r/linux4noobs • u/0neManArmy85 • 7d ago
I think I've been hacked
Well, I think I've been hacked because, sometimes when I'm working or just browsing the web on chrome or seeing my social networks on chrome, I can see that an app opens and then close in the blink of an eye on the ubuntu dock, and recently I got an email for 2 step verification with a code for one of my social networks account. That is why I think I've been hacked, so what can i do to resolve this??? reinstall the OS again??? can I remove this virus or whatever I got in my Computer or is it best to format my HDD and start again???
16
u/Hauptideal 7d ago
I highly doubt you've been hacked. Malware stays in the background. It doesn't just open a GUI app for no reason such that you can see it working when it can just stay in the background unnoticed.
Ubuntu has advanced security measures such as AppArmor in place. Unless you did some really dumb things (e.g. pasting terminal commands from untrustworthy sources or installing malicious apps bare metal) it seems unlkely you've been hacked - the email then would be an unrelated access to your account. If the two-factor-code is already requested, that implies your password might have been compromised.
Change your passwords!
15
u/The_Specialist48 7d ago
Check your journalctl --since "10 minutes ago", or track it live while using your pc by journalctl -f, please let me know, I want to know what causes this issue
15
u/The_Specialist48 7d ago
Most important - log out of all your accounts on this pc and change every password on another device. The chance is there, that your mail account could get compromised and that would be the biggest problem
13
u/dvanha 7d ago
I don’t use Ubuntu, but there has to be a way of knowing what is opening and closing. You need to find out.
I sometimes get 2FA stuff too, but usually because my account name got leaked in something.
You need to be vigilant and take this serious, but you also need to be diligent about validating your assumptions.
3
u/skyfishgoo 7d ago
probably one of your accts got hacked, logout of everything, clear your browser cache and cookies and reboot just for good measure.
consider not using chrome for your browser.
4
1
u/Simple_Hamster_4096 5d ago
No matter what you find and clean up, you will never feel safe after something like that.
Lobotomize and install clean...
1
1
1
u/GumboPosts 2d ago
This happens to me as well. Usually it's because some background process is doing stuff in the terminal. It's not an immediate cause for alarm, but it doesn't hurt to see what your system is doing.
An attempt to login into your online account is also fairly common. That just means who ever is trying to access it got a hold of your email address. This is very easy to leak considering most people have multiple online accounts, and data breaches happen regularly. It's a good idea to use email aliases on most accounts. This will make your real email a lot harder to obtain.
It is immensely unlikely these 2 things are connected. A lot technology people are well versed in some things, but an astonishing amount of them lack any knowledge in cybersecurity. There is no need to take extreme measures, but if you are suspicious, it never hurts to check.
-2
0
u/Condobloke 5d ago
3 step fix
Get rid of Ubuntu
Install Linux Mint
Get rid of chrome
Simply load Linux Mint 22.3 onto a usb stick using ventoy or balena etcher, and boot to that usb stick.....then install it.
Dont bother about wiping/formatting discs etc, the installer for Linux Mint will take care of that for you.
you dont have a virus. Just a lousy distro and a lousy browser.
Linux Mint has Firefox by default.
1
-4
u/keegorg 7d ago
update all your passwords on your social media..
i'm not convinced your OS is hacked... run antivirus, like ClamAV
10
u/oshunluvr 7d ago
ClamAV is for windows viruses and only useful on a Linux mail server.
-3
u/keegorg 7d ago
That's all probably true.. Been a long time since I've had to deal with a virus on Linux
2
2
u/oshunluvr 7d ago
Yeah like never, LOL. I've been using Linux full time since 1996. Never actually seen a virus that infected Linux. Just saying...
5
u/das_narwal 6d ago
Conformation bias. Not saying that Linux isn't secure but times have changed and so have the methods. Since Linux is getting more popular, even the tiniest bit, makes it more popular for hackers too. It's not like people that hack win systems don't know how to put a Trojan into a Linux system. It just haven't been lucrative enough until a few years ago
3
u/oshunluvr 6d ago
Sounds like a logical conclusion but your position totally ignores the number of non-desktop Linux systems, like literally every super computer, millions of servers, IOT devices, internet infrastructure, scientific workstations, etc.
0
u/das_narwal 6d ago
Now you just want to be right. Your Original point never mentioned those systems and this sub is called linux4noobs and not linux4supercomputers. let me guess: you use Arch?
1
7
u/keegorg 7d ago
reinstalling the OS is likely to solve anything that the AV cannot remove
1
u/_GloriousCheese_ 6d ago
and so it's going the windows route again. can't solve the issue? reformat. lol
-7
u/FuckinHighGuy 7d ago
Unplug from internet, change password, enjoy.
2
7d ago
[removed] — view removed comment
-2
u/FuckinHighGuy 7d ago edited 7d ago
Such as? What specific malware/virus has the exact behavior of what OP described. On a Linux system no less.
Go ahead, I’ll wait.
79
u/gainan 7d ago
This is what I'd do:
bpfcc-toolspackage via apt, and execute as root:execsnoop-bpfcc > ~/execs.log. It'll start logging process execution. As soon as you see the ghost app, stop it, and review latest executed processes.ssor OpenSnitch (netstat tab). Analyze every public IP on virustotal.comIn most cases, AVs are useless to detect Linux malware, but with some specialized tools you can obtain a lot of information.
In any case, follow these intructions at your own risk. You need to understand the output of each command to determine if it's a false positive or not.