SOB...concerned I've been breached

Hi All,

I'm concerned my security has been breached but I don't know how to check it. I noticed at least yesterday (could have been before) that my fans were running pretty hard, so I checked up on conky and low and behold, my computer is uploading at 200 kb/s....no clue what's uploading or why. I've checked on different users and all of them show the same thing, as soon as wireless is up it begins, I shut down skype, gwibber, essentially everything that I do as a user and it's still showing 200 kb/s, several gigs uploaded (somewhere)?? in the past two days.


How can I check to see what the hell is going on? I'm pretty nervous right now so any help would be greatly appreciated. Is there an easy way for me to see where my things are being uploaded to? Something similar to the top command for cpu and memory? Thanks again....

Have you run anything like rkhunter to check for rootkits?
Or do you see anything in your running processes that look odd?

I agree with Jayd, run RKHunter after installing and updating it. Check netstat output for anything foreign.

Code:

---

netstat -a

---

Use the who command to see if anyone is logged in

Code:

---

who

---

Check your logs in /var/log
Here is a good starting point.
Linux Administrator's Security Guide - Linux Attack Detection

I ended up downgrading from 11.04 to 10.10. I'm not seeing the issue any more. What would be the result of a rootkit issue? Does that mean someone was taking my stuff from my system? Should I start changing passwords??

The results of a rootkit could be epic pwnage! You could be running a Spam network unknown to you or your machine could be "Rented out" by the attacker for a number of different things, none of which are very favorable.

SOB...how would something like this happen? My passwords are strong, I don't keep root logged in or use su.....a;sdlgkjas;f frustrated

Quote:

---

Originally Posted by jmadero

SOB...how would something like this happen? My passwords are strong, I don't keep root logged in or use su.....a;sdlgkjas;f frustrated

---

Well, you never proved it did happen. Just a hunch, right? The link I posted above should give you some ideas on how it "Could happen".
Just curious, did you completely reinstall? Including formatting the HD?

Formatted my root directory, not my home. Should I be concerned about my home directory?

directory = partition ;) Could something else explain 10 gigs uploaded for no reason??

If you downgraded... did you do that before or after you noticed the odd behavior?