Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How bad was I hacked?

My computer began taking up to 5 minutes to get passed the pin wheel before it would get to the log in screen. After a couple months I deleted a couple gigabytes of information. After turning the computer off when I turned it back on I did not have internet access the screen was stuck at the pin wheel. I took it to the apple store and they swiped it clean. They told me there was a lot of corruption. I think a very knowledgable "friend" hacked it from the computer itself. Is there any possibility that this computer is still hacked even though the hard drive was wiped clean?

MacBook Pro, Mac OS X (10.7.5), it may have been 10.7.3 before

Posted on Jun 16, 2013 8:56 PM

Reply
Question marked as Best reply

Posted on Jun 16, 2013 9:06 PM

Ignorant Apple user wrote:


Is there any possibility that this computer is still hacked even though the hard drive was wiped clean?


Yes if Apple didn't also wipe the hidden EFI partition and the hacker got into there.


EFI is worst than root. At least with root you can tell what's going on, not in EFI. The machine could be recording all your keystrokes and sending it out over the Internet and you wouldn't know without a sniffer on the network.


OS X or any program installed in OS X wouldn't know as both are too low on the chain. EFI is right next to the hardware.

https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface



Yes if the hacker managed to install malware in the keyboard or battery firmware but it's unlikely to escape or do anything as that firmware can't hold or do a lot, expect blow up your battery perhaps, which I think in later Mac versions Apple prevented that from occurring with some sort of hardware preventative thing.

10 replies
Question marked as Best reply

Jun 16, 2013 9:06 PM in response to Ignorant Apple user

Ignorant Apple user wrote:


Is there any possibility that this computer is still hacked even though the hard drive was wiped clean?


Yes if Apple didn't also wipe the hidden EFI partition and the hacker got into there.


EFI is worst than root. At least with root you can tell what's going on, not in EFI. The machine could be recording all your keystrokes and sending it out over the Internet and you wouldn't know without a sniffer on the network.


OS X or any program installed in OS X wouldn't know as both are too low on the chain. EFI is right next to the hardware.

https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface



Yes if the hacker managed to install malware in the keyboard or battery firmware but it's unlikely to escape or do anything as that firmware can't hold or do a lot, expect blow up your battery perhaps, which I think in later Mac versions Apple prevented that from occurring with some sort of hardware preventative thing.

Jun 16, 2013 9:47 PM in response to Ignorant Apple user

Is there any possibility that this computer is still hacked even though the hard drive was wiped clean?


If your still getting "pinwheels" then take it back to the Apple store and have them replace the drive this time.


More likely what occured is damage to the sectors via shock or a defective drive which corrupted the data.


Or it was restored from a corrupted TimeMachine backup or like bootable clone.

Jun 16, 2013 10:11 PM in response to Ignorant Apple user

Ignorant Apple user wrote:


is it possible to hack a computer so that after the hard drive is completely swiped


Not if it's completely wiped it shouldn't be, this includes the hidden partitions of EFI and RecoveryHD, along with the MacintoshHD partition which contains OS X, files and programs.


If the Apple Store people used the RecoveryHD partition to wipe and restore, then they can't erase the entire drive from there as they are booted from one of the partitions, thus can only erase the MacintoshHD partition (and Bootcamp if it was enabled.)


The hidden EFI partition can only be erased via a external botoable medium or via Internet Recovery which resides in memory (RAM)


If the Apple Store people used Internet Recovery, then yes it was possible they wiped the entire drive, however they also could have only done the MacintoshHD parittion only.


If you really want the drive wiped, you have to get a new boot drive as it's blank of everything.


Then in order to format it, the hidden EFI and RecoveryHD partitions are created along with the MacintoshHD partition that contains OS X, programs and files.


Erase, formatting, OS X installs on Mac's

Jun 16, 2013 10:10 PM in response to Ignorant Apple user

Ignorant Apple user wrote:


But my computer takes like 30 seconds to get past the pin wheel, which doesn't seem out of the norm.


Then you have a problem with your network, the boot drive or the machine and you should take it back again.



One should never see the pinwheel, it's a sign that something is wrong and the machine is waiting needlessly.

Jun 17, 2013 4:48 AM in response to Ignorant Apple user

Please don't let ds store scare you. There's no indication whatsoever that you have been hacked, and ds store's mention of the possibility of a hacker installing malware in your computer's firmware (or keyboard or battery firmware) is not realistic.


From the sounds of it, your hard drive and system had become badly corrupt, which can cause all manner of problems. If you had a lot of crashes, or otherwise frequently force-rebooted your computer, that could cause such problems. However, if that's all there was to it, your problems would be gone after wiping the machine clean and reinstalling. Since you're still seeing "pinwheels," that means you have another problem. Perhaps your hard drive is dying, or perhaps you have installed the same bad third-party software that was responsible for causing the original problems in the first place.


If there is some specific action that you can do that always causes the cursor to spin, try restarting in safe mode (hold down the shift key at startup, beginning when you hear the chime and letting go when the Apple logo appears). It will take longer than normal to start up, but will disable all your third-party software that loads at startup. If you test that action in safe mode and have no problem, but the problem comes back as soon as you reboot normally, then the issue is third-party software. The trick will be finding out what.

How bad was I hacked?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.