0

I’ve had it! It is the second time that a “hacker” (A hacker or should I say thief) has had access to my Ubuntu 14.04 LTS system.

The person that I suspect has had physical access to my pc because he had the keys to my house. After the first time it happened I nuked the drive with Dban and reinstalled Ubuntu 14.04 LTS.

When this happened again I was furious! The only explanation that I can think of is that he has my IP and MAC address through using Ipconfig when he had physical access to my pc and he has the information of my Huawei HG532s router.

I am going to Dban my pc once again and reload Ubuntu 14.04 LTS. How do I prevent someone from using Metasploit against my pc (If they have my IP/MAC address)?

closed as too broad by schroeder, RoraΖ, Jens Erat, Mark, M'vy Feb 13 '15 at 9:17

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    How do you know he had access to your system? How did you discover it? – Ángel Feb 12 '15 at 13:28
0

Since you're running Ubuntu 14.04 try using ufw to setup a firewall on your machine. ufw is designed to be a simpler interface than native iptables. See https://help.ubuntu.com/community/UFW

  • Thank you Marc I was using GUFW Firewall package and had incoming connection set to deny... So why could he still access my pc? – user2747487 Feb 12 '15 at 14:56
  • If he could have added software to your system, he could have used a reverse connect (e.g. Your machine connects to a server via HTTPS) and then he could control your machine. via the server. But you indicated that you completely wiped the machine, correct? – COL Wotohice Feb 12 '15 at 18:16
  • if the problem persists even after a wipe and reinstall, I'm not sure this solution will help – schroeder Feb 12 '15 at 19:20
  • Thank all you guys for the awesome support you have given me. The HHD was nuked again and reinstalled. What I did directly after the instalation was to log into my router and configure the ACL (access control list) to only allow my I.P to get to the router login screen. Note: The default setting allows any I.P to access the login screen from any protocal, provided that you know the router address. Once again thank you all very much. – user2747487 Feb 13 '15 at 12:10
4

Your MAC and IP address don't help an attacker at all unless they're combined with open ports on your router, and vulnerable listening services on your machine. It's much more likely that it's a password re-use issue or similar. Did you change your machine password and Wi-Fi password? If he knows where you live and knows your WiFi password he can just sit outside and inject payloads into all your internet traffic.

  • 1
    I have changed all my passwords including my routers passwords and have included a MAC filtering whitelist. Is there a way that my Samsung Galaxy S4 has been hacked and that the payloads are being injected through the “secure” communication between the router and phone? – user2747487 Feb 12 '15 at 9:52
  • 1
    It's a possibility, what are the symptoms that are leading you to think he's hacked you? – AlexH Feb 12 '15 at 11:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.