Cheese Webcam Booth - backdoor Trojan?

[dunbrokin]

The weirdest thing just happened to me.....(or else I am going crazy - possible but not very probabale). I have two ID's on my PC. One for work and one for home. The home one is the master ID. I was using the work ID taking some mug shots using Cheese Webcam Booth...when, all of a sudden, a voice (in a foreign accent...like a French accent) said laughingly " I am watching"....I must say it frightened the Bejasus out of me. I am on a wireless LAN and there is only one other PC on the LAN and that runs my weather station....

What is going on?

How do I check my logs to see if an intrusion has occured?

[snek]

First of all the question is if your WIFI is secured.
Second you might want to check open connections using:

netstat -a

Third you will want to configure iptables to only allow ports you need.

If someone got access to your machine through SSH you can check the auth.log like so:

sudo cat /var/log/auth.log |grep ssh

This will show all SSH connection (attempts).

It is a bit scary though, I agree!

[loell]

oh come on, could it be that you're watching some flash based movies, that may have coincidentally utter the words "I am watching"?

[dunbrokin]

oh come on, could it be that you're watching some flash based movies, that may have coincidentally utter the words "I am watching"?

Entirely possible...except that my browser was not running at the time....so, curiouser and curiouser..

[dunbrokin]

First of all the question is if your WIFI is secured.
Second you might want to check open connections using:

netstat -a

I live in a remote area, so while theoretically my wireless could have been hacked, it is not likely. The output of netstat -a is very long and, I am unhappy to say, makes little sense to me.

[dunbrokin]

sudo cat /var/log/auth.log |grep ssh

This will show all SSH connection (attempts).!

:~$ sudo cat /var/log/auth.log |grep ssh
{sudo] password forxxxj:
:~$ sudo cat /var/log/auth.log |grep ssh
:~$

[dunbrokin]

How do I configure iptables to only configure ports that I need...how do I know what ports I need?

[canadiandude007]

I would recommend reading this first (about intrusion detection):

http://ubuntuforums.org/showthread.p...es#post5787017

and this ...

https://help.ubuntu.com/community/IptablesHowTo

Both very useful. Good luck!

[dunbrokin]

I would recommend reading this first (about intrusion detection):

http://ubuntuforums.org/showthread.p...es#post5787017

and this ...

https://help.ubuntu.com/community/IptablesHowTo

Both very useful. Good luck!

Thanks for that...the first link seems really complicated...not sure I am up to that....I should be able to crack the Iptables....but is there any traces in the logs where the intruder entered and how they entered?

[mikewhatever]

I live in a remote area, so while theoretically my wireless could have been hacked, it is not likely. The output of netstat -a is very long and, I am unhappy to say, makes little sense to me.

You can put it all into a text file and attach the file for review. Run the following command, then check for netstat.txt on the Desktop.

netstat -a > ~/Desktop/netstat.txt