dawnfromnewyork
Level 1 (45 points)

Q: scrambled password prompt - is this safe?

I'm trying to change some of my security settings through System Preferences, which of course require me to enter my password. However the password prompt I get is scrambled, with blocks instead of letters. What is this, how do I fix it, and is it safe to enter my password? Image attached.Screen Shot 2013-11-18 at 12.07.23 AM.png

MacBook Pro, Mac OS X (10.6.8)

Posted on Nov 17, 2013 9:26 PM

by Drew Reece,Solvedanswer
Drew Reece Drew Reece
Level 5 (7,490 points)
Notebooks
A:

This doesn't sound like a very good attack if you have been 'compromised'.

It actually looks more like your font caches are corrupt or a font is damaged somehow.

 

Open fontbook & look for an option to verify or repair fonts (sorry I'm away from a computer).

 

I would also boot into safe mode & see if it still occurs.

http://support.apple.com/kb/ht1455

 

Sites get hacked all the time, how exactly could they using your website password to access the Mac? Have you used the same passwords for the Apple ID? Or for the Mac user account. It's possible it could be a hack, however don't rule out a simple glitch. I'd also suggest if you have been hacked & the computer is 'owned' now would be avoid time to disconnect the backup disk.

Posted on Nov 17, 2013 11:23 PM

Close
dawnfromnewyork

Q: scrambled password prompt - is this safe?

  • All replies
  • Helpful answers

  • by sberman,

    sberman sberman Nov 17, 2013 9:56 PM in response to dawnfromnewyork
    Level 8 (39,142 points)
    Nov 17, 2013 9:56 PM in response to dawnfromnewyork

    I don't know this for sure, but I'm guessing you use iCloud Keychain, described here:

    http://support.apple.com/kb/HT5813

     

    (I don't personally use this new feature.)

     

    Check System Preferences > iCloud and see if you have keychain checked.  If so, that might explain what you're seeing.

  • by dawnfromnewyork,

    dawnfromnewyork dawnfromnewyork Nov 17, 2013 10:12 PM in response to sberman
    Level 1 (45 points)
    Nov 17, 2013 10:12 PM in response to sberman

    I went to iCloud under System Prefs, it showed a prompt for my username/password, so I entered it, and then took me to setup... so I think I just signed up for it, but that I did not have it before. Keychain is not checked.

  • by sberman,

    sberman sberman Nov 17, 2013 10:21 PM in response to dawnfromnewyork
    Level 8 (39,142 points)
    Nov 17, 2013 10:21 PM in response to dawnfromnewyork

    OK, then I would be concerned.

     

    Try restarting your Mac, and go into System Preferences > Security again and see if you get the same scrambled prompt.

     

    By the way, can you go to other areas of System Preferences (for example, Users & Groups) and see English instead of scramble?

  • by dawnfromnewyork,

    dawnfromnewyork dawnfromnewyork Nov 17, 2013 10:45 PM in response to sberman
    Level 1 (45 points)
    Nov 17, 2013 10:45 PM in response to sberman

    I did try a restart, problem was not solved. Going into other areas of System Prefs and clicking that lock gets me the same scrambled prompt. So does uninstalling/installing software.

     

    I don't know if it's related, but I should mention that about a week ago, and a few days apart, 2 online sites I have accounts with (a retailer and another site) emailed me about my username and password being posted on some list of hacked passwords somewhere, and that although they don't believe my accounts were compromised, I should change my password just in case. I admit that I only got around to changing those passwords tonight. Both sites used the same password. Neither sites had saved credit card information in them, though one did have my phone number. The password for those 2 (supposedly) compromised sites is NOT the same one as for computer, or AppleID, or email address which could be used to recover my Apple passwords, so I have no idea how that could relate to my computer being compromised.

     

    Yeah, so...  what can I do about this scabbled password prompt, and how do I know if my computer has been compromised?

    Thanks.

  • by sberman,Helpful

    sberman sberman Nov 17, 2013 10:50 PM in response to dawnfromnewyork
    Level 8 (39,142 points)
    Nov 17, 2013 10:50 PM in response to dawnfromnewyork

    Well, the symptoms sound extremely suspicious to me.

     

    You can install a clean copy of Mavericks by restarting your computer and holding Command + "r" while restarting.  Make sure all your passwords are changed first.  And, of course, make sure you have a good backup before doing anything.

     

    I don't know if these steps are sufficient, but I'm pretty sure they're necesary to proceed in a reasonably safe manner.

  • by dawnfromnewyork,

    dawnfromnewyork dawnfromnewyork Nov 17, 2013 11:03 PM in response to sberman
    Level 1 (45 points)
    Nov 17, 2013 11:03 PM in response to sberman

    Thank you, I will have to try that.

     

    How can I test my backup before I proceed? I have an external drive with a time machine backup (as of tonight), I have not tested it and I don't know how I could except to restore from it... but I would really hate to find out something is wrong with my backup once my data's already been erased. I've gone in to pull a file from Time Machine recently and that worked but that's the extent of my test.

     

    Also, I changed my system (primary user's) password, thats about it. I'll change it again once I do a fresh install. Is there point in changing all of my online passwords now from a computer that might be compromised?

  • by Drew Reece,Solvedanswer

    Drew Reece Drew Reece Nov 17, 2013 11:23 PM in response to dawnfromnewyork
    Level 5 (7,490 points)
    Notebooks
    Nov 17, 2013 11:23 PM in response to dawnfromnewyork

    This doesn't sound like a very good attack if you have been 'compromised'.

    It actually looks more like your font caches are corrupt or a font is damaged somehow.

     

    Open fontbook & look for an option to verify or repair fonts (sorry I'm away from a computer).

     

    I would also boot into safe mode & see if it still occurs.

    http://support.apple.com/kb/ht1455

     

    Sites get hacked all the time, how exactly could they using your website password to access the Mac? Have you used the same passwords for the Apple ID? Or for the Mac user account. It's possible it could be a hack, however don't rule out a simple glitch. I'd also suggest if you have been hacked & the computer is 'owned' now would be avoid time to disconnect the backup disk.

  • by dawnfromnewyork,

    dawnfromnewyork dawnfromnewyork Nov 18, 2013 1:50 AM in response to Drew Reece
    Level 1 (45 points)
    Nov 18, 2013 1:50 AM in response to Drew Reece

    Looks like it was an issue with my Lucida font, which I've resolved.  My password prompts look normal now.

     

    Also did a ClamXav virus scan just in case and it came out clean. Thanks for your help!

  • by Drew Reece,

    Drew Reece Drew Reece Nov 18, 2013 1:34 PM in response to dawnfromnewyork
    Level 5 (7,490 points)
    Notebooks
    Nov 18, 2013 1:34 PM in response to dawnfromnewyork

    That's great news.

     

    It is a good idea to change passwords & be on the lookout for sites that want you to do password resets, just use different strong passwords for each one. 1Password (https://agilebits.com) or the Mac keychain is good for managing them, just be aware that is a 'single point' for all the passwords for an attacker, so have a good password on that, the keychain will use the same one as the login password, which may be insecure? I haven't used it with iCloud.

     

    Obviously be aware how your accounts are 'tied together'.

    e.g. If an email account has old reciepts from say Amazon.com the 'password reset' feature may allow an attacker to gain access to your Amazon account if they are in the email account.

     

    There have been cases where many devices are attacked at once after gaining access to an email account etc. Multiple backups are the only real protection.

     

    Have you seen the film 'Marathon Man'? Your title reminded me of it (is it safe).

     

  • by dawnfromnewyork,

    dawnfromnewyork dawnfromnewyork Nov 19, 2013 4:32 PM in response to Drew Reece
    Level 1 (45 points)
    Nov 19, 2013 4:32 PM in response to Drew Reece

    Thanks for the help Drew! I haven't seen the film but that reference will come to me one day.