Run strace (or falco) and log every file open. When you hear the sound, reference the log of what files were accessed at that time.

Run tcpdump and capture all traffic. Analyze it in wireshark, searching for a time window around when the sounds happened.

FWIW putting pranks like this in con or systemd is a common way to haze people who have bad security practices. We also used to set the default run level to 3 or 6, but of course that doesn’t make sense in the era of systemd.

lmao this is a targeted campaign to fuck with you. Look at people in your circle of family/friends/acquaintances/enemies and you’ll find your suspect. Real viruses don’t do anything as remotely entertaining as this, they just steal your passwords/crypto/etc, ransomware your files, or turn your PC into a botnet for internet spam or mining.

Download a fresh install of debian, flash it onto a usb, and do a reinstall. Use different root/user passwords that you’re certain nobody knows, and ensure you lock the computer whenever you step away. Also, obviously, be careful with what software you’re installing.

Can you record the noise and share it? Consider outlook’s recent arbitrary webdav exploit that fetched a malicious payload from the internet to run if you said it was a custom notifocation sound. That directly attacked a sound producing function and is silent.

It’s not impossible this is an attack but it’s a very rube-goldberg scenario that leads to to suppose there is a literal noisy attacker who can persist through reimaging but can’t stop fucking up an existing sound channel.

It’s just someone fucking with you on discord.

Persistence should be near impossible; you most likely have a bad habit or other factor that makes you vulnerable. As others have said, check your router settings; make sure your router firmware is the latest to patch any vulnerabilities. Check devices on your network to make sure none are compromised.

My first guess, like others, is you’re doing something horribly wrong with your port forwarding, followed by you’re installing suspect software. Don’t go installing from random Github/Gitlab repositories without at least doing a bit of background research. Also, sometimes even legitimate open source projects get compromised. Ultimately, try to stick to the bare minimum, just stuff from the Debian repos, and see if it still happens.

If you still have the problem, then my last resort is to ask this (and this is really paranoid, hopefully an unlikely scenario for you): do you use your computer in a safe environment where only people you trust can access it?

I mostly ask because if not, maybe someone has physical access to your computer and is pulling an evil maid attack, installing the software when you’re not looking. Maybe it’s a jerk coworker. Maybe it’s a creepy landlord. A login password is not enough to defend against this; it may be possible for the attacker to boot off a USB stick and modify system files. The only way to prevent this is to reinstall and use full disk encryption, which I do on my laptop. You can try to use Secure Boot and TPM¹ to add further protection, but honestly, your attacker just sounds like some script kiddie and probably won’t perform a complex attack on your boot partiton.

1: Despite their obnoxious utilization by Microsoft, they can actually be quite useful to a Linux user, making it possible to set up auto-decryption on boot that doesn’t work if the boot partition has been tampered with (in which case you use a backup password).

I don’t believe Debian is susceptible to worms — it wasn’t even susceptible to last year’s xz attack — and if you have a network firewall with port forwarding disabled, there is no way in unless your router’s firmware is compromised. If you’re running any community driven software like, for example, game plugins for servers you’re hosting, those could be suspect. Anything not FOSS is also a suspect. Otherwise, if you’ve already done a secure wipe (using dd, hdparm/nvme, or your UEFI) and used another motherboard then it probably isn’t your firmware that is compromised. You mentioned SSH and credential reuse, so this leads me to think a device on your network, like an IoT device (thermometer, baby monitor, home assistant, Roku, etc.) could be infected with malware. You really can’t trust these things to have any security whatsoever and they need to be placed on a segmented or guest network. This attack honestly seems very immature, something a script kiddie would do, or perhaps it is automated. On that note, automation loves vulnerabilities, so if you forgot to change the default credential on your router for example, I would fix that. Make sure everything is on the latest version and patch everything. I would also start suspecting neighbors and juvenile kids around high school age. If nothing else works then I would do a full Mr. Robot wipe down ;)

Did you try running a scan for malware? I usually use ClamAV. It’s a simple, FOSS anti-virus scanner for Linux. Can run it from the terminal or install a version with a GUI if you’d prefer that.

Where does the sound come from? Your headphones, speakers, etc. Does it ever happen when your machine is off? You mentioned you only have wired audio peripherals - perhaps someone is playing a prank on you and has connected some kind of device inline.

If you’re confident that your system is compromised and it persists beyond re-installations, you can try to reduce the attack surface by switching up your setup a bit.

1. Try installing something like OpenBSD or FreeBSD if your hardware is supported. Software made for Linux often doesn’t even work on BSD flavors unless it’s recompiled specifically for those Operating Systems. Another alternative would be Alpine Linux. Software that relies on glibc often doesn’t work on Alpine thanks to musl.

2. If your network has been compromised, consider looking into your router’s settings. If you can, try to setup OPNSense so you have better control and visibility over network traffic. You can setup some pretty extensive firewall rules, and if you’re savvy with pf you can really go all out. Alternatively, you can setup an app like Wireshark to take a look at what ingress and egress traffic looks like for your device.

None of this has to be permanent unless you’re comfortable with a different setup. Hackers will eventually get bored and move on. You just need to outlast them with a setup they can’t do much with.

Run this command, it will record all audio activity until you stop it to the file sound-inputs.log.

watch -n0.5 'pacmd list-sink-inputs | tee -a sound-inputs.log'

When you hear the sound bites, take a look at it and see which process is triggering the sounds. Might help you discover its cause.

I’m a sappling in the Linux world, so I’m useless to you, but I’m following this thread just in case I start hearing “Ike, we are sick of you talking about ghosts!” coming from my speakers.

How do you think you were compromised? And what have you been doing to make sure you’re not leaking your information to a memelord shit poster of a hacker in the meantime while you’re working on getting this fixed?

Could be schizophrenia or something related too.

Get a carbon monoxide detector

I’d say wipe and reinstall again, but this time with a different Distro and user password, just to eliminate a bunch of variables at once, including suspect install media.

Try Fedora this time. It usually gets the latest security patches in its repos quite quickly, and it has spins for all the myriad desktop environments out there.

There are a lot of ways that the attacker could persist… maybe try a different distro, just to see if it stops? What did you redownload/install when you did your wipe? Do you have any computers on the network besides yours?

Obviously worst case for ‘persisting’ would be your hardware. Do you have a friend who can plug in or connect to your internet and see if they get the same blocked requests? Maybe try a different router/modem.