Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: jameso1111
jameso1111 Author
User level: Level 1
0 points

Remote Hack? Disk Permissions RemoteManagement/ARDAgent + Restart of computer + browser wipe/freeze

Hi All, James here again.


First I want to thank you for answering my questions on hacking in the past. I have my own internet connection now. But I am still concerned.


1. At the command line level can someone remote hack into my computer if they know my mac address?

2. I was unable to burn a DVD so I ran disk permissions and saw all of these errors regading Remote management - is this something to be concerned about?.

3. A few times last week all of a sudden my computer simply restarted out of the blue, and also my browser window - it froze, and then like a white screen wiped down (sorry hard to explain) - can a hacker make my computer do this?

4. are there any command line besides arp -a and netstat that can tell me if someone is remotely connecting?


Thanks Guys and Gals,

James


Repairing permissions for “Macintosh HD”

Permissions differ on "Library/Internet Plug-Ins/Flash Player.plugin/Contents/MacOS/Flash Player", should be -rw-rw-r-- , they are -rwxrwxr-x .

Repaired "Library/Internet Plug-Ins/Flash Player.plugin/Contents/MacOS/Flash Player".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_TW.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_TW.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_TW.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_TW.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_TW.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/zh_TW.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/zh_TW.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_CN.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/zh_CN.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_CN.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/zh_CN.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_CN.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/zh_CN.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/zh_CN.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/zh_CN.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/ko.lproj/RemoteDesktopMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/ko.lproj/RemoteDesktopMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/ko.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/ko.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/ko.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/ko.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/ko.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/ko.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Dutch.lproj/RemoteDesktopMenu.nib" , should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Dutch.lproj/RemoteDesktopMenu.nib" .

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Dutch.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Dutch.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Dutch.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Dutch.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Dutch.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Dutch.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Italian.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Italian.lproj/RemoteDesktopMenu.ni b".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Italian.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Italian.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Spanish.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Spanish.lproj/RemoteDesktopMenu.ni b".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Spanish.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Spanish.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Spanish.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Spanish.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Spanish.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Spanish.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/French.lproj/RemoteDesktopMenu.nib ", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/French.lproj/RemoteDesktopMenu.nib ".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/French.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/French.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/French.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/French.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/French.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/French.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/German.lproj/RemoteDesktopMenu.nib ", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/German.lproj/RemoteDesktopMenu.nib ".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/German.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/German.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/German.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/German.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/German.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/German.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Japanese.lproj/RemoteDesktopMenu.n ib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/Japanese.lproj/RemoteDesktopMenu.n ib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Japanese.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Japanese.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Japanese.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/Japanese.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Japanese.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/Japanese.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b".

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.

Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib".

Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/English.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rw-r--r-- .

Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/English.lproj/MainMenu.nib".

Permissions differ on "System/Library/Extensions/AppleUSBEthernetHost.kext/Contents/MacOS/AppleUSBEth ernetHost", should be -rw-r--r-- , they are -rwxr-xr-x .

Repaired "System/Library/Extensions/AppleUSBEthernetHost.kext/Contents/MacOS/AppleUSBEth ernetHost".


Permissions repair complete

MacBook Pro, Mac OS X (10.6.8)

Posted on May 29, 2012 11:34 PM

Reply
Question marked as Best reply
User profile for user: BobHarris
BobHarris
User level: Level 9
53,117 points

Posted on May 30, 2012 6:28 AM

1. At the command line level can someone remote hack into my computer if they know my mac address?

Do you have System Preferences -> Sharing -> Remote Login enabled. If not, then they cannot get to the command line over the network.


If you have Remote Login enabled, then as long as you have a secure password on your account (or accounts if you have created additional accounts), then it is unlikely they will be able to get to your command line.


If your Mac is behind a home router, then unless you have configured your router to let outside connections in (and you would have had to explicitly do this), then knowing your address doesn't help them. And then they still need to know your account(s) password. Heck, then even need to know your account name, as the only default account (root) is disabled for normal logins (unless you have explicitly enabled it).

2. I was unable to burn a DVD so I ran disk permissions and saw all of these errors regading Remote management - is this something to be concerned about?.


It seems permissions repair always finds something to complain about, and has been this way for years. I stopped paying attention to it. Someone else may have a better opinion. Your mileage may vary.


The more important question is were you able to burn your DVD after running repair permissions?


As for remote management, do you have System Preferences -> Sharing -> Remote Management enabled? If so, why, as that tends to be more for managing a class (or office) full of Macs from a central system. Unless you are a Apple Remote Desktop user (but again why as all your questions seem to be related to a single Mac). At best if you access this Mac from another computer system, then maybe have System Preferences -> Sharing -> Screen Sharing enabled. Similar warning on to Remote Login apply to Screen Sharing access. Good passwords, etc... But if you do not remotely connect, then there is no reason to have Screen Sharing nor Remote Login enabled.

3. A few times last week all of a sudden my computer simply restarted out of the blue, and also my browser window - it froze, and then like a white screen wiped down (sorry hard to explain) - can a hacker make my computer do this?


A hacker can do lots of things, but so can failing hardware. I would lean toward a failing Mac and less towards someone getting into your system.


Did you by any chance buy additonal RAM for your Mac and install it yourself (or have it installed)? Failing RAM is a very common cause of unstable Macs. But so can a failing disk, bad or failing USB and/or Firewire devices, a motherboard failing, etc...


You might want to try running the hardware diagnostics. Depending on your Mac model, they may be available on your hard disk or on the original DVD you got with your Mac. Try using the Finder -> Help menu and search for "Hardware Diagnostics". This will most likely lead you to more information specific to your Mac.


You could also take your Mac into an Apple Store genius bar.


4. are there any command line besides arp -a and netstat that can tell me if someone is remotely connecting?


man who


If someone is logged in over the net, it will show the originating node address.

View in context
2 replies
Question marked as Best reply
User profile for user: BobHarris
BobHarris
User level: Level 9
53,117 points

May 30, 2012 6:28 AM in response to jameso1111

1. At the command line level can someone remote hack into my computer if they know my mac address?

Do you have System Preferences -> Sharing -> Remote Login enabled. If not, then they cannot get to the command line over the network.


If you have Remote Login enabled, then as long as you have a secure password on your account (or accounts if you have created additional accounts), then it is unlikely they will be able to get to your command line.


If your Mac is behind a home router, then unless you have configured your router to let outside connections in (and you would have had to explicitly do this), then knowing your address doesn't help them. And then they still need to know your account(s) password. Heck, then even need to know your account name, as the only default account (root) is disabled for normal logins (unless you have explicitly enabled it).

2. I was unable to burn a DVD so I ran disk permissions and saw all of these errors regading Remote management - is this something to be concerned about?.


It seems permissions repair always finds something to complain about, and has been this way for years. I stopped paying attention to it. Someone else may have a better opinion. Your mileage may vary.


The more important question is were you able to burn your DVD after running repair permissions?


As for remote management, do you have System Preferences -> Sharing -> Remote Management enabled? If so, why, as that tends to be more for managing a class (or office) full of Macs from a central system. Unless you are a Apple Remote Desktop user (but again why as all your questions seem to be related to a single Mac). At best if you access this Mac from another computer system, then maybe have System Preferences -> Sharing -> Screen Sharing enabled. Similar warning on to Remote Login apply to Screen Sharing access. Good passwords, etc... But if you do not remotely connect, then there is no reason to have Screen Sharing nor Remote Login enabled.

3. A few times last week all of a sudden my computer simply restarted out of the blue, and also my browser window - it froze, and then like a white screen wiped down (sorry hard to explain) - can a hacker make my computer do this?


A hacker can do lots of things, but so can failing hardware. I would lean toward a failing Mac and less towards someone getting into your system.


Did you by any chance buy additonal RAM for your Mac and install it yourself (or have it installed)? Failing RAM is a very common cause of unstable Macs. But so can a failing disk, bad or failing USB and/or Firewire devices, a motherboard failing, etc...


You might want to try running the hardware diagnostics. Depending on your Mac model, they may be available on your hard disk or on the original DVD you got with your Mac. Try using the Finder -> Help menu and search for "Hardware Diagnostics". This will most likely lead you to more information specific to your Mac.


You could also take your Mac into an Apple Store genius bar.


4. are there any command line besides arp -a and netstat that can tell me if someone is remotely connecting?


man who


If someone is logged in over the net, it will show the originating node address.

Reply
User profile for user: noondaywitch
noondaywitch
User level: Level 6
8,167 points

May 30, 2012 6:47 AM in response to jameso1111

http://support.apple.com/kb/TS1448


Most of those are normal and will be repeated every time you repair permissions. Which is something you seldom need to do.


In addition to Bob's suggestions;


Given the symptoms you describe, you require to Repair Disk, not permissions. That will best be done from the install disc 1.

I'd also be looking at how much free HD space you have left. That will be shown at the bottom of any Finder window as "xx items, XXGBs available"


If that GB figure is below 20GB you are in the zone where problems may start to occur due to shortage of swap space (virtual memory), depending on the amount of RAM installed and what applications (and how many simultaneously) you're running.


I see no evidence of any hack.

Reply

Remote Hack? Disk Permissions RemoteManagement/ARDAgent + Restart of computer + browser wipe/freeze

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up