Someone seems to have hacked into my MacBook Pro.

While I was working at home a few days ago, I noticed my mouse moving erratically and then a message in the background said "disconnected". Apparently, someone was able to remotely connect to my MacBook Pro. I don't know who it was but definitely not anyone from my household as I confirmed that no one was using any computers at the time. I'm guessing it was one of the neighbours. I do see 2 Macs when I'm very concerned that someone can do this. After this incident, I searched online for how to secure my Mac and then disabled my guest account in addition to ensuring that sharing wasn't on (which it wasn't). How do I ensure that no one can access my MacBook and that I am safe from hackers, etc.? Is there a quick way to check if there is anyone currently connected to my MacBook?


By the way, I'm a very recent Mac convert (2 weeks) using a MacBook Pro with the free OS X Lion upgrade. I really want to have a good experience using my new Mac, but I will admit that this recent incident scares me. Hope that someone can allay my fears...

MacBook Pro, Mac OS X (10.7)

Posted on Jul 31, 2011 4:34 AM

Reply
4 replies

Jul 31, 2011 5:31 AM in response to SEO Guy

This sort of thing is virtually impossible to do unless you (or someone else with physical access to the machine) have set up some kind of remote screen sharing. If you're on a wireless router, that makes it doubly difficult... the wireless router acts as a kind of barrier for incoming connections. Nobody can target your machine unless they're on the same wireless network or there's software on the machine (like LogMeIn) that allows the remote connection.


So, make sure your wireless network has a good password, make sure everything in System Preferences -> Sharing is either off or protected with a strong password, and make sure you don't have software like LogMeIn installed. If you've got screen sharing turned on for a good reason, and it's protected with a good password, but you also have MobileMe, change that password. If anyone untrusted has had unmonitored access to the machine, you need to go over it with a fine-toothed comb and remove any software that didn't come with the machine and you didn't install.


The one exception to everything I said above is malware. However, malware that installs backdoors is pretty rare on the Mac. (See my Mac Virus Guide.*) Even then, those backdoors are things that can be used through automation, not for screen sharing. Malware creators don't have any interest in hacking one machine at a time, they're writing malware so they can automate hacking of many machines. I won't say this is impossible, but it's extremely unlikely.


* Disclaimer: links to my pages may give me compensation, and should not be taken as endorsement of my services by Apple.

Jul 31, 2011 10:35 AM in response to thomas_r.

Thanks for your response Thomas. Much appreciated. I realize it might be virtually impossible for someone to hack into my machine, but I know what I saw. In fact, it happened twice where someone had control of my mouse and was playing on the screen. The good thing is that they didn't stay long and seemed to disconnect fairly quickly. No damage was done, but it is scary to know that someone was able to gain access.


By the way, I do have a wireless router that is supplied by my Service Provider (Bell Canada), but it uses WEP security and does have a password. I have also ensured that all sharing is turned off.


Is there a way to check if anyone is currently logged into my Mac?


Thanks in advance for your reply


Regards,

SEO Guy

Jul 31, 2011 12:36 PM in response to SEO Guy

I realize it might be virtually impossible for someone to hack into my machine, but I know what I saw.


I wasn't implying that you were incorrect about what you saw, I was giving you a way to focus your energies... it's virtually impossible "unless you (or someone else with physical access to the machine) have set up some kind of remote screen sharing." You have to figure out how that happened. If all sharing services were off at the time, that leaves third-party software installed either by you or someone else. Some companies offer this as a "service" for tech support, which I don't trust... have you given such a company access? Has anyone untrusted had access to the machine? You say you confirmed it wasn't someone in your house, but are you sure of that?


I've seen people steadfastly claim to have seen this sort of thing with everything off in sharing, and who were absolutely, 100% certain that nobody in their house was doing it, absolutely, 100% certain that nobody untrusted had access to the machine and absolutely, 100% certain that they hadn't given access to someone. The problem is, those folks are guaranteed to be absolutely, 100% wrong about one of those things. Don't get yourself hung up on this because you're making assumptions that may not be correct.


If you can't be sure that someone hasn't gotten to your Mac and installed some software to give themselves a back door, you should probably get a copy of Little Snitch. That will prevent applications on your machine from sending data out over the network unless you approve it. You'll have to learn a whole bunch about which applications are normal parts of your Mac's system and make connections all the time, but in the process you should shake out any possible culprit. Just make sure you don't approve any connection attempt until you verify that it is to be expected.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Someone seems to have hacked into my MacBook Pro.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.