What happened:

Event 1

A few months ago I was working on my laptop (laptop1). During my activities, sometimes I saw a text selection, when moving my mouse. I thought this happend due to a bad key. After that I also saw my mouse moving (a bit). I cleaned my mouse (laser) to make sure it was dust free. Shortly after that my mouse went moving in manners only a human could do. That day I formated my pc and changed the following passwords:

  • Network passwords (samba)
  • Modem password
  • Wifi password
  • Guest password
  • Mailbox passwords changed

All passwords are generated through a tool and are at least 20 characters long! Also I disabled WPA on the modem.

Event 2

Today I called my ISP to ask why my WIFI was slow. In the statistics of my modem I could see a lot of drops in my connection. The ISP went through my settings and told me, the internet should work fine. As a result he told me to reset my modem. When I went to my modem to reset it, my mouse (which was not in range of my laptop / powered off) went circeling over the screen on (laptop 2)!. I immidiatly killed my wifi connection (with the button on the modem). But still got internet!

A few questions:

  • How can this happen
  • Why did all changes after event 1 not prevent this from happening again?
  • How can I prevent this from happening again?
  • Can WPS sessions survive a modem reboot / password change (event 1)
  • Can it be possible I was not hacked, but my mouse bluetooth connection was used to mouse over my screen?

Extra info

A small description of my network topography:

  • One Fritzbox router
  • One Fritzbox repeater (acting as repeater)
  • 3 networks:

  • [networkname1] - 5G

  • [networkname2] - 2.4G
  • [networkname3] - Guest access (password protected, and password refreshed after event 1)

Also I got a wired connection (using Devolo like devices) to my solar panels. These wired connections are running on their VNET. Also I got a few wired connections (in my private network) to my televisions (also via Devolo)

Hidden network / autoconnect active on all wifi connections

In my wifi list I got a hidden network which is available frequently (for 5 seconds with poses of 10 seconds). It has a weak but steady connection. When I go to my garden, it is just as strong as when I go to the frontside of my house. This network is only visible at the ground floor (not at the first and second floor of my house).

I tried accessing the hidden network, it asked for a SSID, and took my entry (tried all of my network names + some extra). And asked for a security key.

Besides that, all my wifi connections have the 'connect automaticly' checkbox enabled (I did not do that!)

Last but not least, I think I don't have a mental condition (like imagining stuff) ;)

  • Shortly after that my mouse went moving in manners only a human could do. Could you elaborate?
    – jrtapsell
    May 9 '18 at 21:55
  • Do you use a wireless mouse? Do you have any extra USB devices connected to your computer? It sounds like either your mouse is somewhat broken, or somehow someone has (possibly accidentally) connected their wireless mouse to your computer.
    – Macil
    May 9 '18 at 21:58
  • @jrtapsell In event 1 I challenged 'the hacker' by moving to the shutdown feature of Windows. When I wanted to shutdown, the mouse sudenly went to the reboot feature. It seemed to be as if the user was watching my screen. In event two the mouse moved in circles (while I was holding my laptop)
    – Arthur
    May 9 '18 at 21:58
  • 2
    I answered a while ago about a user inside a network trough Wi-Fi, this might help you: security.stackexchange.com/questions/160361/…, you can give it a try, It also looks like a "persistance" of meterpreter reverse_tcp session, but there's not enough information.
    – Azteca
    May 11 '18 at 17:23
  • 1
    Whenever I see "Laptop" + "Mouse Moving" + "Hacked?", I immediately assume the user's palms move the mouse through the mouse pad when typing... You're asking for ways in which computers can be hacked, you're not going to get an answer that is going to help you imo. Because for all we know you've been downloading and running "Free Youtube Downloaders" or "Free PC Boosters"... Also, your initial question is "How can this happen", while you don't even know what "THIS" is...
    – Nomad
    May 14 '18 at 12:39