Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

User profile for user: Naj
Naj Author
User level: Level 1
50 points

I'm affraid I might have been hacked!!!

Wasn't too sure where this should go.

Recently I've been experiencing some strange behaviour on my mac. Maybe I'm being paranoid but I'm quite scared that someone may be accessing my mac and files.

Well my home network has my Mac, a PC with Win xp sp2, Using a belkin wireless modem/router to connect to my broadband line.

The PC is connected to the router physically and I use wireless for my mac. I have windows firewall enabled on the PC and OS X firewall also enabled and running in stealth mode - I do not have UDP blocking enabled, I also have my router's firewall enabled.

I do not have wireless encryption set up on the router but have mac address filtering enabled to allow only my mac and pc to connect to my home network.

I thought that this would be safe enough a setup considering how secure OS X is.

Anyway, my worry springs from 3 things I recently have been playing around with the sharing technologies in OS X mostly FTP and personal file sharing, etc. But I now have them all switched off. these past couple days i've noticed that;

1) My mac would not sleep when inactive according to my power management settings. I repaired permissions and restarted, it seemed to fix it.

2) All my widgets had been turned on, I did not do this.

3) The full keyboard access was enabled, I also did not enable this, and although it is possible that I accidently pressed Fn-ctrl-F7, I really doubt I did.

All this seemed to happen in the one account that I use daily, other accounts seems perfectly fine.

Is it possible that someone has been able to access my mac and change these settings?? I know this is not a huge problem to be worried about but I really am concerned.

The only changes I've made lately to OS X is install the latest security updates.

Please, someone give me an opinion and put my mind at ease!

Thanks

PowerBook G4 12 combo, Mac OS X (10.4.5)

Posted on Mar 27, 2006 4:55 AM

Reply
14 replies
User profile for user: Naj
Naj Author
User level: Level 1
50 points

Mar 27, 2006 10:22 AM in response to macjack

Thanks for the reassurance macJack.

However, how will I know which of the plists are affected??

And is there a way that I can monitor if anyone is trying to hack into my mac in OS X apart from the ipfw log? and if someone does get through, will this be saved in a log of any kind??

Thanks
Reply
User profile for user: macjack
macjack
User level: Level 10
111,168 points

Mar 27, 2006 10:42 AM in response to Naj

how will I know which of the plists are affected??

Only if the preferences don't hold:

Check Preferences Thoroughly;
• Navigate to ~(yourhome/library/ preferences drag this folder to the desktop.
• Restart and test your applications.
• If this works, save the old preferences folder somewhere else or on disk, name it "old prefs" .
** Note: A very important file is the " com.apple.Mail.plist" preference file located in the Preferences folder which contains all email account settings and general mail preferences (hold this one and replace if your problem is not with Mail).
You'll have to go through some of your System Preferences and apps to set the preferences back to how you like them. (Or if you have the time and inclination, "cherry pick" through until you find the problem one or two.)

is there a way that I can monitor if anyone is trying to hack into my mac

Try Little Snitch.

User uploaded file
-mj
macjack@gmail.com
Reply
User profile for user: Naj
Naj Author
User level: Level 1
50 points

Mar 28, 2006 10:42 AM in response to macjack

WOW!

that process would take for ever!!

Well, I have already reset my settings to what they should be, so I take it this would have updated the plists?

I've had a quick browse and the plists that are there look like they should be there - However, I've come accross a few and I have no idea what they're about, i would appreaciate if anyone could tell me what app they may have come from;

1) a plist labeled '(null).plist'

2) a folder called 'opera preferences' I think maybe this is a web browser but I've never downloaded it, i do have firefox, how is this present in my preferences??

3) a plist labeled 'com.MindVision.InstallerVISE.plist'

4) a plist labeled 'com.MyCompany.MoviePlayer.plist'

5) a folder called 'Explorer' with a 'Favorites.html' document. I do not have ms Explorer on my mac.

I think Mind Vision is the VISE installer that many programs use, but not sure.

I have no apps that are called Opera or any Movie Player except VLC.

Spotlighting Opera shows up 'Opera 7 preferences'.

there is also a folder called 'ByHost' which seems to contain apple plists so they don't worry me to much.

Where do these plists come from??
Reply
User profile for user: R C-R
R C-R
User level: Level 6
17,782 points

Mar 28, 2006 11:02 AM in response to Naj

Before worrying about exotic hacks from across the network, is it possible someone has been playing with your account while it is logged in but you are not at the computer? If you don't live alone, unless you log out every time you leave the computer, or set the account to require a password to wake it from sleep or screen saver, someone (a child, perhaps?) could be using it & accidentally (or not) changing around a few things.
Reply
User profile for user: R C-R
R C-R
User level: Level 6
17,782 points

Mar 28, 2006 3:23 PM in response to Naj

FWIW, "(null).plist" & the folder called "ByHost" are normal items present on my Macs, too.

Explorer prefs & some of the others may be left over from a previous 'migration' or importing process when you started using Firefox. (I have all these browsers, so I can't say for sure.)
Reply
User profile for user: E Double
E Double
User level: Level 1
65 points

Mar 29, 2006 8:30 PM in response to Naj

I do not have wireless encryption set up on the
router but have mac address filtering enabled to
allow only my mac and pc to connect to my home
network.

I thought that this would be safe enough a setup
considering how secure OS X is.

Dude. Run, don't walk to this site: http://grc.com/securitynow.htm
Running a wireless network without encryption is like leaving the door open to your home when you're away on holiday. And mac address filtering is the equivalent of locking your door, and then putting the spare key in the flowerpot next to the door-its just a matter of time until someone figures where the key is by eliminating where its not (which is what someone can do with mac addresses-process of elimination, and its not hard to do.) So unless you just want to have an open network so your neighbors can use up your bandwidth (or worse) check out that site. OSX may be more secure than Windows (say a $50 lock vs a $15 lock) but it isn't bulletproof (those recent "security updates" prove that) and a $1000 lock is as useless as an open barn door if you leave the keys in plain sight-which is basically what you're doing now. Good luck.
Reply
User profile for user: Naj
Naj Author
User level: Level 1
50 points

Mar 30, 2006 4:35 AM in response to R C-R

Thanks,

Its very reassuring to know someone else has the same files.

Any ideas about the com.MyCompany.MoviePlayer.plist?? This is just seems comepletely random to be on my mac. The only thing I can think of is maybe when I compiled and ran some of the example applications that you get in delevoper tools. I don't quite remember which one it was but that definately had something to do with video and editing video.

I haven't really experienced any behaviour that actually affects me but it is definately a concern if someone is able to access my mac.

Also, a few months after I bought the mac I discovered a lexmark printer help document in the mac help. Never used or connected to a lexmark before so how did it get on my system!
Reply
User profile for user: R C-R
R C-R
User level: Level 6
17,782 points

Mar 30, 2006 7:38 AM in response to Naj

There is a 'MoviePlayer' java class mentioned in Apple's developer docs, used in conjunction with Quicktime movie display & control. That, along with the "MyCompany" part, which looks like a typical default name for a project, makes me think you are probably on the right track about its origin.

Since you have installed the dev tools, you should have the Property List Editor app. You can use that to examine .plists for clues about their origin & purpose. (Unless you know what you are doing, you shouldn't change any .plist values with it, but just looking can't hurt.) You can also look at creation & modification dates & "kind" info with the Get Info Finder function, which should yield more clues.

Tiger installs lots of printer support files by default, over a GB in fact. If you poke around, you should see lots of Epson, Lexmark, HP, etc. printer files. This is the main reason so many printers are 'plug & play' & is nothing to worry about.

Overall, I don't think there is any compelling evidence that you have been hacked, at least from any of the files you have mentioned.
Reply

I'm affraid I might have been hacked!!!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.
Learn more Sign up