Suspicious processes in top and nettop

I see some suspicious processes in "top" result periodically. I don't have any game controllers on my iMac. I don't use apple pay stuff.


Also I see using "nettop" connections by mobileactivationd (8-11 connections??), biometrickitd (I don't use touch ID), nfcd (as I said I don't use apple pay system), nsurlsessiond (comes up every 5-10 minutes with downloading 15kb).


Is it connected with malware or hacking (password bypass with biometrikitd) stuff somehow?


Several distnoted processes by different users. Are they OK?


I understand that it's a bit silly to ask here, but still. 3-4 months ago I visited a TOR browser without VPN (I was curious). I saw very terrible "content" there. I opened about 20-30 pages (I didn't do anything special; just watch). Now I regret it very much and worry that I have picked up malicious stuff. I've even reinstalled the OS several times. That's why I'm asking about such suspicious things here. Is everything very bad?


iMac 27″, macOS 13.3

Posted on May 1, 2023 12:29 PM

Reply
4 replies

May 1, 2023 1:22 PM in response to aleksei273

There’s nothing wrong here.


In no particular order… MacOS routinely runs services you don’t use. Posting unsolicited images can disclose sensitive information and can potentially end badly. First-few-hops VPN clients are protections against problems that haven’t existed for a decade. There’s rubbish on the regular internet, we don’t need Tor for that. It’s “Tor” and not “TOR”.


More generally… If you want to learn about macOS internals and forensics, acquire the New OS X Book (three volumes), and learn about the structures and organization of macOS.


Malware that can survive a reload is very rare, and—if you’re a potential target of that—requires specialized help with security tailored ro your situation.


May 2, 2023 10:14 AM in response to aleksei273

In addition to the great advice from @MrHoffman, here is another article written by a respected forum contributor which can help keep both you and your devices safe.

Effective defenses against malware and other threats - Apple Community


FYI, you will drive yourself crazy looking too closely at these things since every OS (macOS, Windows, Linux, BSD, etc,.) will have dozens of processes with the same name running at the same time and is perfectly normal. You will only discover a problem if the malware actually uses some oddly named process which is not normally used by the OS or any standard apps. Even then, a legitimate app & process may have odd names. Also, stay away from the macOS system logs for the very same reason.


Just use your Mac normally and don't worry about anything unless you start to have problems. As long as you practice safe computing habits as outlined in the article I linked, you are not likely to ever have a malware related problem.


If you are a high profile target, then you will need to be extra cautious with your safe computing habits and you may need to implement other security procedures, but if that is the case, then you should be consulting with a firm specializing in personal security measures.


The average user who practices safe computing habits should very seldom encounter any malware related issues...any issues should be minor.


Social engineering (aka phishing) is what the average user needs to worry about since people are the weakest link in any security endeavor.

May 2, 2023 7:38 AM in response to aleksei273

Okay, so you’re going to be spending time researching every process in macOS. To do that, read the internals book, and search the open source archives, and search the net.


And also realize that the whole process name approach is somewhat less than completely illuminating, as malware can borrow legitimate process names.


There are legitimate processes using the name mobileactivationd, usually part of: https://libimobiledevice.org/


PerfPowerService is also usually part of macOS.


Most attacks are against us, and not our devices. We’re the weakest part of security, on average. Phishing and other scams, re-used passwords, forgetting to update, compromised passwords via shoulder surfing, etc.


Here’s an intro to safety and security:

Personal Safety User Guide - Apple Support


The widely-publicized high-profile exploits are exceedingly rare, by all appearances


Probably best to explain your specific security risks to Apple, and ask them for forensics suggestions.



This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Suspicious processes in top and nettop

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.