LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-20-2014, 10:10 AM   #1
unnamed1
LQ Newbie
 
Registered: Dec 2014
Posts: 16

Rep: Reputation: Disabled
[LinuxMint17.1] am I hacked? suddenly I saw a lot of text files opened under "Recent"


Hi,
I am noobed with linux (I was more "windows" guy for a long time)

am I hacked? suddenly I saw a lot of text files opened under "Recent".

The files were in a specific folder under NTFS partition.
I remember clearly that I mount and opened one file but I don't remember the other files!! I think it wasn't me.
It was pretty strange! all my text files in the same folder were opened (I assume because I saw them under "Recent" folder.

Is the a way to confirm who "hacked" my machine? if that really happened?

thanks all

Last edited by unnamed1; 12-20-2014 at 10:34 AM.
 
Old 12-20-2014, 07:29 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
Quote:
Originally Posted by unnamed1 View Post
am I hacked? suddenly I saw a lot of text files opened under "Recent".
The fact something happened you can't immediately explain does not automagically mean your computer is compromised. Most of the times there are good, simple explanations for certain behaviour.


Quote:
Originally Posted by unnamed1 View Post
The files were in a specific folder under NTFS partition. I remember clearly that I mount and opened one file but I don't remember the other files!! I think it wasn't me. It was pretty strange! all my text files in the same folder were opened (I assume because I saw them under "Recent" folder. Is the a way to confirm who "hacked" my machine? if that really happened?
- What account was this? Root or an unprivileged user account?
- Is this NTFS partition partition mounted automagically?
- Do you share your account with anybody?
- What does 'last -wai30' return?
- Were these files modified? If so when?
- Do you make backups?
* Anything else you want to add?
 
Old 12-21-2014, 02:11 AM   #3
unnamed1
LQ Newbie
 
Registered: Dec 2014
Posts: 16

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post
The fact something happened you can't immediately explain does not automagically mean your computer is compromised. Most of the times there are good, simple explanations for certain behaviour.



- What account was this? Root or an unprivileged user account?
- Is this NTFS partition partition mounted automagically?
- Do you share your account with anybody?
- What does 'last -wai30' return?
- Were these files modified? If so when?
- Do you make backups?
* Anything else you want to add?
Hi!! first of all thanks for the replay (very detailed reply very pro).

- I don't know what is my account I just installed linux mint lately.
-this NTFS I think it called automatically? I pressed on it and it show me an option to "EJECT" like CDROM and show me the information inside.
-no i dont share my account.
-coool!! I didn't know this command "last -wai30" it show me when I was with my account and when I reboot the system !! very cool.
- I don't do backup (maybe I should!).
- I thought of using the application LOGGEDFS(although I don't really know how because I came from WINDOWS I only know to click things lol) , so I can see a detailed information of what being done on my computer behind the scene
-do you have any idea how to A) Enable / Disable this application) I am talking about LoggedFS to CSV, AND B) how to log all partitions.
C) where do I find the CSV file location? (I don't really understand the stacture of linux folder (look very alien to me compare to windows)).

many thanks!!

Last edited by unnamed1; 12-21-2014 at 02:16 AM.
 
Old 12-21-2014, 06:08 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,409
Blog Entries: 55

Rep: Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582Reputation: 3582
Quote:
Originally Posted by unnamed1 View Post
I don't know what is my account I just installed linux mint lately.
Open a terminal windowd and type 'id'.


Quote:
Originally Posted by unnamed1 View Post
This NTFS I think it called automatically? I pressed on it and it show me an option to "EJECT" like CDROM and show me the information inside.
Hmm. OK...


Quote:
Originally Posted by unnamed1 View Post
I don't do backup (maybe I should!).
Yes, you should make backups. At least of your personal, valuable data.


Quote:
Originally Posted by unnamed1 View Post
(..) so I can see a detailed information of what being done on my computer behind the scene
There are a few things to be said here:

Familiarize yourself with what you use.
Coming from a Windows background you have experienced Linux does things differently. For example you can choose what software you install and you don't have to pay for say drivers for your video card. More importantly Linux is a Real Life community where users and developers interact. This means reciprocity the act of (actively) paying it forward is not only about you doing "good deeds" but vital for the development of Linux. So if you for example find a bug then please report it so we all benefit from that. Back to differences, if you learn what they are and how to use them, the reward will be (more or less) total Freedom and total control. Take your time to read the documentation. Start with what your Linux distribution of choice offers you. A gentle introduction will help.

Be safe
Linux does things differently and that goes for security as well. While viruses are not a Real Life threat, total control appeals to miscreants as well and abuse comes in many disguises. Don't be greedy: install only what you need. Use common sense: if something looks like it's too good to be true then it probably is. Harden your installation: check your Linux distributions documentation to see where to start. Proper, regular hardening and auditing will make your machine safer to use, trustworthy. And please don't procrastinate: if you have a gut feeling something is wrong, if you notice odd connections, high resource usage or if a warning is shown then act on it.

Beware of Hanlon's Razor
As in "do not attribute to malice what can be attributed to stupidity." You're new to Linux. There may be simple explanations for what (you think) you're seeing. First let's check if you have a firewall and if you've got any services running that you shouldn't have. As root run:
Code:
(iptables-save; netstat -antulpe)
If unsure what these (or other) commands do type
Code:
whatis iptables-save; man iptables; whatis netstat; man netstat
before executing those commands.


Quote:
Originally Posted by unnamed1 View Post
do you have any idea how to A) Enable / Disable this application) I am talking about LoggedFS to CSV, AND B) how to log all partitions. C) where do I find the CSV file location?
That's really a question for your other thread on that subject. On Linuxquestions.org (LQ for short) we don't like duplicate threads and questions as that's highly inefficient to say the least.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Text editior that can "see"/open hiddien files/folders?? like .fluxbox linus72 Linux - Software 4 08-11-2009 07:34 AM
a lot of files "broken"???!!! nessic Linux - Software 3 08-21-2006 12:27 AM
how to list most recent files last: "ls -altr" is almost it learnfast Linux - Newbie 1 05-20-2005 10:53 AM
Clearing "recent files" list in Rh 9 moxieman99 Linux - Newbie 2 11-11-2004 07:19 AM
why iam getting problems like "...too many files opened" or "segmentation fault" naren_0101bits Linux - Newbie 2 07-19-2004 12:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:03 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration