Factory reset macmini M1 2020 is not like the others

Question

Level 1

68 points

Factory reset macmini M1 2020 is not like the others

My Apple devices (less than a year old) have got issues I can't match to anything. I checked the Apple Boot Process guide and my boot appears to be a deviation?

Despite having this particular macmini factory reset at the Apple Store a few weeks ago, it will often run deprecated commands or invoke applications and processes that are a part of the Apple Open Source archive and behave like it is 2023 on the outside and 2004 on the inside.

First time the using in-built Apple apps like TextEdit there was irregular network activity. So I checked them in a sandbox and they contacted a lot of domains and IP addresses via TCP and UDP, added files, edited existing files including RemoteConfiguration.plist - amongst other things.

The firewall and stealth keeps getting turned off, or it will show as enabled in the control panel but disabled in the system report.

I've compared my files against unrelated external machines with the same specs and version there is a great deal of difference between them.

The new updates haven't improved anything. Have checked all the usual things. The Apple guy wouldn't say much other than it had been factory reset now, I waited 7 hours. He suggested I get a cyber security company, but I can't afford one and I'm out of ideas.

start up log

bootstrap path

Mac mini (M1, 2020)

Posted on Apr 5, 2023 8:11 AM

Reply

Answer 1

Best reply

gravityfed Author

Level 1

68 points

Sep 25, 2023 5:01 PM in response to MrHoffman

It is a shame given the reach this affects as there are many others too, that assistance cannot be provided by the manufacturer. Professional intervention understandably comes with a hefty price tag.

But at least now I know that my instincts were correct. It is wild that there is no apparent way to wipe the slate clean. Compromising people’s tech, including a heart defibrillator implant, is not cool. Until the security hole is plugged, the saga continues.

Reply

Answer 2

PRP_53

Level 10

85,537 points

Apr 14, 2023 1:35 AM in response to gravityfed

The correct method for Apple Silicon Computers is as per the Copy and Paste from Apple.

Using any other method like back in Intel Days will not work on M1 / M2 Computers.

If anything, it could led to unintended consequences including and having to Revive the Computer

Now, looking at the Etrecheck Report it is reporting an Apple Silicon 14 Inch computer 2021 but your question is specifically related to an macmini M1 2020

Care to explain what machine is actually under discussion and the User is having issues with ?

How to erase all content and settings - Apple Support (CA)

Do one of the following:

If your Mac has macOS 13 or later: Choose Apple menu > System Settings, click General , click Transfer or Reset, then click Erase All Content and Settings.

If your Mac has macOS 12 or earlier: Choose Apple menu > System Preferences, then in the menu bar, choose System Preferences > Erase All Content and Settings.

In Erase Assistant, enter your administrator information (the password you use to log in to your Mac).

Review items that will be removed in addition to your content and settings.

If your Mac has multiple user accounts, click the arrow next to your account name to review the items.

Click Continue, then follow the onscreen instructions.

Reply

Answer 3

Old Toad

Level 10

207,823 points

Jul 6, 2023 2:33 PM in response to gravityfed

First, there is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac. This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.

There are no known viruses, i.e. self propagating, for Macs. There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.

Anti Virus developers try to group all types as viruses into their ad campaigns of fear. They do a poor job of the detecting and isolating the adware and malware. Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.

There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and remove it. The free version is more than adequate for most users.

Also, unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they aprovide false secutiry from a privacy standpoint. Read these two articles: Public VPN's are anything but private and Former Malware Distributor Kape Technologies Now Owns ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and a Collection of VPN “Review” Websites.

So as you've already bee advised to do uninstall any software that falls in the categories above according to the developers' instructions.

Reply

Answer 4

PRP_53

Level 10

85,537 points

Apr 13, 2023 6:39 AM in response to gravityfed

Part 1 of 2

Any Third Party Applications that will interfere with the normal operation of the OS, is an invitation for disaster.

Certain Applications maybe available on the Apple Apps Store - this only means the Developer is prepared to pay Apple a portion on each sale. What the Application may do to the computer is up to the User to check this out before purchase

Any of the below should be removed as per Developers Instructions

1 - Disk Cleaner

This will include CleanMyMac , aka “ BrickMyMac “

2 - Third Party Security Software

This will include BitDefender ,

This will included Norton Antivirus

Webroot ,

ESET ,

Avira ,

Kaspersky Internet Security

➡️ Total Virus Software ⬅️

Read some of the posting and arrive at your own conclusions.

The The Built in Security is all that is required.

Part 2 of 2

If and only if the user had used Setup Assist on the First Reboot and after Erasing all Content and Setting was performed.

Issues that may have existed when the Time Machine Backup was performed would be migrated to the New Installation on this Computer.

This would badly pollute the new Installation and effectively re-introduced the Old Issue back into the New Installation.

Reply

Answer 5

gravityfed Author

Level 1

68 points

Apr 13, 2023 10:41 PM in response to Mac Jim ID

EtreCheck Report

Thanks, I have posted above, I don't have any other additional apps that I have installed, apart from EtreCheck which I just added.

I did try Malwarebytes previously when I couldn't find any answers, but it hasn't picked anything up.

Reply

Answer 6

gravityfed Author

Level 1

68 points

Apr 15, 2023 7:41 PM in response to MrHoffman

Hi MrHoffman, *grin, yes I’ve seen the three volume books is highly recommended around here, but has it been updated since the mid 2000’s I wonder.

Thanks for your reply, yes digital forensics wouldn’t come cheap I’m sure. I guess that’s why us little people resort to the community forums :)

I ended up installing Little Snitch.

My internet IP address is connected via UDP on port 68 Bootstrap Protocol (BOOTP) client - not listed on TCP and UDP ports used by Apple software products – Apple Support (AU)

and also another connection by netbiosd on port 137 Windows Internet Naming Service (WINS) - odd because I have WINS disabled on my new router modem.

Does my machine think it’s an OS X Server, I wonder? The presence and actions of AFP, SMB, POSIX, XSAN (that would explain rapportd connecting on port 49152), ASR (Apple Software Restore), (TFTP Trivial File Transfer Protocol).

Is there a way of knowing where the boot image is being loaded from? There are NetBoot files on here as well.

Other things:

SMB/CIFS

PPPController

From logs:

opendirectoryd modifying a record for a CIFServer

NotificationCentre: [com.apple.unc:application] Found system centre _SYSTEM_CENTER_:com.apple.mdmclient (also say I’m running mdmclient on user 501/ - me)

wifianalytics (Security) Recording an MDS plugin /System/Library/Security/ldapdl.bundle

CommCentre (Security) Recording an MDS plugin /System/Library/Frameworks/Security.frame

containermanagerd creating a new POSIX user, name = [root] dir: /private/var/root (also created a lot of others)

It’s very frustrating I can’t get rid of whatever it is, everything was bought new from Apple directly and I’m not sloppy installing just anything. I can’t pin it to anything but my Mac mini and MacBook Pro are not operating standard.

Reply

Answer 7

Apr 15, 2023 8:26 PM in response to gravityfed

When you say 'factory reset' how was that actually performed? Was it the 'Erase all Content and Settings'? To be entirely sure install Apple Configurator from the Mac App Store on your second Mac. Obtain a Thunderbolt 4 USB-C cable. Use this guide to put the Mac Mini into DFU mode and use Apple Configurator to Restore the Mac to factory. It will download the signed Ventura IPSW file from Apple and then fully reset the Mac to factory. This should provide some peace of mind. Revive or restore a Mac with Apple silicon using Apple Configurator – Apple Support (AU)

The Apple logs are deeply confusing and full of a massive amount of debug detail that mostly internal Apple engineers can decipher. The logs are also scrubbed of sensitive data to protect privacy. This changed when Apple introduced the Unified Logging functionality. To learn more than you ever wanted to know about reading and parsing the logs see Howard Oakley's blog: https://eclecticlight.co/2021/09/27/explainer-logs/

He has several utilities to help with parsing and reading logs. Lots of posts that deep dive and provide useful insights.

In addition, there is the packet filter PF firewall that is ported over from BSD UNIX. A handy utility to help with configuring the arcane pf.conf is https://murusfirewall.com it's just a GUI to make things easier. Worth every penny in my opinion. Certainly easier than hard coding the rules in ViM. The PF firewall is built-in to the kernel and you can utilize both firewalls. The PF firewall is off by default. Murus has another app called Valium that can help with the Application Firewall. Another 3rd party firewall is Little Snitch.

As others have mentioned, it's highly unlikely your Mac has been compromised. It sounds more like you are accustomed to Linux and macOS is considerably different. Malware does exist but it's far more rare than other operating systems. You will find things are locked down tight with macOS. The System volume is entirely immutable. It starts with a read only volume locked with System Integrity Protection (SIP) then an APFS snapshot is made which is signed only by Apple and sealed. The OS actually boots from the snapshot. Apple Silicon Macs are using their own form of secure boot and don't suffer from the issues with secure boot on PC's. The SSD is factory encrypted out of the box. When you turn on FileVault you are merely generating some public / private keys, sticking the private key in the Secure Enclave within the SoC and using the public key to generate the recovery code. The disk is already encrypted. The built-in Apps such as Calculator are all coming from a signed installer and are entirely immutable. There is no way for malware or any user including root to alter the contents of Calculator.app/. Malware can infect a user profile but not the System and certainly not install a rootkit, etc. Apple's built-in malware tools autoupdate and can block malware. In the distant past it was first used to block vulnerable versions of Adobe Flash and Java. Prompting the user to go upgrade them before they would be allowed to execute.

Reply

Answer 8

gravityfed Author

Level 1

68 points

Jul 6, 2023 11:24 AM in response to MrHoffman

MrHoffman wrote:

There is no need to have a Developer ID to enable Developer mode.

It is not typical for developer mode to be “forced on” without the developer mode toggle being activated though.

kernel: (AppleMobileFileIntegrity) AMFI: developer mode is force enabled on this platform

Nor should there be TestFlight and Xcode app activity when neither app is even installed on the Mac or iOS device. Beta versions of applications can’t randomly appear without them which suggests they are being loaded some alternative way as it is my understanding the regular AppStore does not carry beta versions. Even ‘SpringBoard’ is a beta version.

MrHoffman wrote:

There are always data communications with servers whenever iPhone is connected to a network, as an iPhone is a so-called client device.

This is true, but macOS should not be sending FaceTime messages when a) it’s not active (ie toggled off in all relevant places) and b) it is in lockdown mode.

imagent: (FaceTime) [com.apple. Messages :FaceTimePushHandler] Accepting Incoming pushes

launchd: [pid/425/com.apple. FaceTime.FTConversationService [503]:] service state: running

com.apple.FaceTime.FTConversationService: [com.apple. FaceTime:FTConversationService] Asked to accept connection <private>

com.apple.FaceTime.FTConversationService: [com.apple. FaceTime:FTConversationService] Entitlement found; accepting connection <private>

callservicesd: (TelephonyUtilities) [com.apple.calls.telephonyutilities:Default] Cloud calling devices changed

callservicesd: (TelephonyUtilities) [com.apple.calls.telephonyutilities:Default] FaceTime availability changed from (audio=0 video=0) to (audio=1 video=1)

identityservicesd: (FTServices) [com.apple.IDS:FaceTime] Created URL Request: ‹private> from URL: <private>

identityservicesd: (FTServices) [com.apple.IDS:FaceTime] Sent outgoing message: <private> to command: (Request 1D: <private> Connection: <private>)

Similarly, rapportd should not be directly connecting from the Mac to other devices (an iPad in this case) on the same network when all relevant settings have been turned off.

rapportd: (CoreUtils) [com.apple.CoreUtils:AsyncCnx] CLinkCnx-1: Connected to [xxxx:xxxx:ed27:1::4]:58219 (Reach=0.00 ms, SRV=0.00 ms, DNS=0.00 ms, Connect=5.58 ms, Total=112.65 ms)

I just had another look at the log snippets I posted:

kernel: initialized XNU provisioning profile data

This indicates that the kernel has processed XNU provisioning profiles specifically related to kernel extensions/kexts, my understanding is they are deprecated for developer content.

No matter what I do I can’t resolve it, whoever it is has gone to a lot of effort. The list gets longer each day as I discover more. I’m disappointed the latest update didn’t help. I honestly don’t know what to do.

Reply

Answer 9

gravityfed Author

Level 1

68 points

May 4, 2023 5:22 AM in response to gravityfed

Following up with more information on this issue as it’s still unresolved, but at least I have an idea of what is going on now (and that something is actually awry).

Some issues identified so far:

Developer mode has been enabled without a valid developer ID (I’m not a developer)
Modification of the boot process that removes users ability to choose which operating system to boot into (I didn’t set up two!)
HMAC invalidation has been disabled
The use of a fake key for AppleSEPStore
SMMachine (system management) interference
arm64e_plugin_host process running various binaries (bash, login, zsh, sudo) in keys off mode due to their identities. Code signature validation is being skipped because they’ve been modified or are not signed with a valid certificate
Potential compromise of iPhones and iPads by Mac Mini and MacbookPro, AppleImage4 sysctl hook, a security measure of iOS devices suggests the Macs have interacted with them and logs on all devices further suggest data communication between the two (meant to be disabled) as well as many security violations
ANECompilerService active in security processes, issue with root certificate or verification.

There is also evidence data is being sent to a server.

The Mac machines are unable to be physically accessed which suggests remote access through any number of security holes which have been active. Security updates haven’t solved anything nor has rebooting, as there have been modifications made.

I have idea where to from here though. Over six thousand dollars worth of Apple products between the devices and Apple don’t want to dive any deeper than a reset which solves nothing.

I’m a very sad insignificant little panda to the world, but in my world this has affected my family and I greatly.

Reply

Answer 10

gravityfed Author

Level 1

68 points

Apr 5, 2023 8:24 AM in response to gravityfed

My scan of the executable file within the Calculator.app was tagged by Total Virus and OSX Sandbox as matching two 2019 CVE exploits. Wasn't sure if external links were allowed so haven't posted a link.

Reply

Answer 11

gravityfed Author

Level 1

68 points

Apr 13, 2023 6:03 AM in response to gravityfed

Attempted another factory reset tonight but it's still there. I can't find any way to remove the disk image it is defaulting back to.

kernel: vm_page_bootstrap: 995728 free pages, 13694 wired pages, (up to 0 of which are delayed free)

kernel: VM boostrap: 97 maps, 204 entries and 512 holes available

kernel: Maximum number of VM swap files: 100

kernel: "vm_compressor_mode" is 4

kernel: VM bootstrap done: 84 maps, 165 entries and 503 holes left

kernel: IOKit IOMD setownership ENABLED

I contacted the "Apple" chat help (on the malware machine so what did I expect I guess), they didn't know what a bootstrap was. So they got my number and a "senior technician rang" who also didn't know what it was for either.

How do I get rid of this?

Reply

Answer 12

Mac Jim ID

Level 6

10,047 points

Apr 13, 2023 6:03 PM in response to gravityfed

I can tell you that the "corecrypto" process you have highlighted is part of Ventura and is an Apple process that is totally fine. I suggest downloading EtreCheck and post the report here using the "Additional Text" option when posting. This is a safe program that is used frequently here on these forums to diagnose software issues. If you are concerned about Malware, then Malwarebytes is another program suggested here to search for malware.

There is no other Anti-virus or Cleaner program that is needed or should be installed.

Reply

Answer 13

Apr 13, 2023 6:29 PM in response to gravityfed

gravityfed wrote:

My scan of the executable file within the Calculator.app was tagged by Total Virus and OSX Sandbox as matching two 2019 CVE exploits. Wasn't sure if external links were allowed so haven't posted a link.

Presumably, you are uploading random files to some website to scan then, as a website cannot scan a Mac.

Which CVEs, please?

Reply

Answer 14

gravityfed Author

Level 1

68 points

Apr 13, 2023 7:36 PM in response to PRP_53

I have only used Time Machine a few times just after I bought it and then didn't need it so I turned it off, that was 11 months ago and I didn't save the backups.

I ran Malwarebytes about 4 reinstalls ago because I was getting desperate and it seemed generally accepted here if you *had* to do something that was the better option but it showed nothing. I also tried Etrecheck which showed my apps I downloaded from the AppStore, were not, and there was nearly 500 Apple apps on the system, 4 were not even able to run on the M1.

When I erase the hard drive (it won't left me touch the system snapshot/image which is mounted). So I have no idea how I can get rid of this.

Even when I run commands as root to delete folders that I know for sure have nothing to do with the latest Apple - I am unable to delete them.

Of the many issues the ones of most concern are that it looks as though its under the control of someone else, and firewall/steath is being disabled and control centre being added. I change it and it just goes back once the window is closed. Even if the options show one thing, System Report says different.

I am running in lockdown mode. No idea if it makes a difference or not.

As a side note, I would think these things below would not be relevant to a non business user using a standard install of Ventura on a MacBook Pro 2021 and Mac mini 2020 purchased directly from Apple is:

SMBRID opendirectoryd: [com.apple.opendirectoryd:session] dsAttrTypeStandard:SMBRID

AltSecurityIdentities opendirectoryd: [com.apple.opendirectoryd:session] dsAttrTypeStandard:AltSecurityIdentities

Smart Card ctkahp: [com.apple.CryptoTokenKit:AHP] Invoking SmartCard agent for uid 501

Open Directory sudo: (CFOpenDirectory) Open a given node & opendirectoryd: (PlistFile) [com.apple.opendirectoryd:session] found via filename '<private>'

Multipeer kernel: (IO80211Family) com.apple.p2p

kernel (InvalidateHmac) Finished SIO HMAC invalidation.

Credential Manager

AppleCredentialManagerDaemon: ACMTRM-D: -[TransportRestrictedModeService entryPoint_onDaemonStarted]: acmd started, handing control over to kext (TRM allowed by ManagedConfiguration: YES, disabled by AppleSetup: NO).

kernel: (AppleCredentialManager) ACMTRM: init: called, starting TRM service.; kernel: (AppleCredentialManager)

AppleCredentialManager: startImpl: will join SEPManager's PM tree in getSEPEndpoint().

Managed Client launchd: [system:] Service "com.apple.ManagedClient.startup" tried to register for endpoint "com.apple.ManagedClient.agent" already registered by owner: com.apple.ManagedClient

WindowServer

WindowServer: (SkyLight) [com.apple.SkyLight:default] Server is starting up

WindowServer: (SkyLight) [com.apple.SkyLight:default] Session 257; WS port 14603, launchd-launched workspace/session manager

Early Boot

kernel: (Sandbox) Sandbox apply: auearlyboot[11] <bytes>

kernel: (Sandbox) Sandbox: auearlyboot(11) allow iokit-get-properties iokit-class:IOService property:aud-early-boot-critical

kernel: (AppleInputDeviceSupport) Unserializing payload with 2314220 bytes

Reply

Answer 15

Apr 13, 2023 7:52 PM in response to gravityfed

macOS protects itself against corruptions. Much of the system is write-protected, as are backups. That is all part of the built-in anti-malware. The built-in anti-malware which has blocked add-on anti-malware from corrupting macOS with a (hilariously wrong) false positive, too.

Absolutely nothing you have posted here so far is evidence of any issues. Which CVE, BTW?

Backups are a central part of system security. Quite possible rotating and maybe permanently-archived backups, if the data is sufficiently valuable.

Reply

Factory reset macmini M1 2020 is not like the others

Similar questions