EFI Malware - DNS Hijacking

I have not been able to get much support or info back from Apple and I cannot afford a forensics team right now.

I know everyone says this kind of stuff isn't possible but I can confirm that some of it is. I have read most of the reports of the more advanced malware and dns hijacking techniques but due to my lack of expertise in this area it's been hard to be sure.

I believe I am infected with mojo_thor efi malware as how Rick describes it here is very similar to how I experienced it and still am. I don't want to waste a bunch of time so if you ask for logs or proof I'll do my best to get you exactly what you need to see. I have been trying to learn essentially how the inner workings of enterprise management tools and the OS work and for now it's more than I can handle.

I do know I have been under attack and I highly suspect it is stemming from my apple devices. I may, I know 100% that there are things I think are evidence or something malicious and they won't be. I've read every forum post like this and know it's going to be people giving me a hard time if I do that. Please hang in there I have spent enough time with this to know something is going on and I have almost a year of documentation, logs and photos and will as directed update here for anyone that is willing to help.

The stuff I post will not be in order of what's most convincing. If I post it it probably means it was or is the latest thing I'm trying to rule out and understand. If you want a log just ask.

Thanks,

First up and is pretty off topic unless there is EFI bootstrapping during boot but does anyone recognize failure installing with these errors and process.

restore.log

Posted on Feb 28, 2021 11:43 PM

Similar questions

My Mac Book Air is Been Hacked - 0 Hi Respected Sir / Madam I have lots of unresolved issue on my MacBook Air, which I have shared in the Apple Support Community by name kbnikhil as I have shared below screen shots as I could see that Mac OS were getting heavily unstable and not working for me. even I had a reinstall of MacOS Catelina from Apple Authorised Service Centre Imagine Store at Bangalore India, in the month of April 2022 even then seen high crashes were seen on applications like Text Editors, Face Time, High Encryption was seen on iMessages as I was reporting from almost a year now, it is not getting resolved, Antivirus Programs are not revealing any malware, virus, spyware, bloatware etc.., But Operating System Gets Updated regularly, . then I recently came across the below website which suggest there may be a Hacking going on my macOS Catalina. https://macmyths.com/how-to-tell-if-someone-is-remotely-accessing-your-mac/ I had fallow all there steps, as flows on System Preferences, Sharing Folder I did not find Screen Sharing Enabled so went on to next steps as fallows Verify If New User Accounts Have Been Added Fallowing Command Executed in Terminal dscl . list /Users | grep -v '^_' Out Put of the command as fallows daemon MyUserAccount nobody root It Looks Normal Check Which Programs Have Access To Camera And Mic Fallowing Command Executed in Terminal lsof | grep -i "AppleCamera" No OutPut Logs from /var/logs Check The Logs For Possible Access Issues found some things WebKit Used to sharing was having to see getting sigkill, also FsckAps Logs showing many disk present also Failed iBooks Application Also Failed Photos Application And Other Applications Also found Some BloatWare like Studentd Application After All the Above things and Many Reinstalls still facing lots and lots of Application Failure, OverHeat, Network issues, Apple Store Issues and Many more etc.. So As per the Al "MacMyths Autor" Hi, I am Al. I've been working with computers for more than 20 years and I am passionate about Apple products. is my macBook Catalina Os is Hacked If Yes how to tell, and get rid of these Hackers from my system Eagerly waiting for some answer or some solution thank you for listening hopefully I will get faster solution to it thank you All K B Nikhil
9290 22

50 replies

Jun 17, 2021 6:18 AM in response to AutoGenetix_Design

Why not get a chromebook or GrandPad if people are hacking your Mac so much.

Jun 17, 2021 11:42 PM in response to AutoGenetix_Design

Lucky You!!! 2019? I started investigating in 2015 🤦🏻‍♂️

CLZQ

Level 1

4 points

Jul 31, 2021 4:11 PM in response to CLZQ

Strange wtheck happened to my first reply that took me over 30min to thoroughly type out. Guess when your over the Target things go missing!!!

Aug 1, 2021 11:19 AM in response to REPORTED_THIS_FOR_9_MONTHS

[Image Edited by Moderator to Remove Personal Information]

MrHoffman

Level 10

165,399 points

Aug 1, 2021 6:37 AM in response to AutoGenetix_Design

Anything those four screen shots are intended to show, beyond some personal info, what looks like a double install, and an iPhone synced with multiple systens?

As was mentioned earlier, you will want to learn about digital forensics and incident response, and how to do the work, and acquire the evidence. Or pay somebody to do the related forensics work.

Which can be expensive, tedious, and time-consuming.

Claims aside, most making these claims can have had something else happen; software and hardware problems being common. Exposed passwords, phishing, DNS errors, the usual sorts of Apple glitches and corruptions, lots of ways to get into trouble.

And for what I see with the four photos and beyond the included personal info posted here, a double-synced iPhone and/or confusion after a reload, and a doubled install or dual-boot or corrupt Spotlight database. And then a whole lot of forensics work requiring direct access, and some of which may well involve proving a negative; a difficult proposition, at best.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

EFI Malware - DNS Hijacking