Equus

Q: Airport Utility Launched and Tried to Connect to Airport While Wireless Was Turned Off

Something very strange this morning when I got to work and unlocked my screensaver. Airport Utility was open and showed an Airport called "Anthony's Airport Express", with a green light and a request to enter a password for it. I have no idea who "Anthony" is (I'm guessing someone else on the work network), but the really odd thing is, I have wi-fi turned OFF on my Mac (I'm connected via ethernet). Is AU still scanning and tries to connect to an Airport if one appears on the network, even though wi-fi is off? That seems like a security issue.

 

I don't think this was coming over wi-fi, because when I turned wi-fi on and scanned for wireless connections it wasn't there. A few hours later, AU changed to showing "Anthony's Airport Express" was "out of range" and "remembered" (see screenshot). But previously it had showed a solid line from "Internet" to the Airport, with a green light on both. I'm concerned if my Mac is connecting to an Airport without my permission (although it was requesting a password so perhaps it didn't connect to it).

 

Any ideas what this is about?

 

--Equus

 

Screen Shot 2013-09-11 at 2.29.56 PM.png

Mac mini, OS X Mountain Lion (10.8.4), Quad Core 2.3 Ghz Intel Core i7

Posted on Sep 11, 2013 4:31 AM

Close

Q: Airport Utility Launched and Tried to Connect to Airport While Wireless Was Turned Off

  • All replies
  • Helpful answers

  • by markwmsn,

    markwmsn markwmsn Sep 11, 2013 7:22 AM in response to Equus
    Level 5 (5,669 points)
    Photos for Mac
    Sep 11, 2013 7:22 AM in response to Equus

    Connecting AirPort Utility to an AirPort device over Ethernet can be useful. For example, my Mac Pro doesn't have Wi-Fi hardware, so I couldn't manage my AirPort devices from that system without this ability. (I have other means, but sometimes the tower is handier or I just need another view.)

     

    Any security issue, either through Ethernet or via Wi-Fi, should be handled by passwords in the AirPort device. It's no threat to your Mac.

  • by Equus,

    Equus Equus Sep 11, 2013 9:09 AM in response to markwmsn
    Level 1 (100 points)
    Sep 11, 2013 9:09 AM in response to markwmsn

    Thanks, but why would my Mac automatically open AU and try to connect to it? I assume that's what it did since it was asking for a password. I don't want my Mac trying to connect some random Airport Express that someone hooks into the network.

  • by markwmsn,

    markwmsn markwmsn Sep 11, 2013 10:43 AM in response to Equus
    Level 5 (5,669 points)
    Photos for Mac
    Sep 11, 2013 10:43 AM in response to Equus

    AirPort Utility can be auto-launched if an AirPort base station on the same network has a problem.

     

    You can control it with AirPort Utility > Preferences > "Monitor AirPort base stations for problems" with the suboption "Only monitor AirPort base stations I have configured"; looks like the default may be monitoring all base stations (major option checked, minor unchecked). As the preferences dialog explains, it only auto-launches this "when a supported AirPort base station's status light blinks amber."

     

    Probably, somebody brought in an AirPort base station from home, reset it to configure it, configured it, and took it home. Your AirPort Utility noticed it while it was in the unconfigured state and auto-launched to configure it.

  • by Equus,

    Equus Equus Sep 11, 2013 2:07 PM in response to markwmsn
    Level 1 (100 points)
    Sep 11, 2013 2:07 PM in response to markwmsn

    Thanks. I checked the AU preferences and the only thing checked was "Check for updates". "Monitoring AirPort base stations" was not checked.

     

    I've never used AU, so this is very strange.

  • by markwmsn,

    markwmsn markwmsn Sep 11, 2013 2:10 PM in response to Equus
    Level 5 (5,669 points)
    Photos for Mac
    Sep 11, 2013 2:10 PM in response to Equus

    Equus wrote:

     

    I've never used AU, so this is very strange.

    Indeed.

  • by Equus,

    Equus Equus Sep 11, 2013 2:29 PM in response to markwmsn
    Level 1 (100 points)
    Sep 11, 2013 2:29 PM in response to markwmsn

    That's why I'm wondering if something malicious isn't going on.

  • by markwmsn,

    markwmsn markwmsn Sep 11, 2013 2:33 PM in response to Equus
    Level 5 (5,669 points)
    Photos for Mac
    Sep 11, 2013 2:33 PM in response to Equus

    I've already told you the only way I know for AirPort Utility to launch automatically if you have never used it. That leaves the possiility that somebody obtained logon access to your Mac. Hard to see why somebody malicious would get out of launching AirPort Utility.

  • by Equus,

    Equus Equus Sep 11, 2013 3:42 PM in response to markwmsn
    Level 1 (100 points)
    Sep 11, 2013 3:42 PM in response to markwmsn

    Logon access directly, or over the network?

     

    Direct access would be difficult, as it's in a locked area.

     

    I'm not sure why launching AU would do anything, but maybe it happened while someone was rooting around. Making me a little paranoid now. There have been some unusual crashes lately. The other day while I was browsing in Chrome, Firefox seemed to launch itself. Also a few days ago first thing in the morning when I went to unlock the screensaver I found myself facing the login screen...the Mac had "shut down improperly" yet had rebooted itself...I don't have it set to reboot after a power failure so I have no idea what would shut it down improperly yet start it back up again.

     

    The Finder also crashed on me tonight and wouldn't restart, so I had to do a hard reboot. Yet there's only one panic reports in /Library/Logs/PanicReporter and that's from back in July. There's nothing in /Library/Logs/CrashReporter.

     

    This is very weird.

  • by Equus,

    Equus Equus Sep 11, 2013 3:57 PM in response to Equus
    Level 1 (100 points)
    Sep 11, 2013 3:57 PM in response to Equus

    I did find this in wifi.log.0.bz2:

     

    Sep 11 00:30:06 My-Computer newsyslog[85831]: logfile turned over

    Thu Sep 12 00:16:35.345 ***Starting Up***

    Thu Sep 12 00:16:42.94  <airportd[76]> _processDLILEvent: en1 attached (down)

    Sep 12 00:30:11 My-Computer newsyslog[519]: logfile turned over

     

    That's the only one that has anything other than "logfile turned over" in it. I'm guessing that was the launch of AU this morning. But I have no idea what it could mean.

  • by markwmsn,

    markwmsn markwmsn Sep 12, 2013 12:57 PM in response to Equus
    Level 5 (5,669 points)
    Photos for Mac
    Sep 12, 2013 12:57 PM in response to Equus

    Looks more like an ethernet cable was plugged in or unplugged. My wifi.log files have many entries (since I do use wifi on this MacBook Pro) but not that one (since it rarely has ethernet attached).