Screen Sharing hacked - How to be confident the 'hole' is closed...

Question

Screen Sharing hacked - How to be confident the 'hole' is closed...

My OS is Ventura 13.3.1 on a M1 Mac mini.

Over the weekend my computer was hacked into through Screen Sharing. It is 100% my fault, no question there, because I had set up port forwarding so that I could log into my computer when I was at home for Christmas, and never shut it back down. (Since it needed my user account password to log in I felt it wasn't "completely" open, but clearly they got ahold of that password.)

I deserve every bit of "blame" anyone wants to throw my way about making such a dumb mistake, but lets just skip that since I get it, and accept it, and I've learned my lesson.

It was the middle of the night, but I by total chance was awake and caught them pretty quick (I think) and shut it down. They did log into Amazon and PayPal and buy several gift cards. Since they were logging in from my computer's browser through screen sharing, auto-complete let them in.

Could have been much worse. Looking at my browser history, they first tried going to Coinbase (no account there) Chase (no accounts there) Amazon ($250 in gift card before Amazon locked my account) and then PayPal ($200 in gift cards before I caught wind and shut everything down). Luckily they didn't see my bookmark to PNC, my bank, which also would have auto logged in. They could have cleaned me out. Or they didn't recognize that "PNC" is a bank, since it isn't as obvious as "Bank of America" or "Wells Fargo" or something...

(As a side note for anyone interested, the Amazon charges were through my default payment method, which is a debit Mastercard, and I am being totally protected there by Mastercard Buyer Protection. The PayPal charges were direct on the PayPal website, and PayPal is throwing me to the wolves and not offering ANY protection. FWIW)

I have now:

Turned Screen Sharing & Remote Login OFF in System Settings
Deleted the port forwards from my internet service/modem
Deleted the entries in my router's settings that made those port forwards "work"
Changed my Mac user account, AppleID and all bank/other website passwords to completely new, much longer passwords
Set up 2-factor for everything that has the option

My questions are:

1) Just for peace of mind, with those Screen Sharing & Remote Login options turned off and port forwarding entries deleted, there really is NO WAY for someone to screen share into my computer from outside my local home network, right? Whether they use Screen Sharing from a macOS computer or VNC from a non-Mac computer, it all uses the same underlying mechanisms, which I now have turned off? (screensharingd, I believe...?) Doing Screen Sharing through Messages DOES STILL WORK apparently, which makes me worry a little, but is this normal behavior? It does require someone on both ends to authorize.

2) I'm still able to view the screen of a headless Mac mini on my local home network. It is functioning as a dedicated print server, no software other than bare minimum installed and not even signed into ANY iCloud account. This is normal behavior, since Screen Sharing is still ON on that computer, right? In other words, Screen Sharing being turned off simply means that that computer won't share IT'S screen, not that the whole Screen Sharing infrastructure is shut down?

3) Is there any way to tell if they downloaded a "dump" of my email and or Messages or anything? If such a mechanism even exists? I think I caught wind of what was happening pretty quick, but it is possible they were on my computer for a while BEFORE they started buying the gift cards, which is what alerted me.

4) Should I consider completely wiping and reinstalling from scratch on my Mac mini to be safe, in case they, while on my computer, installed some other backdoor to my computer that can avoid using Apple's own Screen Sharing code and use their own instead? Or key logging software? Or is that over-worrying?

Thank you deeply to anyone who actually read this far and is open to helping me out with some information that will hopefully give me some peace of mind... I've been turning my Mac completely off every time I walk away from it the last few days, and that ends up being dozens of times a day, and it is pretty disruptive. haha (Luckily the M1 Mac mini boots crazy fast!)

Thanks again.

[Re-Titled by Moderator]

Mac mini

Posted on May 8, 2023 2:08 PM

Reply

Answer 1

Top-ranking reply

MrHoffman

Community+ 2025

Level 10

143,473 points

May 8, 2023 2:29 PM in response to BlueSkyPrinter

Off the top…

If they had admin access, pretty much nothing can be trusted.

And wading through whatever logs are around logs won’t tell you what you need to know.

Option Get-Current: Make a precautionary backup, build a bootable installer, erase and re-install Monterey or Ventura or whatever is newest for the Mac, migrate in from your backup, re-configure remote access, and change all passwords.

Option Restore: Make a precautionary backup, build a bootable installer for whatever version you were using, restore the backup, re-configure remote access. And change all passwords.

Option I-Have-No-Backups: Make a precautionary backup, build a bootable installer, erase and install Monterey or Ventura or whatever is newest for the Mac, migrate your files and documents and not apps, and change all passwords.

Enable two-factor on your Apple ID, and change your password-reset path passwords (mail, etc), social-media passwords, everything. make sure you recognize all devices associated with your Apple ID, or reset all and re-log in. Review your trusted telephone numbers, too. I’d also reset passwords and rules on and update the firmware of the Wi-Fi router / firewall / gateway box, too.

See Safety Check here: Personal Safety User Guide - Apple Support

Password re-use is approximately doom, these days, too.

Reply

Answer 2

T3ddy19

Level 1

94 points

Feb 19, 2024 8:05 AM in response to BlueSkyPrinter

MrHoffman is one of the best out here. Did that solve your issue? I was in the hospital 2021 for about a month, and my devices were compromised. Screen sharing appeared. An iPad mini was taken, likely by someone that knows me very well. I saw it online about 3 times, once to hack my home alarm system. My Apple ID was deleted (so no I didn’t know password on device). New unauthorised Apple IDs were created, that were exactly like my former 3rd party email accounts but now created under iCloud. I also received several fake emails purporting to be from Apple. I could no longer view header data.

Several programs were installed, some using “Family Sharing”, and a hidden feature. Others just appeared under purchased programs, those were actually free programs. The categories included remote access (that allows everything including side loaded programs), screen recorders, equivalent key loggers, and worse MDM programs, email manipulation, screen sharing, many more. The hidden apps did not show on my device, but I could see the traffic to the sites. I’d contacted some of the venders and found in some cases a relay account was used to purchase or download these programs, and even received the invoices in some instances. Hopefully, this is not your situation. Reformatting or buying new devices did not help. It sounds like you did a great job fixing everything that happened. So hopefully, along with additional help from MrHoffman, you no longer have issues. And, to add a question, in my case the screen sharing was the result of an unauthorised app, but not the program/hack. In your case, it sounds like Screen Share is a program or feature that compromised your device? Is that the case? I’d never used screen share before, so I was just wondering.

With any device I’d recommend Apples biometrics (Face ID or Finger Print) and a hardware token (search on Apple site) where possible. However, if you have a screen recorder installed, the token I tried displayed an emergency code to unlock, so after the fact, it did not help.

Reply

Answer 3

T3ddy19

Level 1

94 points

Feb 19, 2024 8:13 AM in response to BlueSkyPrinter

One more thing, many printers have a vulnerability that allow access to printed data. Look that one up and apply firmware update if available. Also, search on Lsass vulnerability (which may or may not apply to you, but it requires a manual update). And likely based on your comments, apply a security certificate to your router to prevent clear text transmission of data. Good luck, and special thanks to MrHoffman.

Reply

Screen Sharing hacked - How to be confident the 'hole' is closed...

Similar questions