Thinkpad-trackpoint-moves-on-its-own-on-linux

[demos95]

Hello

Following previous Talk on Link (Wrong Category) : Bug 33628

I have currently an issue on my Laptop Lenovo ThinkPad T490S
The problem is as Bug Reported (but not bug finally ) Bug 33628

The Thinkpad Cursor Pointer of my laptop is moving some times to times in wrong Direction or doing Strange movement
Sometimes similar to Human Movement
Same Movement in same direction some time to time

What I have notice also is sometimes the cursor is not stable
if you use two finger on the Pad for the Mouse of the Laptop
The Two finger make instability to the cursor

But !

The problem is occuring only some times to times

I noticed
Generally it's after going to Firefox
Also
I Generally have Internet Wire Connection ( Wifi Deactivated, Bluetooth Deactived ) only wire
if I remove the Ethernet Wire for internet
The cursor pointer stop to move

Also I have noticed
The problem occures even after restarting my distrib from scratch
Saving files but not touching or opening them
I think the issue come from internet .. I think Firefox

Then
Generally if I reset my Laptop
I then change my password or User name
the Laptop by going to the web sometimes have the Fan Turning
And then the cursor move strangely

I then Start to notice this issue
When the cursor is moving I Disconect my wire and then there is no issue anymore

I think this issue is concerning Linux Distrib
But I think the issue is also concerning other distrib

Cause my FAN is going up there is possibly Leak Of Security Exploit
And then ... Cursor movement ..
Both are tiring...

If you have any question please let me know
Kind Regards
Demos95

"Linux localhost.localdomain 6.6.52-desktop-1.mga9 #1 SMP PREEMPT_DYNAMIC Thu Sep 19 20:27:15 UTC 2024 x86_64 GNU/Linux"

Link previously shared :
https://superuser.com/questions/1200352 ... n-on-linux

[Germ]

The easiest answer is, if you do not use the trackpoint just disable it.

[doktor5000]

I'd say you should replace your touchpad.

Just because your mouse pointer is moving, does not imply a "security breach" or "trojan" or "hacker attack".

[Germ]

is this the little round toggle in the center of the keyboard? or am I thinking of something else?

[doktor5000]

That's the thinkpad, which would be replaced with the keyboard. But OP also mentioned

What I have notice also is sometimes the cursor is not stable
if you use two finger on the Pad for the Mouse of the Laptop
The Two finger make instability to the cursor

Sounds partially to me like the common problem where touchpad is not disabled and having palm of your hand or thumb on the touchpad without palm detection normally makes the cursor move.

[Germ]

Yes, it does sound like that. It's especially sensitive on my Dell Latitude. I always disable it.

[morgano]

Also initially discussed at https://bugs.mageia.org/show_bug.cgi?id=33628

[demos95]

Hello

So Following the last few days the TouchPad Move again and get unstable
I used the "little round toggle"

The Round Toogle have more strengh on the drive and movement of the cursor
if I use the Little round Toggle
I have less instability it's right

But I'm not completely sure the cursor is not able to move without touching the touchpad
I mean maybe cursor is able also to move sometimes alone I don't know ...

Also there was some update recently
I might not have less issue now
But not sure ...

Just to mention this issue might exist in other OS also Windows etc

[doktor5000]

Just to mention this issue might exist in other OS also Windows etc

If it's a hardware or user issue then it will exist in ANY operating system no matter what.

[demos95]

Hello

Just to add to the discussion
If I type the command "TOP"

The User connected are : 2

I saw also 3 sometimes
is that ok ?
strange no ?

Demos95

[doktor5000]

What is this thread actually about? Is it about a strange behaviour of your trackpoint/cursor ? Or is it about you assuming you have somehow been hacked, like you mentioned in the bugreport?

If the former, that can be easily verified e.g. with a Live DVD without network access.
If really the latter, and you're being honest about that - WHY would you keep using that box, and not reinstall and recheck all your online accounts, or get new ones ?

[demos95]

Hello

yes the Thread is related to the Trackpoint/Cursor sensitive or unstable some time to times

if I disconnect my laptop from internet
I do not have the same issue

The unstability of the Cursor generally occurs after going to some website
Sometimes editing my own website...
I do not understand this

I think there might be PHP Leak that create Security Breach and alter my cursor

Also the Cursor instability might be also cause of External Hack Behavior
But
It migth be a side effect ... not the reall issue
For exemple someone succeed to break the access to the Computer
but then the cursor just higlight the access

so Maybe the cursor is not the worse problem

Following what I said previously there is no problem if I disconnect from internet
Also the issue is only occuring some time to times..
AJAX issue possibly ?
But then Security leak there ?
I don't know
I didn't tried DVD
But I have multiple time try to reinstall my computer
with new User and Password
After reconnecting to some website wordpress personal website
The Laptop do lot of FAN noise
And the cursor get unstability

After this the Fan Get normal but cursor is moving some time to times

Demos95

[demos95]

My Cursor move strangely and get unstable when I go on Some website
as for example Following code bellow

The Website is showing only Simple Button list that you can activate
It's like 5 or 7 button list that you can Activate or Deactivate

But then Simply going on few button with the cursor make the Cursor unstable ...
As Trembling Cursor...

Maybe it's a program as trojan moving the cursor automatically

I tried some minutes after

But it didn't do the same ...
Not sure why
But for sure this issue is not occuring if I reinstall my laptop

The Website page is containing PHP and Java Script
( it's a Random website as SuperMarket Website )

Code: Select all

<form class="row" method="post" action="/app/user/opt-ins/set/signup/17111709">
    <input type="hidden" name="application_override" value="Y">
    <input type="hidden" name="application_id" value="41308488">

    <div class="col-md-8 margin-top col-md-offset-2">

        <div class="text-left ">
            <h4 class="text-center">Opt-in and communication settings</h4>
            <p><b>Please note:</b> These settings can be updated on the settings page of your account</p>
        </div>

        <div class="text-left margin-top margin-bottom-lg">
            <div class="control-group margin-top-sm">
                <div class="controls">
                    <label class="switch switch-card">
                        <input type="checkbox" id="opt_in_checkAll">
                        <span class="switch-indicator"></span>
                        Check all
                    </label>
                </div>
                <div>
                    <label class="switch switch-card">
                        <input type="checkbox" id="opt_in_checkAll_recommended">
                        <span class="switch-indicator"></span>
                        Check all recommended
                    </label>
                </div>
                <div class="opt_in_checkboxes">
                                                                                                <div class="controls">
                                <label for="opt_in_job_matching" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_job_matching" name="opt_ins[]" value="job_matching" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want to be automatically alerted when jobs are posted that I might be interested in                                 </label>
                            </div>
                                                                                                                        <div class="controls">
                                <label for="opt_in_suggest_profile" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_suggest_profile" name="opt_ins[]" value="suggest_profile" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want to be suggested to recruiters for other jobs that I might be suitable for                                 </label>
                            </div>
                                                                                                                        <div class="controls">
                                <label for="opt_in_recruiter_contact_new_opportunities" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_recruiter_contact_new_opportunities" name="opt_ins[]" value="recruiter_contact_new_opportunities" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want recruiters to contact me about other suitable opportunities                                 </label>
                            </div>
                                                                                                                        <div class="controls">
                                <label for="opt_in_recruiter_contact_updates" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_recruiter_contact_updates" name="opt_ins[]" value="recruiter_contact_updates" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want recruiters to contact me about other company news and events                                 </label>
                            </div>
                                                                                                                        <div class="controls">
                                <label for="opt_in_sms_application_updates" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_sms_application_updates" name="opt_ins[]" value="sms_application_updates" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want to be kept informed of my application progress by SMS                                 </label>
                            </div>
                                                                                                                        <div class="controls">
                                <label for="opt_in_sms_general_updates" class="switch switch-card">
                                    <input type="checkbox" id="opt_in_sms_general_updates" name="opt_ins[]" value="sms_general_updates" data-recommended="true">
                                    <span class="switch-indicator"></span>
                                    I want to be informed of other company news by SMS                                 </label>
                            </div>
                                                            </div>
            </div>
        </div>
    </div>

    <div class="form-actions">
        <button class="btn btn-primary" type="submit">Save and continue</button>
    </div>
</form>

[isadora]

The following code is simple button that you can activate

Acknowledging yourself code is presented, please also reserve some time for properly formatting your messages.

[doktor5000]

You seem to be ignoring the important part of the question.

If really the latter, and you're being honest about that - WHY would you keep using that box, and not reinstall and recheck all your online accounts, or get new ones ?

But go ahead and keep asking if you have been hacked or if there's some kind of security breach, you seem to be trolling.

[demos95]

Hello

Thanks for your Question
"- WHY would you keep using that box, and not reinstall and recheck all your online accounts, or get new ones ?"

I Think this issue is not impacting only Mageia.. That box if you mean Mageia Distrib I think it's not only Mageia
I think I saw the issue on Windows also with Lenovo laptop in the past

Keep using that box
It depend
At least reporting it can help everyone

[demos95]

( in Context of Microship and Computer Science Trust issues )
On linux it's quite bad to see cursor moving strangely

[doktor5000]

At least reporting it can help everyone

Spreading some weird conspiracy theory can help everyone how in particular ?

[demos95]

Hello

"Spreading some weird conspiracy theory can help everyone how in particular ?"

Conspiracy... Ah ok... well.. sorry
Just to highlight we are not in best IT computer History Cycle
I thought more in a sense everyone is not sure about anything
Having cursort moving in lot of direction ... is not so much Dangerous as an exploit but can also affect trust

Today I got situation when a process on my Laptop get overloaded

Firefox >
https://nvd.nist.gov/vuln/detail/CVE-2024-9680
https://uk.pcmag.com/browsers/154823/up ... n-the-wild

A Exploit seems exist in Firefox ...
But ...

Today I got also an other issue
So what happen is the following

I went to my Wordpress Website
I login to it (2FA authentication)
Open a "Post" to edit it
I wanted to change a picture
So I delete the old picture and try to add new one
but when the Menu open to give me access to the Picture Library
Then The Cursor moved in lot of dirrection
Getting unstable

Then This time with the cursor moving
I got Process on Top Menu that get in high CPU
Process impact in TOP :
"ksoftirqd"

It's seems IRQ connection in problem

so Just to precise
I have Reinstall my laptop recently without so much change since it happen
I will report this issue to other instance

Thank you
Demos95

[doktor5000]

I don't understand your reaction. You suspect an exploit/hacker attack/security leak/breach since 2 weeks ago.
Yet you still keep using that machine with the suspected exploit/hacker attack/security leak/breach you know about, which seems to return after reinstallation.
That does not make sense at all, that would mean the vulnerability is either contained in e.g. your browser profile, contained in your backup or somewhere else where it returns after reinstallation.

If you really suspect exploit/hacker attack/security leak/breach/whatever then you should immediately cut any network connectivity and shutdown that box.
If you're interested in it you could bring it to some local whitehat hacker/computer enthusiast club or if there's a local university with a good computer forensics department you could ask them for help.

[demos95]

Hello

Thanks for your reply
Yes I suspect exploit/hacker attack/security leak/breach
Yes it return after re-installation ( on Mageia 9 last update with Laptop Lenovo T490s )

My browser do not have anything specific changing comparing to my config in the past
The problem might have come from my Backup
But

There is very narrow chance for this
Cause when I reset my laptop
I create new profile

I just realise it's true I move file in my new profile
I cannot remind if the issue occured without moving my back up

... I can try that to see if the issue come from my backup files

So generally when my cursor is moving
There is two possibility the Fan get higher ... in the past in some occasion
But not anymore

But recently Cursor continue to move and get unstable

That's good idea regarding White Hat
I just wanted to precise
I have did lot of Scan of my backup with CLAMAV
But no detection of anything also

I would like to precise aussi
My Personal Website often make my cursor moved in the past
But
It also occurend in different web site
looking for something and get suddenly my cursor moving

... I will continue to investigate
Do you have any idea of what log I can check when it occurs

It's seems to be Hide from network visibility
If We verify a Network Dump
It's sound ok

I think we might be able to see some trace in the OS
But Where ?
Do you have any ideas

Thanks for your help already

Demos95

[demos95]

I tried to check the F12 but it didn't shown so much new information
The issue from F12 screenshot in past Forum Thread shown Website Code F12

If I recall
The problem of the issue appeared even after reseting my laptop and going to new website even without touching so much my Backup

Very Strange

Possible it's trojan ... but Clam av do not detect it
Hide Files ... on part of the disk
But it would be visible in the Hidden Files with LS command

or Brut force
Forcing SSH
But I Have Firewall activated on my distrib

I don't know
it get better last few days
But .. it cursor sometimes trambling still occuring

I would like to add also the Cursor Trambling is maybe not a bad Signal
if we fix this
maybe we will not notice then someone is Hacking the connection

So Cursor unstable might be a bug finally showing there is an other leak
Thanks for your help

If you have any question
or any Ideas which log I can check when it occur please let me know

Demos95

[doktor5000]

clamav has a detection rate around 60% which is far below commercial antimalware products, so that doesn't mean your box is clean when clamav doesn't find anything.
And please stop spamming this thread with some suspected exploit/hacker attack/security leak/breach nonsense.

You also seem to ignore the hints given in the thread, to disable the touchpad for further troubleshooting.
You could also easily monitor the X input event to check if this comes from your hardware. See https://unix.stackexchange.com/question ... mouse-in-x or https://www.baeldung.com/linux/mouse-ev ... -interface
xinput (which might need to be installed) will show the device for each cursor move.
If you disconnect network and you still have mouse input events then this is clearly faulty hardware, and that would also explain the CPU usage by ksoftirqd which is a kernel process for IRQ handling - which are generated by all attached hardware.