Am I hacked?

[ubtutu654]

I am a UNIX novice but not total noob.

Something is leeching a ton of banwidth on my ubuntu 13.04 box.

While researching it I stumbled over a thread from a guy who was hacked and I wound up getting a list of all the users on my system.

I think this looks very suspicious - can anyone tell me if I'm hacked or not, please?

I am terry on this list

root
daemon
bin
sys
sync
games
man
lp
mail
news
uucp
proxy
www-data
backup
list
irc
gnats
nobody
libuuid
syslog
messagebus
avahi-autoipd
usbmux
dnsmasq
whoopsie
kernoops
rtkit
speech-dispatcher
lightdm
avahi
colord
pulse
hplip
saned
terry
dhcpd
guest-yla6m4
guest-J9XWdv
guest-bUlUPz
guest-ajBhyE

[Habitual]

Did you create these guest-* accounts?

[ubtutu654]

No. I created terry. The rest just showed up. rtkit looks damn suspicious all by itself.

[The Cog]

rtkit is RealtimeKit. See "man rtkitctl". I don't think that's a problem.

If you want to see what's using the internet, probably these commands will help:

sudo netstat -tup
sudo lsof -i

[Habitual]

how about using the last command on each of the guest-* accounts and see if they have logged in?

I agree is it alarming and you would do well to be prepared for counter-measure of the re-install kind if you cannot find the method of entry.

[ubudog]

how about using the last command on each of the guest-* accounts and see if they have logged in?

I agree is it alarming and you would do well to be prepared for counter-measure of the re-install kind if you cannot find the method of entry.

+1

Have you examined /var/log/auth.log?

[cariboo]

Those guest accounts are created automagically when you log into that account. They should be removed when you reboot the system.

[Habitual]

I never thought about the "guest" feature of the Ubuntu OS. My bad.

[raja.genupula]

okay , can you post output of

ac -p

you can see , all the users and their total active time. so that you can see the blackhat account.

[bashiergui]

I would focus on network traffic in your instance. If something is eating up bandwidth then start with

top

and see what processes are using lots of cpus. You could try to run

sudo netstat -npta

on the suspect computer, but it's best to watch network traffic from another machine using tcpdump or Wireshark.


When you have a process name from top then Google it to determine if it's legit. Then you can determine if it's a hacker or if it's some process that has gone wrong.