Get a carbon monoxide detector

Run strace (or falco) and log every file open. When you hear the sound, reference the log of what files were accessed at that time.

Run tcpdump and capture all traffic. Analyze it in wireshark, searching for a time window around when the sounds happened.

FWIW putting pranks like this in cron or systemd is a common way to haze people who have bad security practices. We also used to set the default run level to 3 or 6, but of course that doesn’t make sense in the era of systemd.

lmao this is a targeted campaign to fuck with you. Look at people in your circle of family/friends/acquaintances/enemies and you’ll find your suspect. Real viruses don’t do anything as remotely entertaining as this, they just steal your passwords/crypto/etc, ransomware your files, or turn your PC into a botnet for internet spam or mining.

Download a fresh install of debian, flash it onto a usb, and do a reinstall. Use different root/user passwords that you’re certain nobody knows, and ensure you lock the computer whenever you step away. Also, obviously, be careful with what software you’re installing.

It’s very unlikely you’re getting hacked, but if you wiped and then reinstalled using the same credentials again…who knows.

Can you tell a bit more about your setup? Do your speakers have Bluetooth? Do you have some other type of wireless devices hooked up to your machine?

• Start by checking your auth logs for logins or executed commands
• Check and see if another user has been created
• Did you run scripts from anywhere during your setup? If so, like them here.
• Use the ‘w’ command to see if anyone else is logged into the machine when the noises happen
• Disable SSH on your machine temporarily and see if the sounds stop. If not, it’s unlikely your machine is compromised, but more likely the sound is coming from your speakers having wireless comms of some sort.

Persistence should be near impossible; you most likely have a bad habit or other factor that makes you vulnerable. As others have said, check your router settings; make sure your router firmware is the latest to patch any vulnerabilities. Check devices on your network to make sure none are compromised.

My first guess, like others, is you’re doing something horribly wrong with your port forwarding, followed by you’re installing suspect software. Don’t go installing from random Github/Gitlab repositories without at least doing a bit of background research. Also, sometimes even legitimate open source projects get compromised. Ultimately, try to stick to the bare minimum, just stuff from the Debian repos, and see if it still happens.

If you still have the problem, then my last resort is to ask this (and this is really paranoid, hopefully an unlikely scenario for you): do you use your computer in a safe environment where only people you trust can access it?

I mostly ask because if not, maybe someone has physical access to your computer and is pulling an evil maid attack, installing the software when you’re not looking. Maybe it’s a jerk coworker. Maybe it’s a creepy landlord. A login password is not enough to defend against this; it may be possible for the attacker to boot off a USB stick and modify system files. The only way to prevent this is to reinstall and use full disk encryption, which I do on my laptop. You can try to use Secure Boot and TPM¹ to add further protection, but honestly, your attacker just sounds like some script kiddie and probably won’t perform a complex attack on your boot partiton.

1: Despite their obnoxious utilization by Microsoft, they can actually be quite useful to a Linux user, making it possible to set up auto-decryption on boot that doesn’t work if the boot partition has been tampered with (in which case you use a backup password).

Run this command, it will record all audio activity until you stop it to the file sound-inputs.log.

watch -n0.5 'pacmd list-sink-inputs | tee -a sound-inputs.log'

When you hear the sound bites, take a look at it and see which process is triggering the sounds. Might help you discover its cause.

Alternatively you can watch playback streams on pavucontrol. It lists all programs that run sounds, but is less detailed.

Could be schizophrenia or something related too.

Last time I heard about weird audio playing it was Steam’s built-in soundtrack player picking up all kinds of weird stuff and randomly playing it (or getting triggered through some shortcut or something)… just to rule it out, do you have Steam installed?