0

I’ve had it! It is the second time that a “hacker” (A hacker or should I say thief) has had access to my Ubuntu 14.04 LTS system.

The person that I suspect has had physical access to my pc because he had the keys to my house. After the first time it happened I nuked the drive with Dban and reinstalled Ubuntu 14.04 LTS.

When this happened again I was furious! The only explanation that I can think of is that he has my IP and MAC address through using Ipconfig when he had physical access to my pc and he has the information of my Huawei HG532s router.

I am going to Dban my pc once again and reload Ubuntu 14.04 LTS. How do I prevent someone from using Metasploit against my pc (If they have my IP/MAC address)?

Improve this question
1
  • 2
    How do you know he had access to your system? How did you discover it?
    – Ángel
    Feb 12, 2015 at 13:28

2 Answers 2

Reset to default
0

Since you're running Ubuntu 14.04 try using ufw to setup a firewall on your machine. ufw is designed to be a simpler interface than native iptables. See https://help.ubuntu.com/community/UFW

Improve this answer
4
  • Thank you Marc I was using GUFW Firewall package and had incoming connection set to deny... So why could he still access my pc?
    – user2747487
    Feb 12, 2015 at 14:56
  • If he could have added software to your system, he could have used a reverse connect (e.g. Your machine connects to a server via HTTPS) and then he could control your machine. via the server. But you indicated that you completely wiped the machine, correct?
    – COL Wotohice
    Feb 12, 2015 at 18:16
  • if the problem persists even after a wipe and reinstall, I'm not sure this solution will help
    – schroeder ♦
    Feb 12, 2015 at 19:20
  • Thank all you guys for the awesome support you have given me. The HHD was nuked again and reinstalled. What I did directly after the instalation was to log into my router and configure the ACL (access control list) to only allow my I.P to get to the router login screen. Note: The default setting allows any I.P to access the login screen from any protocal, provided that you know the router address. Once again thank you all very much.
    – user2747487
    Feb 13, 2015 at 12:10
4

Your MAC and IP address don't help an attacker at all unless they're combined with open ports on your router, and vulnerable listening services on your machine. It's much more likely that it's a password re-use issue or similar. Did you change your machine password and Wi-Fi password? If he knows where you live and knows your WiFi password he can just sit outside and inject payloads into all your internet traffic.

Improve this answer
2
  • 1
    I have changed all my passwords including my routers passwords and have included a MAC filtering whitelist. Is there a way that my Samsung Galaxy S4 has been hacked and that the payloads are being injected through the “secure” communication between the router and phone?
    – user2747487
    Feb 12, 2015 at 9:52
  • 1
    It's a possibility, what are the symptoms that are leading you to think he's hacked you?
    – AlexH
    Feb 12, 2015 at 11:15

Not the answer you're looking for? Browse other questions tagged .