Hey, I followed some terminal commands because my macbook has acted weird. I can't find the folders "KeyboardServices"-folder nor the "LanguageModeling". I've sensored my name by the way :) What do you think?
MacBook Pro 13”, macOS 10.14
bash-3.2# dscl . list /Users | grep -v '^_'
...
hiddenuser
...
is hiddenuser in fact hidden in System Preferences > Users & Groups? Names themselves don't mean anything, but if hiddenuser does not appear in Users & Groups it's more than suspicious.
daemon
nobody
root
... are present by default. Nothing other than those and authorized User Accounts should appear. I am assuming you substituted myusername for your actual user name, whatever that is. Don't reveal it here.
I can't reveal personal details, but there is a fair chance someone has done a thoroughly job to access my data.
If that's the case then your data are in the wind and there's no undoing that fact. There is no point in continuing to use that Mac, including using it to find out who's accessing it. Turn it off, unplug it, etc. Do not use it. Place it in the hands of an expert.
Having said that, whatever means someone used to access it (and in all likelihood, everything else you use) is another story altogether. Unless and until that breach is determined and rectified the problem is likely to occur again, even if you were to completely erase and reconfigure that Mac.
MrHoffman wrote:
Change all passwords, change the passwords in the password-recovery paths, social media passwords, check your trusted telephone numbers, revoke any unrecognized app approvals, enable two-factor authentication, etc.
Check the other devices and the other connected hardware on your desk and on your local network for compromises, particularly your router and your network-connected printers, and upgrade all of that to current firmware, and seriously consider resetting and reconfiguring the router.
👍
And don't use that Mac to do that.
Sorry, here it is:
But the screensharing plist file results in this no matter what:
Aaand here is some shady stuff in the system log.
Yeah, I get it. Thanks a lot by the way.
_ctkd appears to be the smart-card driver.
Wireshark? Yes. Remote desktop? Not a chance.
I can't reveal personal details, but there is a fair chance someone has done a thoroughly job to access my data. I've used Apple products for 10 years, and never suspected anything. It all started with the router acting weird, so I took a look at the maintenance log. Someone had disabled the firewall, initiated channel hopping and deleting all filters for allowed mac addresses.
I created a password protected folder to gather all the proof of compromise. After a couple of weeks I lost access to the folder because "you don’t have the necessary permission." I've also changed passwords everywhere, factory reset all my devices, enabled two-factor, and so on.
Here are some examples that makes me suspect compromise:
Do I have spyware?
