Arch Linux

physicsshark

Member

Registered: 2014-04-19

Posts: 44

Have I been Hacked?[SOLVED]

Guys, I just saw the weirdest thing.  I unlocked my computer around 1:45 Eastern Standard Time, and I saw a creepy notification.  It said the following: "Nollock was here. DIE".  I've never seen this before.  I clicked the notification (so no screenshot).The date for the notification was around 1:30 (and there was no logo or picture in the notification), a few minutes before I unlocked my computer.  Firefox, Autokey, Dropbox, Nano, Guake and Caja were open at the time.  I can tell you what tabs I had open in Firefox if you need it.  I have a few packages installed from the AUR (using yaourt), I'll list them here in case they are the culprits.

archlinux-artwork 1.6-3
atraci-bin 0.5.2-1
autokey-data 0.90.4-5
autokey-gtk 0.90.4-5
brackets-bin 0.41-1
google-talkplugin 5.4.2.0-1
libepoxy 1.2-3
libgcrypt15 1.5.3-1
libreoffice-en-us-help 4.2.4-1
libudev.so.0 0.1.1-2
makehuman-bin 1.0.0-1
mint-themes 3.10_5-3
mint-x-icons 1.1.8-1
mintmenu 5.5.8-1
preload 0.6.4-6
proot 3.2.2-1
speedtest-cli 0.2.7-1
ttf-ms-fonts 2.0-10

All of the other packages I have installed are from the official repositories.  I've set up a firewall using ufw.  I've never visited sites that would be considered sketchy or dangerous.
Is there any way I can see where this notification came from (like a notification history)?  I'm using MATE desktop.  I don't have any IRC or chat clients installed, so they couldn't have been from that.
I've always thought that Linux was safer than Windows.  On Windows, I've never been hacked.
I'm really scared.  I've been using Arch Linux consistently since April, and I've encountered a few bumps in the road, but never something illogical like this.
I'll keep you updated if anything else happens.  Hopefully, there's a logical explanation to all of this.

Last edited by physicsshark (2014-07-18 18:39:42)

---

"The Guide says that there is an art to flying," said Ford, "or rather a knack. The knack lies in learning how to throw yourself at the ground and miss."  - Life, the Universe, and Everything

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 19,804

Re: Have I been Hacked?[SOLVED]

Probably.
Do you have sshd enabled? Is it accessible from the Internet? Do you have password log on through ssh enabled? Do you have weak passwords?

If they did not try to cover their tracks, you may see a brute force attack in the journal.  Look for lots of failed password attempts.  If they got in (and did not cover their tracks) you should be able to which account they used.  You may be able to look at the shell history to see what they did.  If they are hackers (in the original meaning of the word) they might have just been toying with you to teach you a lesson.  If they were an ass, they may have done damage.

If I found evidence of intrusion, I would back up critical data and reinstall.  Then, lock the system down so that it is a secure system, like it is supposed to be.  We can help you with that.

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

miga

Member

From: Phoenix, Arizona

Registered: 2014-07-15

Posts: 12

Re: Have I been Hacked?[SOLVED]

Is it possible that someone else had access to your PC before you came back and unlocked it? If I remember correctly MATE has an option with its default screen locker where you can type a message for the person to see when they came back to their computer and unlocked it.

---

My computers:
Hakase - Shuttle SX79R5 | Intel Core i7 3930k 3.2GHz (6-core) | nVidia GeForce GTX 560 1GB | 32GB (4x8GB) DDR3 (1600MHz) | SanDisk Extreme 120GB SATAIII SSD + Seagate Barracuda 3TB SATAIII HDD | Onboard sound is faulty
Miyako - ASUS Q501LA | Intel Core i5 4200U 1.6GHz (2-core) | Intel HD Graphics 4400 | 8GB DDR3 (1600MHz) | Intel 520 Series 120GB SATAIII SSD

physicsshark

Member

Registered: 2014-04-19

Posts: 44

Re: Have I been Hacked?[SOLVED]

Is it possible that someone else had access to your PC before you came back and unlocked it? If I remember correctly MATE has an option with its default screen locker where you can type a message for the person to see when they came back to their computer and unlocked it.

Yes, that's probably what it was.  Maybe a prank from one of my siblings.  I'm new to using MATE.  I don't have SSH or VNC set up.  I'll go ask my brother if he knows anything about this.

---

"The Guide says that there is an art to flying," said Ford, "or rather a knack. The knack lies in learning how to throw yourself at the ground and miss."  - Life, the Universe, and Everything

physicsshark

Member

Registered: 2014-04-19

Posts: 44

Re: Have I been Hacked?[SOLVED]

Yep.  That was it.  I'm new to MATE, and I just freaked out and assumed the worst.  My brother is a fan of the open source game SuperTuxKart, and the villain's name is Nolok.  He posted the message from the lock screen as a prank.
Thanks for the help and my apologies on freaking out.

---

"The Guide says that there is an art to flying," said Ford, "or rather a knack. The knack lies in learning how to throw yourself at the ground and miss."  - Life, the Universe, and Everything