Ubuntu Security :: H4x0rz All Up In Machine?

I have this little nettop box, an Acer Revo, that I use for Boxee/Hulu Desktop with my tv. It's been a fairly enjoyable setup for months, until two mornings ago. The first strike Before work I poured myself some cereal, wandered over to the couch, plopped down and powered on the tv. After the set warmed up, a header image for some banking/something-another website made it from my screen, into my retinas, and slowly turned my otherwise uneventful morning into me chocking on a mouth full of Honey Nut Os as I lept over my coffee table and slammed the off button on my cable modem.

I clean up the Nut Os that I knocked on the floor and systematically change every password on my networked machines (Revo and two *laptops*). I check my router, disable my ssh port forwarding rule, kill remote admin access, change passwords, MAC addr whitelist my wifi connected machines just in case it's a local job. I read through all running processes, check my bash history, look for screen sessions, and so on. Finally I decide that I must have been brute forced, either on my ssh port or perhaps even directly on my router. My laptops should have been, and seemed to still be, in sleep mode since that night.

The second strike So tonight I'm watching a South Park episode (a show I hate to love), about to cut out for the night, when the Boxee menu pops up. I look at the remote and back at the tv; for just a moment I think that perhaps the mouse shifted slightly on the carpet and caused the menu to activate. Then Boxee stops the video, navigates the menu a few clicks, pulls up the exit menu and closes itself. ......