I think there has been 3 times an intrusion in my computer.
Last week, I was listening music on my computer (ubuntu 12.04.1 LTS on a MacBook Air 4,2), my hands were far from keyboard and trackpad (on a real book) and Firefox had the focus. I'm not a geek and not a 'mum-and-dad' user.
I saw the web page I had opened self-scrolling a few (not reloading). I move the moose and 5 min later it happened again. I disable wifi. At that time aMule was running. Skype too. Some ports were open but not for my IP address. My system was updated 3 hours ago (but not the kernel) and so up-to-date.
10 min later, the ubuntu update manager prompt me updates for the linux kernel. One package was named using Russian (linux-image-generic). It never happened before, so I didn't applied it yet. Yes, I've added Russian language to keyboard-maps and Russian virtual/visual keyboard.
3 days later I saw again an open web page self-scrolling in Firefox. aMule wasn't running, but skype was.
One day later (now), I even find some packages' names translated in Russian in Ubuntu Software Center. Not apps, only packages.
1. How can I know if there has been an intrusion in my computer ?
2. How can I know if someone remotely changed/corrupted some packages or
configuration in my system ?
3. Especially something concerning the update manager ? And Firefox profile ?
Latter, using (for the first time)
sudo lsof -i | grep ESTABLISHED
I didn't notice any strange connection (but I may be wrong).
And (the first time too)
chkrootkit
answer
Checking `sniffer'...
wlan0: PACKET SNIFFER(/sbin/wpa_supplicant[1052], /sbin/dhclient[21907])
Please don't answer me make a new Firefox profile or install a new system (I can take that decision and do it 😉 ) : I want to know, understand, fix and being protected next time.
Here is : the output of sudo lsof -i -n -P
Best Answer
So to summarise your questions, these are the suspicious activities you've seen on your computer:
For the second activity, I would not consider this suspicious at all. Ubuntu is divided into thousands of packages, each one can receive updates. I wouldn't be surprised if not all the packages in Ubuntu's repositories get their meta-data translated into Russian on time before release, sadly. English is still by far the most used language in Ubuntu.
For the first problem, I would say this is much more likely to be a bug than a security breach. Even if you're aware from your touchpad and your mouse, it could well be that the hardware is problematic, sending signals to your computer when it shouldn't, or that the software is buggy, badly interpreting mouse signals.
The output of the commands you ran do not look suspicious to me, although I only glanced at it and didn't analyse it properly.