Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of:
The first one was obviously a rootkit checker and it was something I had previously had installed. But the other two I did not recognise and their stated purpose has given me cause for alarm:
(admin): active password cracking tool - character sets
John the Ripper is a fast password cracker, available for many operating systems. Its primary purpose is to detect weak Unix passwords, although Windows LM hashes and a number of other password hash types are supported as well. John the Ripper is free and Open Source software, distributed primarily in source code form.
Seeing as I have never installed any security software designed to detect weak passwords, and I have never installed a password cracker before (and why even on my own machine?), do I have to seriously consider this to be particularly nafarious?
I might add for context I'm in proceedings with the Investigatory Powers Tribunal over illegal surveillance from GCHQ and the presence of a password cracker (which has to be the second weirdest thing within the last two weeks, the first being a phone call from Palestine/Israel) has me particularly unnerved, especially given I am unaware of any particular packages that would require a system to expose vulnerable packages.
Should I consider this nefarious, or am I mistaken?
[My sudo password has already been changed in light of this.]