Help with possible hacking

[Kent Kelly]

Hello,

It has been years since I attended meetings of this LUG: timing, circumstances, other interests . . . . However, I now need some help/guidance/suggestions about something that happened. I hope someone in this group can provide it.

I am currently running Linux Mint 20 Cinnamon, Version 4.6.7, Linux Kernel 5.4.0-173 Generic. I check and use the Update Manager at least once a week.

What happened: I was displaying a folder’s contents in icon view when I got up to get something, looked back at the screen and it was now in list view steadily displaying each file at the top of the list one at a time. My first thoughts/questions were that my computer had been hacked (?). I have no idea how to check, cross-check, correct that possibility. I have not gone into any critical site (banking, health, etc.) that might expose my password.

Which is why I’m posting here. Thank you for any assistance you can give.

Kent Kelly

[Ian Weisser]

"steadily displaying each file at the top of the list one at a time"

Are the files still there? Or were the files trashed?

Are you open to considering some mundane possibilities? Stuck arrow key on the keyboard? Transient short? Mouse rolling about?

A hacker good enough to access your system is also good enough to review your files in a way that you won't detect. i.e. not using your screen for the purpose.

Cheers,

Ian

[Tom]

My first assumption would be a stuck key- which is not always a mechanical issue. I have keyboards that don't work reliably on my older underpowered laptop-- the machine seems to "see" key-down events, but "miss" key-up events, with some keyboards, with the result that the Ctrl, Alt, Shift, or "meta" ("Windows") key seems to be stuck down. A quick tap and release of the offending key might fix it, but often I have to tap and release both ALT keys, one after the other.

 

The same keyboard on my other laptop has never exhibited this symptom.

 

You could take a look at the files in a terminal window, using ls -lA to see all the details. See if their modification date/time stamp looks suspicious.

 

-Tom