drazek73
Level 1 (0 points)

Q: detect key logger, screen capture, spyware on mac @linc davis

Linc or any other forensics master - can you guys take a look if there is anything strange on this mac?  I run the terminal commands you recommended.  Please.  Appreciated.

 

drazeks-MacBook-Pro-2:~ drazek$ kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

drazeks-MacBook-Pro-2:~ drazek$ sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfi x|x)/{print $3}'

 

WARNING: Improper use of the sudo command could lead to data loss

or the deletion of important system files. Please double-check your

typing when using sudo. Type "man sudo" for more information.

 

To proceed, enter your password, or type Ctrl-C to abort.

 

Password:

com.adobe.versioncueCS4

com.microsoft.office.licensing.helper

com.google.keystone.daemon

com.oracle.java.Helper-Tool

com.adobe.fpsaud

drazeks-MacBook-Pro-2:~ drazek$ launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

com.google.Chrome.92332

com.adobe.CS4ServiceManager

org.mozilla.firefox.49164

jp.co.canon.cijscannerregister.86368

com.microsoft.Word.56832

com.google.keystone.system.agent

com.jdibackup.ZipCloud.autostart

com.oracle.java.Java-Updater

com.getdropbox.dropbox.80120

com.rpatechnology.mobilemouse.61944

com.jdibackup.ZipCloud.notify

com.adobe.dreamweaver-10.0.40360

com.divx.update.agent

com.microsoft.autoupdate.fba.86652

com.divx.dms.agent

drazeks-MacBook-Pro-2:~ drazek$ ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta} * L*/Fonts 2> /dev/null

/Library/Components:

 

/Library/Extensions:

ACS6x.kext

ATTOCelerityFC8.kext

ATTOExpressSASHBA2.kext

ATTOExpressSASRAID2.kext

ArcMSR.kext

CalDigitHDProDrv.kext

EPSONUSBPrintClass.kext

HighPointIOP.kext

HighPointRR.kext

PromiseSTEX.kext

SoftRAID.kext

 

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

DivX Toolkit.framework

DivXInstallerUtilities.framework

EWSMac.framework

NyxAudioAnalysis.framework

PluginManager.framework

TSLicense.framework

iLifeFaceRecognition.framework

iLifeKit.framework

iLifePageLayout.framework

iLifeSQLAccess.framework

iLifeSlideshow.framework

iTunesLibrary.framework

 

/Library/Input Methods:

 

/Library/Internet Plug-Ins:

Default Browser.plugin

DivX Web Player.plugin

Flash Player.plugin

Flip4Mac WMV Plugin.plugin

Flip4Mac WMV Plugin.webplugin

JavaAppletPlugin.plugin

LogitechHarmony.plugin

OVSHelper.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

SharePointBrowserPlugin.plugin

SharePointWebKitPlugin.webplugin

Silverlight.plugin

SnagitSafariScroller.webplugin

flashplayer.xpt

googletalkbrowserplugin.plugin

iPhotoPhotocast.plugin

nsIQTScriptablePlugin.xpt

o1dbrowserplugin.plugin

 

/Library/Keyboard Layouts:

 

/Library/LaunchAgents:

com.adobe.CS4ServiceManager.plist

com.divx.dms.agent.plist

com.divx.update.agent.plist

com.google.keystone.agent.plist

com.oracle.java.Java-Updater.plist

 

/Library/LaunchDaemons:

com.adobe.fpsaud.plist

com.adobe.versioncueCS4.plist

com.google.keystone.daemon.plist

com.microsoft.office.licensing.helper.plist

com.oracle.java.Helper-Tool.plist

 

/Library/PreferencePanes:

Flash Player.prefPane

Flip4Mac WMV.prefPane

JavaControlPanel.prefPane

VersionCueCS4.prefPane

 

/Library/PrivilegedHelperTools:

com.microsoft.office.licensing.helper

 

/Library/QuickLook:

GBQLGenerator.qlgenerator

iBooksAuthor.qlgenerator

iWork.qlgenerator

 

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

 

/Library/ScriptingAdditions:

Adobe Unit Types.osax

 

/Library/Spotlight:

GBSpotlightImporter.mdimporter

LogicPro.mdimporter

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter

 

/Library/StartupItems:

 

/etc/mach_init.d:

 

/etc/mach_init_per_login_session.d:

 

/etc/mach_init_per_user.d:

 

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

 

Library/Fonts:

eurof35.ttf

eurof36.ttf

eurof55.ttf

eurof56.ttf

eurof75.ttf

eurof76.ttf

 

Library/Frameworks:

EWSMac.framework

 

Library/Input Methods:

.localized

 

Library/Internet Plug-Ins:

CitrixOnlineWebDeploymentPlugin.plugin

ZoomUsPlugIn.plugin

 

Library/Keyboard Layouts:

 

Library/LanguageModeling:

da-dynamic.lm

de-dynamic.lm

en-dynamic.lm

es-dynamic.lm

fr-dynamic.lm

it-dynamic.lm

nb-dynamic.lm

nl-dynamic.lm

pt-dynamic.lm

sv-dynamic.lm

tr-dynamic.lm

 

Library/LaunchAgents:

com.apple.CSConfigDotMacCert-drazek@me.com-SharedServices.Agent.plist

com.apple.FolderActions.enabled.plist

com.apple.FolderActions.folders.plist

com.jdibackup.ZipCloud.autostart.plist

com.jdibackup.ZipCloud.notify.plist

 

Library/PreferencePanes:

 

Library/Services:

.localized

drazeks-MacBook-Pro-2:~ drazek$ osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

iTunesHelper, Mobile Mouse Server, BitTorrent, Dropbox, Google Chrome

drazeks-MacBook-Pro-2:~ drazek$

MacBook Pro, iOS 8.4.1

Posted on Sep 12, 2015 8:17 AM

Close
drazek73

Q: detect key logger, screen capture, spyware on mac @linc davis

  • All replies
  • Helpful answers

Page 1 Next

  • by KiltedTim,

    KiltedTim KiltedTim Sep 15, 2015 9:54 AM in response to drazek73
    Level 9 (55,946 points)
    Mac OS X
    Sep 15, 2015 9:54 AM in response to drazek73

    Why don't you try actually explaining what your problem is...

  • by drazek73,

    drazek73 drazek73 Sep 16, 2015 9:19 AM in response to KiltedTim
    Level 1 (0 points)
    Sep 16, 2015 9:19 AM in response to KiltedTim

    competitor/business partners knows what only I should know .. not sure if this is the explanation you're looking for

     

    I can send all the littlesnitch processes that it picks up .. will that be sufficient to diagnose/eliminate any possibility of spyware?

  • by KiltedTim,

    KiltedTim KiltedTim Sep 16, 2015 9:46 AM in response to drazek73
    Level 9 (55,946 points)
    Mac OS X
    Sep 16, 2015 9:46 AM in response to drazek73

    Not really. Why do you believe your system has been compromised? I see no evidence of that.

  • by drazek73,

    drazek73 drazek73 Sep 16, 2015 10:21 AM in response to KiltedTim
    Level 1 (0 points)
    Sep 16, 2015 10:21 AM in response to KiltedTim

    what do you need to see as evidence .. I'm looking to find it

     

    all I can answer you involved confidential data that leaked from my personal computer

  • by KiltedTim,

    KiltedTim KiltedTim Sep 16, 2015 10:29 AM in response to drazek73
    Level 9 (55,946 points)
    Mac OS X
    Sep 16, 2015 10:29 AM in response to drazek73

    This is a technical support forum. We are not psychic. Maybe your email account was compromised. We don't know.

     

    Try running Etrecheck and posting the results. It gives a good starting point, including lists of processes running and killed.

     

    For someone to install a key logger, they would have to have physical access to the machine. It looks like you may have a bit-torrent client running. Not smart. Virtually never used for 'legal' purposes.

  • by drazek73,

    drazek73 drazek73 Sep 17, 2015 9:44 AM in response to KiltedTim
    Level 1 (0 points)
    Sep 17, 2015 9:44 AM in response to KiltedTim

    etrecheck results below .. how do I find what installed bit-torrent?  it's nowhere in the applications

     

     

    EtreCheck version: 2.4.2 (142)

    Report generated 9/17/15, 12:38 PM

    Download EtreCheck from http://etresoft.com/etrecheck

     

    Click the [Click for support] links for help with non-Apple products.

    Click the [Click for details] links for more information about that line.

     

    Hardware Information: (What does this mean?)

        MacBook Pro (13-inch, Mid 2010) (Technical Specifications)

        MacBook Pro - model: MacBookPro7,1

        1 2.4 GHz Intel Core 2 Duo CPU: 2-core

        10 GB RAM Upgradeable

            BANK 0/DIMM0

                8 GB DDR3 1067 MHz ok

            BANK 1/DIMM0

                2 GB DDR3 1067 MHz ok

        Bluetooth: Old - Handoff/Airdrop2 not supported

        Wireless:  en1: 802.11 a/b/g/n

        Battery: Health = Normal - Cycle count = 348 - SN = W00474LH4D3BA

     

    Video Information: (What does this mean?)

        NVIDIA GeForce 320M - VRAM: 256 MB

            Color LCD 1280 x 800

     

    System Software: (What does this mean?)

        OS X 10.10.3 (14D136) - Time since boot: about 3 hours

     

    Disk Information: (What does this mean?)

        Hitachi HTS545025B9SA02 disk0 : (250.06 GB) (Rotational)

            EFI (disk0s1) <not mounted> : 210 MB

            Macintosh HD (disk0s2) / : 249.20 GB (49.22 GB free)

            Recovery HD (disk0s3) <not mounted>  [Recovery]: 650 MB

     

        MATSHITADVD-R   UJ-898   ()

     

    USB Information: (What does this mean?)

        Apple Inc. Built-in iSight

        Apple Internal Memory Card Reader

        Apple Inc. BRCM2046 Hub

            Apple Inc. Bluetooth USB Host Controller

        Apple Computer, Inc. IR Receiver

        Apple Inc. Apple Internal Keyboard / Trackpad

     

    Gatekeeper: (What does this mean?)

        Mac App Store and identified developers

     

    Kernel Extensions: (What does this mean?)

            /Library/Extensions

        [loaded]    at.obdev.nke.LittleSnitch (4246 - SDK 10.8) [Click for support]

     

    Launch Agents: (What does this mean?)

        [running]    at.obdev.LittleSnitchUIAgent.plist [Click for support]

        [loaded]    com.adobe.CS4ServiceManager.plist [Click for support]

        [running]    com.divx.dms.agent.plist [Click for support]

        [loaded]    com.divx.update.agent.plist [Click for support]

        [loaded]    com.google.keystone.agent.plist [Click for support]

        [loaded]    com.oracle.java.Java-Updater.plist [Click for support]

     

    Launch Daemons: (What does this mean?)

        [running]    at.obdev.littlesnitchd.plist [Click for support]

        [loaded]    com.adobe.fpsaud.plist [Click for support]

        [loaded]    com.adobe.versioncueCS4.plist [Click for support]

        [loaded]    com.google.keystone.daemon.plist [Click for support]

        [loaded]    com.microsoft.office.licensing.helper.plist [Click for support]

        [loaded]    com.oracle.java.Helper-Tool.plist [Click for support]

     

    User Launch Agents: (What does this mean?)

        [failed]    com.apple.CSConfigDotMacCert-[...]@me.com-SharedServices.Agent.plist [Click for details]

        [failed]    com.jdibackup.ZipCloud.autostart.plist [Click for support] [Click for details]

        [failed]    com.jdibackup.ZipCloud.notify.plist [Click for support] [Click for details]

     

    User Login Items: (What does this mean?)

        iTunesHelper    UNKNOWN Hidden (missing value)

        Mobile Mouse Server    Application  (/Applications/Mobile Mouse Server.app)

        BitTorrent    UNKNOWN  (missing value)

        Dropbox    Application  (/Applications/Dropbox.app)

        Google Chrome    Application Hidden (/Applications/Google Chrome.app)

     

    Internet Plug-ins: (What does this mean?)

        LogitechHarmony: Version: 1.0.0.1 [Click for support]

        o1dbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

        OVSHelper: Version: 1.1 [Click for support]

        Default Browser: Version: 600 - SDK 10.10

        Flip4Mac WMV Plugin: Version: 2.3.8.1 [Click for support]

        Silverlight: Version: 5.1.20125.0 - SDK 10.6 [Click for support]

        FlashPlayer-10.6: Version: 18.0.0.232 - SDK 10.6 [Click for support]

        DivX Web Player: Version: 3.3.1.17 - SDK 10.10 [Click for support]

        Flash Player: Version: 18.0.0.232 - SDK 10.6 [Click for support]

        QuickTime Plugin: Version: 7.7.3

        googletalkbrowserplugin: Version: 5.41.0.0 - SDK 10.8 [Click for support]

        iPhotoPhotocast: Version: 7.0 - SDK 10.7

        SharePointBrowserPlugin: Version: 14.4.9 - SDK 10.6 [Click for support]

        JavaAppletPlugin: Version: Java 8 Update 60 build 27 Check version

     

    User internet Plug-ins: (What does this mean?)

        CitrixOnlineWebDeploymentPlugin: Version: 1.0.105 [Click for support]

        ZoomUsPlugIn: Version: 3.5.21488.0723 - SDK 10.10 [Click for support]

     

    3rd Party Preference Panes: (What does this mean?)

        Adobe Version Cue CS4  [Click for support]

        Flash Player  [Click for support]

        Flip4Mac WMV  [Click for support]

        Java  [Click for support]

     

    Time Machine: (What does this mean?)

        Auto backup: YES

        Volumes being backed up:

            Macintosh HD: Disk size: 249.20 GB Disk used: 199.98 GB

        Destinations:

            TOSHIBA EXT [Local]

            Total size: 999.86 GB

            Total number of backups: 5

            Oldest backup: 2014-09-19 04:06:05 +0000

            Last backup: 2014-11-25 20:08:53 +0000

            Size of backup disk: Excellent

                Backup size 999.86 GB > (Disk size 249.20 GB X 3)

     

    Top Processes by CPU: (What does this mean?)

            16%    WindowServer

            16%    firefox

             4%    DivXMediaServer

             2%    Little Snitch Network Monitor

             2%    Google Chrome Helper(17)

     

    Top Processes by Memory: (What does this mean?)

        2.12 GB    Google Chrome Helper(16)

        1.43 GB    firefox

        1.24 GB    com.apple.WebKit.WebContent(12)

        936 MB    kernel_task

        236 MB    Safari

     

    Virtual Memory Information: (What does this mean?)

        388 MB    Free RAM

        9.62 GB    Used RAM (1.62 GB Cached)

        0 B    Swap Used

     

    Diagnostics Information: (What does this mean?)

        Sep 17, 2015, 08:52:32 AM    Self test - passed

        Sep 16, 2015, 10:58:54 PM    ~/Library/Logs/DiagnosticReports/filezilla_2015-09-16-225854_[redacted].crash

  • by KiltedTim,

    KiltedTim KiltedTim Sep 17, 2015 10:11 AM in response to drazek73
    Level 9 (55,946 points)
    Mac OS X
    Sep 17, 2015 10:11 AM in response to drazek73

    I'm guessing it is either a part of or packaged with Zipcloud. You may want to get rid of that.

  • by drazek73,

    drazek73 drazek73 Sep 17, 2015 10:29 AM in response to KiltedTim
    Level 1 (0 points)
    Sep 17, 2015 10:29 AM in response to KiltedTim

    i'm not even seeing zipcloud in applications, is that to be expected?

  • by Drew Reece,Helpful

    Drew Reece Drew Reece Sep 17, 2015 2:50 PM in response to drazek73
    Level 5 (7,679 points)
    Notebooks
    Sep 17, 2015 2:50 PM in response to drazek73

    BitTorrent is a broken login item.

    System Preferences > Users & groups, select your account & edit the login items. Remove all UNKNOWN ones, they may be left over from old installs that have been removed, as such they are harmless - the item they want to launch can't be found.

     

    Also remove the 3 failing times from /Users/YOURUSERNAME/Library/LaunchAgents/ delete the 3 files that are listed in the 'User Launch Agents' above.

    Again these are probably harmless, just old junk (.Mac closed down years ago).

     

    You seem convinced that the Mac is the only way this data could have been lost. If you are 100% sure that is the case just stop using it. Purchase a replacement HD & reinstall OS X via a known good network (or better get a new Mac, pass this onto the professionals). Avoid migrating any data from the 'compromised' disk(s).

     

    Consider that routers can be compromised, Wifi Can be cracked if using older encryption, other network devices can be exploited too… When you start to think about all the possibilities your head can spin - which is why you need professional help to resolve this correctly. Contact a security firm or law enforcement if you have apparent evidence of a crime.

     

    Personally I suspect there may be other simpler explanations, such as employees who said the wrong thing or you may be assuming the competitors know more than they actually do. Bluffing & choosing words carefully can gather more info than you may like to consider. Also consider how many industries can be a 'community', could your customers or suppliers have passed the info on, either accidentally or deliberately? All online web services are potentially vulnerable too, do you use online backup? How good is the Dropbox password? Do you use 2 factor/ 2 step authentication on any important sites?

     

    Your reports don't show anything alarming to me, you haven't provided the evidence from Little Snitch. It is possible that could just be normal parts of the OS doing it's thing.

     

    I'm not trying to convince you are wrong, just hoping that you have thought through all the possibilities & other sources for information to leak. Using a 'compromised' machine is not really a good idea - if 'attackers' really can see what you are doing maybe they have seen this & hidden themselves deeper or cleaned out any evidence.

     

    Your Mac looks like many others that have been used for a number of years, junk accumulates when you migrate from one OS to another.

  • by Donald Morgan,

    Donald Morgan Donald Morgan Sep 17, 2015 11:42 AM in response to drazek73
    Level 6 (12,783 points)
    Sep 17, 2015 11:42 AM in response to drazek73

    Any torrent, Little Snitch and Zip Cloud. Get rid of all of them. My guess is if you have a Key Logger it was from using a Torrent to get Illegal Software, and has always shown to cause big problems with computers.

    Cheers and Good Luck

    Don Morgan

  • by drazek73,

    drazek73 drazek73 Sep 17, 2015 2:54 PM in response to Drew Reece
    Level 1 (0 points)
    Sep 17, 2015 2:54 PM in response to Drew Reece

    this is good stuff .. you put some sanity back into me at least

     

    i'll try to do all you recommended

     

    here is the littlesnitch info btw .. 'network monitor' and 'all rules' down below it

     

    apsd

    /System/Library/PrivateFrameworks/ApplePushService.framework/apsd

    Total: 75.8 kB sent, 111 kB received

        Summary of 5 connections

     

    Skype

    /Applications/Skype.app

    Total: 126 MB sent, 227 MB received

        Summary of 1091 connections

     

    discoveryd

    /usr/libexec/discoveryd

    Total: 190 kB sent, 556 kB received

        Outgoing to 8.8.8.8, Port dns (53), Protocol UDP (17), 190 kB sent, 556 kB received

     

    Safari

    /Applications/Safari.app

    Total: 195 kB sent, 1.94 MB received

        Summary of 10 connections

     

    Firefox

    /Applications/Firefox.app

    Total: 64.4 MB sent, 267 MB received

        Summary of 473 connections

     

    Google Chrome

    /Applications/Google Chrome.app

    Total: 10.3 MB sent, 30.1 MB received

        Summary of 107 connections

     

    Safari via Safari Networking

    /Applications/Safari.app

    /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/ com.apple.WebKit.Networking.xpc

    Total: 3.38 MB sent, 36.7 MB received

        Summary of 136 connections

     

    Dropbox

    /Applications/Dropbox.app

    Total: 420 kB sent, 529 kB received

        Summary of 13 connections

     

    syncdefaultsd

    /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support/syncdefaultsd

    Total: 152 kB sent, 179 kB received

        Summary of 2 connections

     

    Mobile Mouse Server

    /Applications/Mobile Mouse Server.app

    Total: 0 B sent, 0 B received

        Summary of 2 connections

     

    Dashboard

    /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app

    Total: 1.84 kB sent, 3.42 kB received

        Outgoing to wu-calculator.apple.com (17.171.43.55), Port http (80), Protocol TCP (6), 1.84 kB sent, 3.42 kB received

     

    ntpd

    /usr/sbin/ntpd

    Total: 2.02 kB sent, 2.02 kB received

        Outgoing to time.apple.com (17.253.84.253), Port ntp (123), Protocol UDP (17), 2.02 kB sent, 2.02 kB received

     

    CalendarAgent

    /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAg ent

    Total: 281 kB sent, 290 kB received

        Summary of 4 connections

     

    ocspd

    /usr/sbin/ocspd

    Total: 15.4 kB sent, 121 kB received

        Summary of 7 connections

     

    AddressBookSourceSync

    /System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/AddressBookS ourceSync.app

    Total: 108 kB sent, 313 kB received

        Summary of 6 connections

     

    com.apple.geod.xpc

    /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/c om.apple.geod.xpc

    Total: 16.9 kB sent, 1.17 MB received

        Summary of 4 connections

     

    UserEventAgent

    /usr/libexec/UserEventAgent

    Total: 0 B sent, 0 B received

        Outgoing to captive.apple.com (23.76.86.232), Port http (80), Protocol TCP (6), 0 B sent, 0 B received

     

    GoToMeeting v7.2.4

    /Users/drazek/Applications/GoToMeeting (3277).app

    Total: 16.7 MB sent, 95.4 MB received

        Summary of 31 connections

     

    CitrixOnlineLauncher

    /Users/drazek/Library/Application Support/CitrixOnline/CitrixOnlineLauncher.app

    Total: 4.47 kB sent, 14.6 MB received

        Summary of 2 connections

     

    helpd

    /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd

    Total: 15.3 kB sent, 4.03 MB received

        Outgoing to help.apple.com (23.76.88.139), Port https (443), Protocol TCP (6), 15.3 kB sent, 4.03 MB received

     

    locationd

    /usr/libexec/locationd

    Total: 6.56 kB sent, 49.9 kB received

        Outgoing to gs-loc.apple.com (17.167.194.149), Port https (443), Protocol TCP (6), 6.56 kB sent, 49.9 kB received

     

    Google Software Update

    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resour ces/GoogleSoftwareUpdateAgent.app

    Total: 1.48 kB sent, 4.88 kB received

        Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 1.48 kB sent, 4.88 kB received

     

    Google Software Update via ksfetch

    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resour ces/GoogleSoftwareUpdateAgent.app

    /private/tmp/KSOutOfProcessFetcher.501.I5ci1K_TwCwqo1sKvc0siaBbJTw=/ksfetch

    Total: 1.67 kB sent, 5.20 kB received

        Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 1.67 kB sent, 5.20 kB received

     

    GoogleSoftwareUpdateDaemon via ksfetch

    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ GoogleSoftwareUpdateDaemon

    /private/tmp/KSOutOfProcessFetcher.0.I5ci1K_TwCwqo1sKvc0siaBbJTw=/ksfetch

    Total: 3.43 kB sent, 10.5 kB received

        Outgoing to history.l.google.com (64.233.171.100), Port https (443), Protocol TCP (6), 3.43 kB sent, 10.5 kB received

     

    plugin-container

    /Applications/Firefox.app/Contents/MacOS/plugin-container.app

    Total: 289 B sent, 226 B received

        Outgoing to pixel2.moatads.com (52.21.158.40), Port 843, Protocol TCP (6), 23 B sent, 113 B received

        Outgoing to pixel2.moatads.com (52.21.158.40), Port http (80), Protocol TCP (6), 266 B sent, 113 B received

     

    bird

    /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/b ird

    Total: 4.06 kB sent, 12.9 kB received

        Outgoing to setup.icloud.com (17.167.138.45), Port https (443), Protocol TCP (6), 4.06 kB sent, 12.9 kB received

     

    Microsoft AutoUpdate

    /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app

    Total: 5.61 kB sent, 119 MB received

        Summary of 2 connections

     

    Safari via Safari Web Content

    /Applications/Safari.app

    /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/ com.apple.WebKit.WebContent.xpc

    Total: 47.5 kB sent, 496 kB received

        Summary of 30 connections

     

    EtreCheck

    /Users/drazek/Downloads/EtreCheck.app

    Total: 688 B sent, 38.8 kB received

        Summary of 3 connections

     

    Safari via com.apple.Safari.SearchHelper.xpc

    /Applications/Safari.app

    /System/Library/StagedFrameworks/Safari/Safari.framework/Versions/A/XPCServices/ com.apple.Safari.SearchHelper.xpc

    Total: 5.44 kB sent, 19.5 kB received

        Outgoing to clients2.google.com (74.125.228.225), Port https (443), Protocol TCP (6), 5.44 kB sent, 19.5 kB received

     

    cloudd

    /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

    Total: 41.4 kB sent, 432 kB received

        Summary of 4 connections

     

    fpsaud

    /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

    Total: 884 B sent, 5.83 kB received

        Outgoing to fpdownload.macromedia.com (23.76.68.127), Port https (443), Protocol TCP (6), 884 B sent, 5.83 kB received

     

    nbagent

    /System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nba gent.app

    Total: 862 B sent, 5.38 kB received

        Outgoing to swscan.apple.com (17.146.232.12), Port https (443), Protocol TCP (6), 862 B sent, 5.38 kB received

     

    SubmitDiagInfo

    /System/Library/CoreServices/SubmitDiagInfo

    Total: 22.5 kB sent, 3.76 kB received

        Outgoing to radarsubmissions.apple.com (17.148.88.63), Port https (443), Protocol TCP (6), 22.5 kB sent, 3.76 kB received

     

    Adobe Dreamweaver CS4

    /Applications/Adobe Dreamweaver CS4/Adobe Dreamweaver CS4.app

    Total: 1.30 kB sent, 44.6 kB received

        Outgoing to djnf6e5yyirys.cloudfront.net (54.230.39.52), Port http (80), Protocol TCP (6), 1.30 kB sent, 44.6 kB received

     

    mapspushd

    /System/Library/CoreServices/mapspushd

    Total: 882 B sent, 4.79 kB received

        Outgoing to gspe35-ssl.ls.apple.com (23.76.86.219), Port https (443), Protocol TCP (6), 882 B sent, 4.79 kB received

     

    com.apple.iCloudHelper.xpc

    /System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.ap ple.iCloudHelper.xpc

    Total: 4.29 kB sent, 18.7 kB received

        Summary of 2 connections

     

    storeaccountd

    /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/sto reaccountd

    Total: 2.58 kB sent, 34.7 kB received

        Summary of 2 connections

     

    fmfd

    /usr/libexec/fmfd

    Total: 3.42 kB sent, 5.32 kB received

        Outgoing to p05-fmfmobile.icloud.com (17.172.100.55), Port https (443), Protocol TCP (6), 3.42 kB sent, 5.32 kB received

     

    SafariDAVClient

    /System/Library/PrivateFrameworks/BookmarkDAV.framework/Versions/A/Helpers/Safar iDAVClient

    Total: 4.13 kB sent, 12.5 kB received

        Outgoing to p05-bookmarks-current.edge.icloud.apple-dns.net (17.248.135.211), Port https (443), Protocol TCP (6), 4.13 kB sent, 12.5 kB received

     

    Microsoft AU Daemon

    /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app

    Total: 2.48 kB sent, 72.1 kB received

        Outgoing to www.microsoft.com (23.218.210.155), Port http (80), Protocol TCP (6), 2.48 kB sent, 72.1 kB received

     

    AppleIDAuthAgent

    /System/Library/CoreServices/AppleIDAuthAgent

    Total: 1.01 kB sent, 4.59 kB received

        Outgoing to setup.icloud.com (17.167.138.45), Port https (443), Protocol TCP (6), 1.01 kB sent, 4.59 kB received

     

    findmydeviced

    /usr/libexec/findmydeviced

    Total: 0 B sent, 0 B received

        Outgoing to p05-fmip.icloud.com (17.172.100.49), Port https (443), Protocol TCP (6), 0 B sent, 0 B received

     

    CFNetworkAgent

    /System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/CFNetworkAgent

    Total: 460 B sent, 2.08 kB received

        Outgoing to configuration.apple.com (23.76.86.143), Port http (80), Protocol TCP (6), 460 B sent, 2.08 kB received

     

    SpotlightNetHelper

    /System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotligh tNetHelper.app

    Total: 125 kB sent, 1.80 MB received

        Summary of 4 connections

     

    identityservicesd via IMRemoteURLConnectionAgent.xpc

    /System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app

    /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURL ConnectionAgent.xpc

    Total: 237 B sent, 5.24 kB received

        Outgoing to init.ess.apple.com (184.29.104.217), Port http (80), Protocol TCP (6), 237 B sent, 5.24 kB received

     

     

    action: allow

    direction: incoming

    process: any

    owner: system

    destination: local-net

    port: any

    protocol: any

    help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.

     

    action: allow

    direction: incoming

    process: any

    owner: system

    destination: any

    port: any

    protocol: 17

    help: UDP packets are used for data where delays are not acceptable, e.g. streaming multimedia data. This rule allows all system processes to receive UDP data packets.

     

    action: allow

    direction: incoming

    process: any

    owner: system

    destination: any

    port: any

    protocol: 1

    help: ICMP data packets are used to propagate information relating to the network itself, e.g. whether a host is unreachable or whether a remote port is not ready to receive connections. This rule allows all system processes to receive ICMP data packets.

     

    action: allow

    direction: incoming

    process: any

    owner: me

    destination: local-net

    port: any

    protocol: any

    help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.

     

    action: allow

    direction: incoming

    process: any

    owner: me

    destination: any

    port: any

    protocol: 1

    help: ICMP data packets are used to propagate information relating to the network itself, e.g. whether a host is unreachable or whether a remote port is not ready to receive connections. This rule allows all user processes to receive ICMP data packets.

     

    action: allow

    direction: incoming

    process: any

    owner: me

    destination: any

    port: any

    protocol: 17

    help: UDP packets are used for data where delays are not acceptable, e.g. streaming multimedia data. This rule allows all user processes to receive UDP data packets.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/ApplePushService.framework/apsd

    owner: system

    destination: domain push.apple.com

    port: any

    protocol: any

    help: Part of Apple’s PushService framework.

     

    action: deny

    direction: outgoing

    process: /usr/sbin/nmbd

    owner: system

    destination: 192.168.32.1

    port: any

    protocol: any

     

    action: allow

    direction: incoming

    process: /Applications/Skype.app/Contents/MacOS/Skype

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: deny

    direction: outgoing

    process: /usr/libexec/XProtectUpdater

    owner: system

    destination: 184.24.154.224

    port: 80

    protocol: 6

     

    action: allow

    direction: outgoing

    process: any

    owner: system

    destination: domain icloud.com

    port: 443

    protocol: 6

    help: This rule is necessary if you want to use iCloud services.

     

    action: allow

    direction: outgoing

    process: any

    owner: system

    destination: local-net

    port: any

    protocol: any

    help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/AppleIDAuthAgent

    owner: me

    destination: identity.apple.com

    port: 443

    protocol: 6

    help: AppleIDAuthAgent is used to check whether Apple-ID certificates are valid.

     

    action: allow

    direction: outgoing

    process: /System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/AssetCacheLoc atorService

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, AssetCacheLocatorService tried to establish a connection to lcdn-locator.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/AssistantServices.framework/assistantd

    owner: me

    destination: domain apple.com

    port: 443

    protocol: 6

    help: This rule is necessary if you want to use Apple’s dictation services.

     

    action: allow

    direction: outgoing

    process: /usr/sbin/automount

    owner: system

    destination: any

    port: any

    protocol: any

    help: Automount is responsible for on-demand mounting of remote file systems. This rule enables automount to access file servers outside your local network.

     

    action: deny

    direction: outgoing

    process: /usr/libexec/automountd

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, automountd tried to establish a connection to bittorrent.app on port 111 (sunrpc). The request was denied via connection alert.

     

    action: deny

    direction: outgoing

    process: /usr/libexec/crsud

    owner: system

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /usr/libexec/discoveryd

    owner: system

    destination: any

    port: 53

    protocol: any

    help: discoveryd is the central service in OS X that maps computer names to Internet addresses.

     

    action: allow

    direction: outgoing

    process: /Library/Application Support/Adobe/Flash Player Install Manager/fpsaud

    owner: system

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS /GoogleSoftwareUpdateDaemon

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, GoogleSoftwareUpdateDaemon via ksfetch tried to establish a connection to tools.google.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/HelpData.framework/Versions/A/Resources/helpd

    owner: me

    destination: domain apple.com

    port: 443

    protocol: 6

    help: helpd downloads dynamic content for Apple's HelpViewer. If you disable this rule, HelpViewer search won't work.

     

    action: allow

    direction: outgoing

    process: /Library/Little Snitch/Little Snitch Agent.app/Contents/MacOS/Little Snitch Agent

    owner: me

    destination: ***.obdev.at

    port: 80

    protocol: any

    help: This rule allows Little Snitch’s connection alert to request more information about a connection from Objective Development’s Research Assistant Database. You can safely disable this rule if you don’t use this feature.

     

    action: allow

    direction: outgoing

    process: /usr/libexec/locationd

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, locationd tried to establish a connection to cl2.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /sbin/mount_nfs

    owner: system

    destination: any

    port: any

    protocol: any

    help: The mount_nfs utility performs file system mounts from Network File System (NFS) servers. This rule allows mount_nfs to access file servers outside your local network.

     

    action: allow

    direction: outgoing

    process: /usr/libexec/mount_url

    owner: system

    destination: any

    port: any

    protocol: any

    help: The mount_url tool performs file system mounts of WebDAV servers and other remote file systems that can be specified as URL. This rule allows mount_url to access such servers over the Internet.

     

    action: allow

    direction: outgoing

    process: /usr/libexec/nsurlsessiond

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, nsurlsessiond tried to establish a connection to swcdn.apple.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /usr/sbin/ntpd

    owner: system

    destination: any

    port: 123

    protocol: 17

    help: ntpd is the network time daemon that synchronizes your clock with a network time server.

     

    action: allow

    direction: outgoing

    process: /usr/sbin/ocspd

    owner: system

    destination: any

    port: any

    protocol: any

    help: ocspd is the “Online Certificate Status Protocol” daemon that processes certificate validation. Verisign is one of the common providers of Internet certificates so it’s one of the services the ocspd process will contact for certificate updates and verification.\n\nFor more detailed information please refer to http://en.wikipedia.org/wiki/X.509

     

    action: allow

    direction: outgoing

    process: /usr/bin/sntp

    owner: system

    destination: any

    port: 123

    protocol: 17

    help: sntp is the network time daemon that synchronizes your clock with a network time server.

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, softwareupdated tried to establish a connection to p01-swscan.apple.com.akadns.net on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/SubmitDiagInfo

    owner: system

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, SubmitDiagInfo tried to establish a connection to radarsubmissions.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: any

    owner: me

    destination: domain icloud.com

    port: 443

    protocol: 6

    help: This rule is necessary if you want to use iCloud services.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

    owner: me

    destination: domain apple.com

    port: any

    protocol: any

    help: IMRemoteURLConnectionAgent.xpc is part of Apple’s messaging/chat services.

     

    action: allow

    direction: outgoing

    process: /Library/Little Snitch/Little Snitch Agent.app/Contents/MacOS/Little Snitch Agent

    owner: me

    destination: domain apple.com

    port: any

    protocol: any

    help: This rule allows Little Snitch to determine the current geographic location when a network is joined. This information is only saved if “Save location of networks” is enabled in the preferences.

     

    action: allow

    direction: outgoing

    process: /Applications/Skype.app/Contents/MacOS/Skype

    owner: me

    destination: domain skype.com

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Skype.app/Contents/MacOS/Skype

    owner: me

    destination: domain skype.net

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: any

    owner: me

    destination: local-net

    port: any

    protocol: any

    help: Local Network is an alias for your home or company network. Technically speaking, it covers all networks your computer is physically connected to (e.g. via Wi-Fi, ethernet cable, dial-up connection, etc). The represented address ranges are updated with every change of your network configuration.

     

    action: allow

    direction: outgoing

    process: /System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/AddressBook SourceSync.app/Contents/MacOS/AddressBookSourceSync

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, AddressBookSourceSync tried to establish a connection to www.facebook.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/Adobe Dreamweaver CS4/Adobe Dreamweaver CS4.app/Contents/MacOS/Dreamweaver

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, Adobe Dreamweaver CS4 tried to establish a connection to d3qmoiwwdk0tnn.cloudfront.net on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/Utilities/Adobe Flash Player Install Manager.app/Contents/MacOS/Adobe Flash Player Install Manager

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Utilities/Adobe Utilities.localized/Adobe Updater6/Adobe Updater.app/Contents/MacOS/Adobe Updater

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, Adobe Updater tried to establish a connection to swupmf.adobe.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/AdWords Editor.app/Contents/MacOS/xulrunner

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, AdWords Editor tried to establish a connection to blogger.l.google.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/AirPort Base Station Agent.app/Contents/MacOS/AirPort Base Station Agent

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/App Store.app/Contents/MacOS/App Store

    owner: me

    destination: any

    port: any

    protocol: any

    help: This rule is necessary if you want to use the Mac App Store.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarA gent

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, CalendarAgent tried to establish a connection to webdav.facebook.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Users/drazek/Downloads/CCleaner.app/Contents/MacOS/CCleaner

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, CCleaner tried to establish a connection to piriform.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/Frameworks/CFNetwork.framework/Versions/A/Support/CFNetworkAgen t

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, CFNetworkAgent tried to establish a connection to configuration.apple.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Users/drazek/Library/Application Support/CitrixOnline/CitrixOnlineLauncher.app/Contents/MacOS/Citrix Online Launcher

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, CitrixOnlineLauncher tried to establish a connection to builds.cdn.citrixonline.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/CloudKitDaemon.framework/Support/cloudd

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 16, 2015, cloudd tried to establish a connection to configuration.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/ com.apple.geod.xpc/Contents/MacOS/com.apple.geod

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, com.apple.geod.xpc tried to establish a connection to gsp1.apple.com on port 80 (http). The request was allowed via connection alert.

     

    action: deny

    direction: outgoing

    process: /usr/libexec/crsud

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/Dock.app/Contents/Resources/DashboardClient.app/Co ntents/MacOS/DashboardClient

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Library/Application Support/DivX/DivXUpdate.app/Contents/MacOS/DivXUpdate

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Dropbox.app/Contents/MacOS/Dropbox

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, Dropbox tried to establish a connection to client.dropbox.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Users/drazek/Downloads/EtreCheck.app/Contents/MacOS/EtreCheck

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, EtreCheck tried to establish a connection to etresoft.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/FileZilla.app/Contents/MacOS/filezilla

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Firefox.app/Contents/MacOS/firefox

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gam ed

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, gamed tried to establish a connection to init.gc.apple.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, Google Chrome tried to establish a connection to 8.8.8.8 on port 53 (domain). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resou rces/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Library/Application Support/Google/GoogleTalkPlugin.app/Contents/MacOS/GoogleTalkPlugin

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 16, 2015, GoogleTalkPlugin tried to establish a connection to stun.l.google.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Users/drazek/Applications/GoToMeeting (3277).app/Contents/MacOS/GoToMeeting

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, GoToMeeting v7.2.4 tried to establish a connection to egwglobal.gotomeeting.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/iBooks.app/Contents/MacOS/iBooks

    via: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/XPCServices/ com.apple.CommerceKit.TransactionService.xpc/Contents/MacOS/com.apple.CommerceKi t.TransactionService

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, iBooks via com.apple.CommerceKit.TransactionService.xpc tried to establish a connection to init.itunes.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/iBooks.app/Contents/MacOS/iBooks

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, iBooks tried to establish a connection to bookkeeper.itunes.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/iPhoto.app/Contents/MacOS/iPhoto

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/iTunes.app/Contents/MacOS/iTunes

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 995

    protocol: 6

    help: This rule allows Mail.app to receive emails via the SSL-encrypted Post Office Protocol (POP).

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 993

    protocol: 6

    help: This rule allows Mail.app to receive emails via the SSL-encrypted Internet Message Access Protocol (IMAP).

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 587

    protocol: 6

    help: This rule allows Mail.app to send emails via the authenticated Simple Mail Transfer Protocol (SMTP).

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 465

    protocol: 6

    help: This rule allows Mail.app to send emails via the Simple Mail Transfer Protocol (SMTP) secured using SSL/TLS.

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 143

    protocol: 6

    help: This rule allows Mail.app to receive emails via the Internet Message Access Protocol (IMAP).

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 110

    protocol: 6

    help: This rule allows Mail.app to receive emails via the Post Office Protocol (POP).

     

    action: allow

    direction: outgoing

    process: /Applications/Mail.app/Contents/MacOS/Mail

    owner: me

    destination: any

    port: 25

    protocol: 6

    help: This rule allows Mail.app to send emails via the Simple Mail Transfer Protocol (SMTP).

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/mapspushd

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, mapspushd tried to establish a connection to gspe35-ssl.ls.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app/Contents/MacOS/Microsoft AU Daemon

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AutoUpdate

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: deny

    direction: outgoing

    process: /Applications/Mobile Mouse Server.app/Contents/MacOS/Mobile Mouse Server

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/Noticeboard.framework/Versions/A/Resources/nb agent.app/Contents/MacOS/nbagent

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, nbagent tried to establish a connection to swscan.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS/pl ugin-container

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.ap p/Contents/MacOS/PubSubAgent

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /Applications/Safari.app/Contents/MacOS/Safari

    owner: me

    destination: any

    port: 443

    protocol: 6

    help: Port 443 (https) is the default port for secure webservers. With this rule you will be able to connect to typical secure websites with Safari.

     

    action: allow

    direction: outgoing

    process: /Applications/Safari.app/Contents/MacOS/Safari

    owner: me

    destination: any

    port: 80

    protocol: 6

    help: Port 80 (http) is the default port for webservers. With this rule you will be able to visit most of the common (non-encrypted) websites with Safari.

     

    action: allow

    direction: outgoing

    process: /Applications/Safari.app/Contents/MacOS/Safari

    via: /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices /com.apple.WebKit.Plugin.64.xpc/Contents/MacOS/com.apple.WebKit.Plugin.64

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, Safari via com.apple.WebKit.Plugin.64.xpc tried to establish a connection to pixel2.moatads.com on port 843. The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /Applications/Skype.app/Contents/MacOS/Skype

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/Software Update.app/Contents/Resources/SoftwareUpdateCheck

    owner: me

    destination: any

    port: any

    protocol: any

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotlig htNetHelper.app/Contents/MacOS/SpotlightNetHelper

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 12, 2015, SpotlightNetHelper tried to establish a connection to api.smoot.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oreaccountd

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 17, 2015, storeaccountd tried to establish a connection to init.itunes.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oreassetd

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, storeassetd tried to establish a connection to su.itunes.apple.com on port 443 (https). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/st oredownloadd

    owner: me

    destination: any

    port: any

    protocol: any

    help: On Sep 13, 2015, storedownloadd tried to establish a connection to a397.phobos.apple.com on port 80 (http). The request was allowed via connection alert.

     

    action: allow

    direction: outgoing

    process: /System/Library/CoreServices/SubmitDiagInfo

    owner: me

    destination: any

    port: any

    protocol: any

  • by drazek73,

    drazek73 drazek73 Sep 17, 2015 3:14 PM in response to drazek73
    Level 1 (0 points)
    Sep 17, 2015 3:14 PM in response to drazek73

    do you know if wireshark can be of any help?  just installed it but I see I know we will have a huge learning curve there

  • by Drew Reece,

    Drew Reece Drew Reece Sep 18, 2015 1:14 PM in response to drazek73
    Level 5 (7,679 points)
    Notebooks
    Sep 18, 2015 1:14 PM in response to drazek73

    There is an awful lot going on there, but I can't see anything that seems abnormal. I can't pretend to know a lot about key loggers & other tools that could be used to extract data but I don't see any signs in that output. The trouble is that the data may have removed before this reporting was started or it may have been a different type of attack, like at a router or hardware keylogger (there are too many ways to speculate).

     

    Many of the connections are from system tools, they are just part of how OS X works these days. It has a network addiction.

     

    I do wonder if Citrix's app could have been used against you - any remote access tool has a lot of power. Ensure your account is secure if you have previously shared passwords or login details for that account.

     

    Wireshark will only help if you know what to look for. Network data is full of many management frames & lots of traffic that is beyond my abilities to diagnose.

     

    I don't think I have an answer you want to hear… basically if you don't trust it, clean install it and/ or get it investigated by a professional. Restoring data after a breach is a major battle, finding out how you have been attacked is equally hard, it becomes even more difficult when you are not even sure if an attack has actually happened.

  • by drazek73,

    drazek73 drazek73 Sep 19, 2015 7:25 PM in response to Drew Reece
    Level 1 (0 points)
    Sep 19, 2015 7:25 PM in response to Drew Reece

    would you know anything about this mac address? .. F4:1B:A1:04:96:A9  i did a little reserch with my internet provider and see 3 devices connected ... one of which I don't recognize

     

    Connected Clients

    MAC Address Age(s) RSSI(dBm) IP Addr Host Name ModeSpeed (kbps)
    F4:1B:A1:04:96:A9195423-79n2000
Page 1 Next