My fellow penguins,

I have been pwned. What started off as weeks of smiling everytime I heard a 7-10s soundbyte of Karma Factory’s “Where Is My Mind” has now devolved into hearing dashes and dots (Morse Code) and my all-time favorite, a South Park S13: Dead Celebrities soundbyte of Ike’s Dad saying, “Ike, we are sick of you talking about ghosts!”

It’s getting old now.

I feel like these sounds should be grepable in some log somewhere, but I’m a neophyte to this. I’ve done a clean (secure wipe >> reinstall) already, the sounds returned not even a day later.

Distro is Debian Bookworm. So how do I find these soundbytes? And how do I overcome this persistence? UFW is blocking inbound connection attempts everyday, but the attacker already established a foothold.

Thank you in advance. LOLseas

  • just_another_person@lemmy.world
    1·
    29 days ago

    Are you reusing credentials or something? It would be VERY weird to just get remotely compromised like that.

    Some other questions:

    1. Does your network not have NAT or firewall of some sort?
    2. What packages are installing that would allow remote access? (SSH, RDP…etc?)
    • LOLseas@sh.itjust.worksOPEnglish
      1·
      29 days ago

      Guilty of reusing credentials. Strong password, but reused.

      I use my ISP’s router and their built-in firewall is saying Enabled on the page.

      Then I run UFW on my PC denying all incoming. It’s one of two rules (the other is port forwarding for CS:CZ server).

      I thought running Mullvad VPN would be another good layer of obscurity, but whatever drive-by malware got through something somewhere. ClamAV reported no infections. No SSH and no RDP. I really am at a loss on how I got compromised.

      Thanks for spitballing with me! I look forward to further insight.