, maybe his browser User-Agent (supposing I could trust it) etc. .

(I could even set up a page designed to send me a warning in real time).

The same thing can be done on a computer, if you know you should be the only one having access to any given section of it: set up a document there, remember never to open it, and check out its last access time. Also, you can usually check event logs and access information (if and how depends on your operating system, though).

Screen activity grabbing

An easy way that is usually enough to spot screen grabbing consists in looking up the network properties, and specifically the network traffic counter. In a pinch, look at the network activity LED which is usually near the plug. Screen grabbers work in one of two ways: either they photograph the screen at fixed intervals (difficult to spot, since it's not under your control) or, to save bandwidth, they do so whenever the screen changes, and often only transmit the changed areas.

So if you open the Network Properties, you'll see that the traffic counter is steadily going up in fits and starts (Windows Update, BITS and various services are always running), usually not very fast. If you were to shuffle icons around, this should have no effect on the network (unless you operated on a network folder), normally; but if the screen is being grabbed, your moving an icon or resizing a window would trigger a screen update, and you'd see the network traffic going up in sync with your actions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.