-2

Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not?

My only clue is that my mouse sometimes start to move randomly (it is not a mouse error, not even straight line moves, and sometimes 5-10 secs around the screen.

I am using fedora 17.

How can I verify this, and stop it?

Icallyca
  • 19
  • 1
  • 1
  • 1
  • 9
    Is you mouse wireless? If you only experience random mouse movements, I'd first think about either interference, dirty optical sensor or any other mechanical damage to the mouse, not about someone strange that enjoys controlling your PC just to randomly move mouse. – Oleg V. Volkov Sep 11 '12 at 11:07
  • @Polynomial Under Linux? Technically possible, but highly unlikely. – Gilles 'SO- stop being evil' Sep 11 '12 at 11:40
  • @Gilles The question is almost exactly the same, but just for Windows instead. The same principle applies. – Polynomial Sep 11 '12 at 12:09
  • @Gilles We haven't gotten any feedback from the OP of the proposed duplicate to verify whether he's actually experiencing network activity on the standard RDP port, or is just guessing at it because of mouse movements. – Iszi Sep 11 '12 at 14:06
  • In addition to @OlegV.Volkov's recommendation, you should also check your system for any USB devices you don't recognize (such as someone else's wireless mouse receiver). – Iszi Sep 11 '12 at 14:07
  • 2
    Real hackers don't use the network to remote-control your computer, they use a butterfly with very accurately timed wing flaps, creating small changes in atmospheric pressure, which in turn causes electromagnetic radiation to hit your computer, flipping specific bits in memory thereby allowing them to alter your system's state to their advantage. – Thomas Sep 11 '12 at 14:30
  • @Oleg V. Volkov no its not wireless. And somehow I doubt the mouse would make complex movement across the screen because of dirty sensors. Besides I dont think actual real hacking is involved, rather I suspect my computer is may being monitored. – Icallyca Sep 11 '12 at 15:26
  • 4
    @Thomas - no they use emacs C-x M-c M-butterfly. – dr jimbob Sep 11 '12 at 16:30
  • 2
    Is it a laptop? Does it have the Thinkpad nubby pointer? Does it have a touch pad? If the answer is yes to any of these, there are known issues that can cause random mouse movement with these devices, particularly on non-standard OSes that sometimes have spotty or minimal driver support. Also, you can get some really weird movement if sensor's are partially blocked (such as by a hair across the sensor). – AJ Henderson Sep 11 '12 at 16:57
  • 2
    @Icallyca I think you have some misconceptions regarding monitoring and remote control. Monitoring is just watching (or recording) your screen, or the data being passed to/from your computer. It would not cause the mouse movements you've described. Remote control, on the other hand, is actually hijacking your computer in order to make it do tasks other than what you would have it do. This can be done in the background, but some methods (i.e.: VNC or other "desktop sharing" applications) will actually show themselves in ways such as what you're experiencing here. – Iszi Sep 11 '12 at 16:57
  • 2
    Also, regarding the "Thinkpad nubby pointer" to which @AJHenderson is referring: Check this thread on SuperUser for other common names of that device, and some pictures. He's definitely right in saying that driver or hardware glitches, as well as accidental bumps, with these devices could cause the problem you're describing. – Iszi Sep 11 '12 at 17:00
  • Read this article to know how people can control your computer remotely. –  Sep 11 '12 at 10:31

5 Answers5

4

If someone is accessing your computer then there will be network traffic related to this. While if you suspect that your PC has been compromised, then you can't rely on data you get from the computer but you could monitor the traffic using a seperate box and (e.g.) wireshark

Community
  • 1
symcbean
  • 18,625
  • 1
  • 41
  • 75
4

netstat (network Statistics) is a simple command line tool that displays all active connections both incoming and out coming, and provides a number of useful network interface statistics. You can explore it further at how to use this command to detect suspicious IPs. For Blocking you can use IPtables which is a very useful network layer firewall to block all the blacklist IPs or unwanted outbound connections by writing rules for them.

Ali Ahmad
  • 4,844
  • 8
  • 37
  • 61
3

First off, you will need to provide more information in your question to help this audience narrow down and assist you. As you have proposed it, your question is like asking - my house might have been broken into, how can I tell while I am on vacation in africa.

Secondly, having installed linux systems (fedora being one of them) on a variety of hardware configurations, you can sometimes get this behavior just from the system. Lately, for instance on my Ubuntu system, I have been finding for some strange reason, when I connect USB drives (clean ones I know for a fact) to my machine, my wireless mouse starts doing a very similar behavior - it becomes erratic. So what you are witnessing could simply be a kernel change that is flaky.

Finally, the advice provide above is good, however some pointers and thoughts:

  1. If a rootkit has been installed on your machine, understand any utility (including netstat) could be subverted, so you can not test what is being reported. If you are wanting to listen to network traffic coming from/to your machine you will need to do it from an independent machine. You can do this very easily by grabbing a Snorby appliance and setting it up on another machine (its a VM) on your subnet and listening to your traffic. (https://snorby.org/)

  2. Boot your machine with a clean fedora livecd and gather md5 hashes of all the key binaries. Then go set up a clean instance in a VM and bring it to the same run level as the one yours is and capture the same hash base. Do a diff.

  3. Run through the SAN checklist provided.

  4. Google around and see if other users of your fedora version/level are having similar issues with the mouse config you have. I would do this FIRST before anything else.

Just a few of the quick things you can do. You can be as diligent as you want, and take it to whatever level you want. Its up to you and the time you have.

Tek Tengu
  • 1,719
  • 11
  • 13
2

There is a really REALLY simple thing you can do to figure out if this is a technical issue or a remote access. If it occurs regularly, simply disconnect your computer from the network the next time it occurs. See if the movement continues or is terminated. If it ever happens while disconnected, it is a technical problem. If it consistently stops when disconnecting the network, then you will probably want to look in to things more closely.

AJ Henderson
  • 42,081
  • 5
  • 65
  • 112
1

You can check whether there is a remote desktop app listening on your computer using netstat (netstat -ltp or netstat -ltpn if you want netstat to resolve hosts and ports). The most widely used remote desktop app is VNC I guess, which should listen on port 5900 by default. If something like that is listening, then you may have a problem :)

But if you can't find it this way, it doesn't mean your computer is safe, because the person may have installed a rootkit that hijacks the informations read by netstat. So you could install something like wireshark and tcpdump, stop all your activities using the network (web browsing, e-mail, IM, etc) or learn how to use filters in wireshark/tcpdump and see if there is remaining network activity. Then you'll have the IP address from which the person should be connecting (it may be spoofing his IP address using some tor or socks relay but that's beyond the scope of this reply).

You can also use nmap to find open ports on your computer. But sometimes, some backdoors use port knocking (they wait for specific packets with a particular flag enabled for example) to hide (SAdoor uses this).

You can run chkrootkit and rkhunter commands on your system too. But it won't detect tweaked backdoors.

You can get other useful advices on the cheatsheet here: http://www.sans.org/score/checklists/ID_Linux.pdf

meik
  • 56
  • 3