Found console open, possible unusual log, and IP addresses. Have I been hacked?

Hi,


My console was strangely open yesterday. Today I've looked at it, and there is some unusual logs I've not seen before.


I then checked IPs connected to device, and don't recognise these two:



In additional text is some of the console log (I've hidden ID with ....). Can anyone advice if the log or/and IP addresses are suspicious and indicate if I've been hacked?


[Personal Information Edited by Moderator]


Posted on Mar 30, 2023 7:52 AM

Reply
3 replies

Mar 30, 2023 9:30 AM in response to Oli_P

Console app can be opened through various means, not the least of which is a Spotlight search including a few characters and a return. In isolation, I'd not expect issues with an open app.


If you are concerned, steps here would include wiping and reloading the Mac, given the severity of the compromise here you are claiming. Basically, what you are writing about and fearing is a catastrophic failure of your local security and either a failure of or bypass of your external network firewall, assuming a typical small office or home office Mac setup. The recourse there is a wipe and reinstall from known-good sources, and potentially also your network firewall. A wipe and reinstall is something I would not expect is necessary here, absent more evidence of compromise.


If the IP address is in the 17/8 block, it's Apple. If not in 17/8, it could be Apple, or it could be any number of other apps or service providers. IP addresses and log data more generally are less than useful in this and similar contexts. Not without something to look for.


That you might not be familiar with a log or three doesn't indicate it's at all unusual to others. Apple has shuffled those around, and various apps keep their own.


With what's been posted and then expurgated, I don't think you're going to get an answer here, past changing your passwords and updating to the most current macOS supported by your Mac, and similar longstanding recommendations.

Mar 30, 2023 11:21 AM in response to Oli_P

It is best to avoid looking at the macOS system logs these days. The macOS system logs are full of a lot of nonsense which can look & sound very scary, plus most entries are cryptic making sense only to the developer of the app/utility....these logs are no longer meant to be viewed by users. In addition these logs rarely help in troubleshooting any macOS or hardware issues. Some logs are now even sanitized probably under the guise of security, so if an entry was going to be useful, the sanitization destroys the usefulness as there will be no details. Years ago, these system logs were useful (I used them all the time), but this has not been the case now for at least ten years. The only useful log these days are the Kernel Panic logs, but even these are starting to become useless especially with the Apple Silicon Macs.


Even a third party macOS software developer who is a respected forum contributor has said the same thing.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Found console open, possible unusual log, and IP addresses. Have I been hacked?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.