Did my guest put spyware on my Mac?

Question

Level 1

0 points

Did my guest put spyware on my Mac?

I recently had a house guest and they were extremely nosy. I'm fairly certain they were watching me when I entered my system password while I was installing an application. Later I found that they had used my computer when I wasn't present. they had accessed the web but then cleared all the history and cookies from the browser. I'm a bit suspicious that they may have uploaded a keystroke tracker or some other form of spyware or tracking software to my computer. I've checked the system log for the times the machine was used, but I'm not at all certain what I should be looking for. Is there a good way to determine if spyware or a tracker is installed on my machine? Please help out a noob. Thanks.

Mini 2GHz C2D, Mac OS X (10.5.1)

Posted on Nov 25, 2007 7:57 PM

Reply

Answer 1

Nov 25, 2007 8:16 PM in response to Streamlines

Welcome to the Apple Discussion Board!

Try taking a look at these apps and read in their documentaion where they install their parts:

http://www.versiontracker.com/php/qs.php?mode=basic&action=search&str=key+logger &srchArea=macosx&submit=Go

If your really paranoid, change your password and make sure your screensaver and login require a password.

Reply

Answer 2

LarryHN

Level 10

106,142 points

Nov 25, 2007 8:20 PM in response to Streamlines

and be sure the firewall is turned on and tightly locked down - do not approve any strange requests

Larry Nebel

Reply

Answer 3

Streamlines Author

Level 1

0 points

Nov 25, 2007 8:24 PM in response to pardthemonster

Well, the person no longer has direct access to my machine and won't for some time. Should I change my system password anyway? If they are recording my keystrokes won't they get the change as it happens?

Sorry for my ignorance, but I'm not really savvy enough to figure out where the apps you listed install their parts.

Reply

Answer 4

Streamlines Author

Level 1

0 points

Nov 25, 2007 8:25 PM in response to LarryHN

I'm very good about not approving strange requests. Any suggestions for firewall settings?

Message was edited by: Streamlines

Reply

Answer 5

Nov 25, 2007 8:35 PM in response to LarryHN

Yes, change your password! Apple's firewall won't block outgoing requests, only incoming. If you are interested if there is outgoing activity, you might want to try Little Snitch ( http://www.obdev.at/products/littlesnitch/index.html). You best bet I think would be looking for the few keyloggers that there are for osx and how they work. I'm not aware of any keyloggers that send data to another person. If you do find a keylogger on your computer that is indeed doing this you might want to look into legal action against this person. Here's some more I found from a google search:

MonitorX Pro ( http://www.burning-bytes.com/monitorerxpro.html) (keylogger plus screenshots)

Spectre for Mac OS ( http://www.spectorsoft.com/products/Spector_Macintosh/index.html) (screenshots)

KeyStroke ( http://keystroke-loggers.staticusers.net/mac.shtml)

logKext ( http://braden.machacking.net/)

Keystroke Recorder X and KeyLogger X ( http://www.undergroundmac.com/security.html)

Reply

Answer 6

KJK555

Level 4

2,906 points

Nov 26, 2007 2:35 AM in response to Streamlines

Hi Streamlines:

If you are a newbie, most likely you are going to have a hard time determining whether or not someone has placed a piece of spyware on your machine or not. it can be a challenge to an old hand like me to find. If you believe that your guest has sufficient motive to invest $100 or so in a program to spy on you, then I suggest you back up your important data, erase and reformat and reinstall and after all that secure your computer so it won't happen again.

If you decide it is important enough to find out for sure and you are willing to pursue prosecution, then you should seek out a professional data recovery service to help you.

Reply

Answer 7

Streamlines Author

Level 1

0 points

Nov 26, 2007 6:48 PM in response to pardthemonster

Well, the person no longer has physical access to my machine. It appears from what you're saying about there not being any keyloggers that send data to another person that they will not be able to get any data or info off of my machine over the web?

Reply

Answer 8

lethal

Level 2

435 points

Nov 26, 2007 7:06 PM in response to Streamlines

Most spyware or keyloggers can send data out to the internet.

The best way to detect and stop that is some like Little Snitch - which will be able to detect and block the outbound traffic but not remove the keylogger.

Reply

Answer 9

reddart

Level 1

8 points

Nov 27, 2007 4:12 PM in response to pardthemonster

Well, I can tell you that Spector does not work on 10.5.1 (even though it says for 10.3 and higher), so you don't have to worry about spector being a problem. I know, because I am trying to install it on my computer. They even sent me a new beta version, but it also didn't work...

SO, don't buy spector untill they come out with a version that works with 10.5.

Reply

Answer 10

lethal

Level 2

435 points

Nov 27, 2007 4:28 PM in response to reddart

One of the applications I can't use under Leopard is iListen - speech recognition and dictation software - it fails because Apple changed the low level internals of how keystrokes are handled.

This change likely snapped most keyloggers too.

Reply