I found something interesting in my Cache Dameons folder today and started to give me a scare- please take a look and lmk what you think.

I found that I have a lot of items in my daemon cache folder lately, which I don't think is normal and one of them is com.apple.opendirectoryd.plist - which I researched and found that it

is to be used as a way to set my computer into single user mode and

letting some individual use it to exploit through UNIX. From what I found, this allows them to be able to see all of my public folders, files and then have even more access to create more crazy shi* to happen on my computer and basically plant other codes that can do even more powerful things. Please let me know your opinion or if you are familiar with this. Below is a copied version of the plist i found in the folder because it was locked. If someone can help me I would really appreciate it, or even give me some thoughts. I have had many people tell me I am not being hacked and it's almost "impossible" in those other entries, but I want as many people's opinions on this as possibe and if this IS what I suspect it is, how to go about fixing this issue, becuase I believe even a hard reset would still allow them to have this code in place since its mounted to different drives etc. Even if I am able to do a hard reset, what do I do to contain this from happening again? I know there are a lot of questions in here and I am only providing one piece of evidence, but if you look into it this is how mac's are exploited now. So please someone help me, I really would appreciate your time and effort. I am learning new stuff everyday when posting on here, so please enlighten me to what you think. Thanks to everyone who contributes!!


Title: com.apple.opendirectoryd.plist


bplist00ÿ

!"_BeginTransactionAtShutdown_EnableTransactions_EnvironmentVariablesYKeepAliveULabel\MachServices^POSIXSpawnTypeWProgram

__CFPREFERENCES_AVOID_DAEMON___CF_USER_TEXT_ENCODINGQ1W0x0:0:0_com.apple.opendirectoryd÷ _$com.apple.private.opendirectoryd.rpc_,com.apple.system.DirectoryService.libinfo_v1_/

com.apple.system.DirectoryService.membership_v1_#com.apple.system.opendirectoryd.api_'com.apple.system.opendirectoryd.libinfo*com.apple.system.opendirectoryd.membership_HideUntilCheckIn

[Interactive_/usr/libexec/opendirectoryd��6�K�b�l�r��é�ñ�ó�ò�ù�º�÷�ÿ�‡�·�¸

0_ë∑·$%&'()*6�������������#��������������T


THANKS FOR EVERYONE WHO HELPED!!!!

Posted on Jan 23, 2020 7:10 PM

Reply
Question marked as Top-ranking reply

Posted on Jan 23, 2020 8:04 PM

First, to accomplish what you describe that hypothetical user would require hands-on possession of that Mac. The most fundamental element of security is physical: keep your Mac physically inaccessible to unauthorized users of it. Physical possession makes a number of potentially unauthorized and nefarious actions possible. It would also be a crime to do that, lacking a warrant issued by a court, at least in the United States.


Next: even if someone were to physically possess that Mac, he or she would need to provide its firmware password before being able to boot single-user mode.


Next: even if someone were to boot single-user mode, that someone would need to provide the Mac's FileVault password before its startup disk (hard disk / flash memory / "fusion drive") could even be mounted. Without that password, a hard disk encrypted with FileVault can be used for no purpose unless and until it is erased, which leaves nothing but random data behind.


Next: Macs with the T2 Security Chip convey even more protections with options described in Secure Boot.


Next: The particular Launch Daemon that uses the properly list you're describing comprises a fundamental aspect of macOS User Account creation and control. It is not subject to exploitation any more than macOS itself, and macOS "Catalina" is by far the most secure consumer-grade operating system there has ever been in the history of mankind or whatever may have preceded it.


Despite those facts I understand you're concerned about your Mac becoming "hacked". That's understandable, but a more comprehensive answer requires explaining just what that term means to you. "Hacking" has a bunch of different connotations encompassing the full range of benevolent to benign to malicious. Bear in mind that an enormous number of Mac users willfully install things that exist for the sole purpose of constantly harvesting and uploading personal information from their Macs, in the same manner as a "computer virus" would, if such a thing were to exist on a Mac, which it doesn't. They do so willfully; almost gleefully. Merely suggesting they reconsider that practice tends to annoy them. It's called Google.


Read about Apple's Open Directory project here: https://developer.apple.com/documentation/opendirectory


Finally: there are multitude of simpler and easier ways of lifting personal information that don't even involve a Mac.

Similar questions

5 replies
Question marked as Top-ranking reply

Jan 23, 2020 8:04 PM in response to AlwaysHacked247

First, to accomplish what you describe that hypothetical user would require hands-on possession of that Mac. The most fundamental element of security is physical: keep your Mac physically inaccessible to unauthorized users of it. Physical possession makes a number of potentially unauthorized and nefarious actions possible. It would also be a crime to do that, lacking a warrant issued by a court, at least in the United States.


Next: even if someone were to physically possess that Mac, he or she would need to provide its firmware password before being able to boot single-user mode.


Next: even if someone were to boot single-user mode, that someone would need to provide the Mac's FileVault password before its startup disk (hard disk / flash memory / "fusion drive") could even be mounted. Without that password, a hard disk encrypted with FileVault can be used for no purpose unless and until it is erased, which leaves nothing but random data behind.


Next: Macs with the T2 Security Chip convey even more protections with options described in Secure Boot.


Next: The particular Launch Daemon that uses the properly list you're describing comprises a fundamental aspect of macOS User Account creation and control. It is not subject to exploitation any more than macOS itself, and macOS "Catalina" is by far the most secure consumer-grade operating system there has ever been in the history of mankind or whatever may have preceded it.


Despite those facts I understand you're concerned about your Mac becoming "hacked". That's understandable, but a more comprehensive answer requires explaining just what that term means to you. "Hacking" has a bunch of different connotations encompassing the full range of benevolent to benign to malicious. Bear in mind that an enormous number of Mac users willfully install things that exist for the sole purpose of constantly harvesting and uploading personal information from their Macs, in the same manner as a "computer virus" would, if such a thing were to exist on a Mac, which it doesn't. They do so willfully; almost gleefully. Merely suggesting they reconsider that practice tends to annoy them. It's called Google.


Read about Apple's Open Directory project here: https://developer.apple.com/documentation/opendirectory


Finally: there are multitude of simpler and easier ways of lifting personal information that don't even involve a Mac.

Jan 23, 2020 10:25 PM in response to AlwaysHacked247

No, I won't call you crazy; I'll just call you naturally inquisitive and cautious. But there's no reason to believe any of the information you posted is any indication of malicious interference. I have looked at everything you posted, and there is simply nothing unusual or reason for concern.


MobileDevice for example is a name Apple typically uses to identify various services for iOS devices that connect to and sync with your Mac, and those files exist on the Macs I use.


I would caution you about opportunists that seek to convince you of the need to buy whatever product they're peddling claiming to protect your Mac from whatever evils—real or imagined—may exist. They'll exploit your concerns and even use the information you posted to convince you something's wrong when it isn't. Those opportunists are the real threat you should fear.

Jan 23, 2020 10:14 PM in response to AlwaysHacked247

I can't get too excited about Trojans. By definition that's something users are deceived into installing, and usually that deception leverages a desire to illegally obtain something without having to pay for it. It's my opinion that people who do that get what they deserve, but set that opinion aside for now. Everything you install on a Mac requires a deliberate and overt action, and macOS provides various degrees of warnings if that something was obtained from a potentially untrustworthy source. Those warnings should always be taken seriously. Things that affect a Mac system-wide always require Administrator authorization. Then there's macOS itself, recent versions of which simply cannot be altered, even with Administrator authorization.


Then consider "Intego" is one of the worst pieces of garbage anyone could inflict on a Mac. Installing it made mine nearly unusable. No knowledgeable Mac user would tolerate it. But set that aside also. Set aside its purpose of frightening people into buying their junk too. The Intego article describes a hypothetical Trojan that never manifested in affecting Macs in any widespread manner. Apple responded by blocking it with its XProtect service anyway, as they do when such exploits arise—even hypothetical ones.


It's one thing to create a clever Trojan in a laboratory setting and proclaim its success. It's quite another to actually deploy one and accomplish anything meaningful. You can come up with hypothetical Trojans all day long. It would take me about thirty minutes to develop one myself, but that's only because I have no extraordinary programming skills.


Then there's the fact it's eight years old and as many macOS versions out of date.


Summary: Forget about "OSX Crisis". The sky is perpetually falling for some people.


XPCServices: https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingXPCServices.html


All those files in your screenshot are totally normal and present with all recent macOS versions. They are used in conjunction with iOS device syncing.

Jan 23, 2020 9:27 PM in response to John Galt

Thank you for taking the time to write that out and explain to me your thoughts. I agree with 99% of what your saying. Yes, I agree that Macs have very very good personal and just overall great security features. Now I know when people say I have been hacked and all this they are always paranoid, don’t make any sense or are usually just looking at something apple put in their as code and there just dumb enough to think its a hack et etc. We have all heard all of these cases. I just want you to look at a few pictures that I took and see if you had these on your computer what you would 1) think and 2) do and react. So I really appreciate your answer and how you had some real thoughts and real actual answers on what I was trying to describe. I think some of these things you may just need to see. I will give you some little specs of information such as a hidden folder (which arent uncommon since apple has a lot of them) but this one was name PrivateFrameworks/MobileDevice.framework and it had 4 folders being “Resources”, “Versions”, and “XPCServices” which I saw was a very bad malware/trojan- website for that information is here. 


https://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/


Lastly, in that folder there was one document I could not open at all called MobileDevice. I ended up using BBedit and opened it and saw so much that actually led to me believing I have something wrong with my computer. Below is one photo of the picture you can get to understand it a little more on my end. 


Then I discovered this picture out of the blue that I did not delete, nor did I even try to open- it just showed up while I was searching for something in spotlight. That is below as well.  Now when I look at this a lot jumps out saying somethings not right to me- so you let me know what you think. Apple doesn't use XPC Services, nor did Apple Mobile Helper and Apple Mobile Sync look fishy, especially seen as deleted, but still there. Last thing I want to point out is

that the MobileDevice document I could only open with BBedit and that's when i saw the entire project. I will add a few photos from there because I do think I am running out of characters.


Those are what brought up all the red flags. I have other code i want to show you but I believe I am running out of room.


Jan 23, 2020 9:48 PM in response to AlwaysHacked247

Now, here is some code I got from that one document called MobileDevice. Here is what I found and shows that the ONLY code they are using is UNIX and Unicode.

This is something I just wanted to include and I blocked out my name. This says On Console which doesn't also make sense.


Heres an example which I want you to also know I am finding this stuff as I come along and before the post. I think it is more serious but thats why I want others opinions. They just had a code written to say BuildMachineOSmachine.... that's very weird. Please let me know your thoughts on that as well. Do you know coding by any chance? because what they are doing or the virus is basically keep looping different codes with different variables and stringing them all together. Here are the last 2 photos.


there is one and heres the last one.



Just skimming through it I do think it is some type of bad maleware. I do want your input and what you would do if you were me because at this point I have a lot of information I am providing and I hope you understand where I am coming from as if the same thing were happening to you. Again, you have been of great knowledge and I hope everyone can see this and tell me I am crazy but if not actually give me advice on how to make my computer more secure. Thank you for your time and sorry for how long this was but its the end. Please just look at what I showed you and see if theres something you see as well. Thanks again to everyone who responds.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

I found something interesting in my Cache Dameons folder today and started to give me a scare- please take a look and lmk what you think.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.