Compromised Regular System; Unusual input behaviour

Gulver · 2016-01-22 13:29:09

I will not be able to pinpoint a problem or question but rather a few and keep it short:

After a few seconds Xorg session is started pointer starts to make downward movement in a steady pace and MPV constantly pushing the volume down.

I have to say that I always get my computer toyed, using Arch, not on other systems. It's like punching a random guy who is trying to get his groceries to his car in a parking lot who keeps doing it.

Security setup is pretty nominal, a firewall, not a single port open, did not even installed ssh.

I ran a security check and more than a few issues came up, I'm listing below, any help or opinion appreciated.

pass016w: User **** has home directory at / and is not using an acceptable password hash. (This is a stock Arch Kernel)
/var/lib/gdm has 4096 write access (It is unusable ever since I tried to use it)
cron file for unkown user, is not restricted.

Practical queston is, how can I diagnose and fix this automated input behavior?

x33a · 2016-01-22 13:40:51

Create a new user and see if the problem persists with that user as well.

Also,

pass016w: User **** has home directory at / and is not using an acceptable password hash. (This is a stock Arch Kernel)

implies that you didn't create a user properly.

Gulver · 2016-01-22 14:19:41

x33a wrote:

Create a new user and see if the problem persists with that user as well.
Also,
pass016w: User **** has home directory at / and is not using an acceptable password hash. (This is a stock Arch Kernel)
implies that you didn't create a user properly.

****:x:99:99:nobody:/:/usr/bin/nologin
user:x:1000:100::/home/user:/bin/zsh

You are right, I did screwed it creating, is that a security compromisation?

New user seems not to be affected but it is hacked anyway, I'm guessing. What's the procedure from here, I'm thinking a fresh install?

Trilby · 2016-01-22 14:24:57

Wait, is there a problem here other than the mouse pointer floating downward?* I doubt someone has hacked into your computer and took control of your x session to just slowly move your mouse cursor in a consistent direction.

Is this a laptop with a pointing-stick/track-point type mouse? This sounds like just a misbehaving mouse input, and such slow drags in one direction are *very* common with the pointing-stick type input devices. (It's not a zebra)

As for the output of the security check, some security checking programs give many false positives. To explore that further you'd have to tell us what program you ran that gave that output.

*note: mpv volume can likely be controlled by a downward scroll, so when mpv has focus, this same "dirty mouse" input would have that effect.

Gulver · 2016-01-22 22:53:13

Trilby wrote:

Wait, is there a problem here other than the mouse pointer floating downward?* I doubt someone has hacked into your computer and took control of your x session to just slowly move your mouse cursor in a consistent direction.
Is this a laptop with a pointing-stick/track-point type mouse? This sounds like just a misbehaving mouse input, and such slow drags in one direction are *very* common with the pointing-stick type input devices. (It's not a zebra)
As for the output of the security check, some security checking programs give many false positives. To explore that further you'd have to tell us what program you ran that gave that output.
*note: mpv volume can likely be controlled by a downward scroll, so when mpv has focus, this same "dirty mouse" input would have that effect.

Sorry for the late response, I had to be at the graduation of my lil' niece.

It's a desktop with a Trust mouse that is brand new, please note that it happens only in the regular account that I use, nobody, as I forgot to asteriks it. :-)

I've used tiger, with all the options. Got from Aur. It did actually spammed a lot of crap, these are the ones I seemed relevant in anyway; Incorrect hash for example spammed like 70 times. It was working without an hassle and I didn't change anything, get an update from 3.3-2 to 3.3-3 to no avail. Technically, as for mpv behaviour scrolling is not "stuck" in any other application and actually works if that's the case. Sounds stupid I know but, maybe someone has a sense of humor, besides there isn't much thing in it besides porn. Hehm.

Last edited by Gulver (2016-01-22 23:03:35)

Arch Linux

#1 2016-01-22 13:29:09

Compromised Regular System; Unusual input behaviour

#2 2016-01-22 13:40:51

Re: Compromised Regular System; Unusual input behaviour

#3 2016-01-22 14:19:41

Re: Compromised Regular System; Unusual input behaviour

#4 2016-01-22 14:24:57

Re: Compromised Regular System; Unusual input behaviour

#5 2016-01-22 22:53:13

Re: Compromised Regular System; Unusual input behaviour

Board footer