Computer was hacked through screensharing. Some questions...

I don't think getting a new IP address will make any difference to this, or is necessary. That's a public IP, and if things are closed up properly on the router, as seems to have been done, no one is getting through. But the idea of changing routers to get a new one is absurd. This can be attempted in several ways: there may be a setting in the router, Release DHCP Lease, which may or may not do it; power cycle the router: turn it off for at least 30 min., and then turn it back on; call or contact the ISP and ask them to do it.

Kingoftypos wrote:

Also get a different router, or modem/router. As installing a different router will most certainly change your public IP Address.

I'm sure there is a way to chage the IP Address on your current router or modem/router. But I have no idea how to do it.

Also, don't use a static public IP Address. Mine hasn't changed in a while and I too have two ports forwarding. I haven't kept my router long enough to see if it changes with in so many months. But I suppose if the IP Address is changed, then I can just simply change a setting on my iPhone.

I would strongly disagree with the above advice.

A port scan of the entire IPv4 address space can be completed in about three minutes given enough bandwidth, either with a sufficiently large network link used by the scanning tools (example) or by the use of a botnet and its massively distributed bandwidth. The 30C3 conference had a 100 gigabit network uplink available to all attendees just last week. You can scan everything with that much bandwidth. Twice. Typical botnets used for scanning for open ports also have bandwidth proportional to their size, and many of those are very large.

Put another way, changing your IP address does nothing to help with security; an open port will get found, and — if you're connected to the net long enough — a weak password will get exploited.

There are nice lists of the five or ten thousand most common passwords these days, and those are common fodder for dictionary attacks on any open ports.

The use of dynamic or static IP addresses are not relevant here. The IPv4 port scanners and the botnets can't reliably make that determination, and don't bother.

The brand of the router also has little to do with the frequency with which the ISP might (or might not) rotate the IP addresses they are assigning via DHCP. Some ISPs will rotate those, and some don't bother.

The general solution here is good passwords or the use of certificates (which are better passwords), fewer or no forwarded ports in normal operations, and VPNs and TLS-protected (encrypted) links when you need connectivity inward.

Probably the only reason I'd swap out firewall gateway here is to upgrade to a model with an integrated VPN server.

I wouldn't greatly suspect txt files & such for infection, it's possible, but not sure why they'd need or want to once they had complete control.

Curious, did they change the delivery address on eBay for the iPhone purchase?

"Ok that's pretty scary. So the only thing to do is beef up the passwords?"

I would also say never ever leave passwords on autofill with anything that allows money to be spent. Amazon is another example.

You must have had paypal password on autofill as even when linked to Ebay you need to log into Paypal with password to pay. Once in, the delivery address on paypal could be changed too.

• Did you wipe the disk and reinstall OS X from distribution, or did you use Migration Assistant without the wipe and install?
• Did you close that forwarded port your NAT device?
• Did you change all of your passwords?
• Is your login short name mayboy?
• Do you have any tools or scripts that start automatically when you log in?  > System Preferences > Users & Groups > Login Items

Any admin user login on your computer.

System Preferences>Sharing make sure everything is turned off. Unfortunately, that setting can't be locked making it possible to change without needing the admin password.

Kingoftypos wrote:

Also get a different router, or modem/router. As installing a different router will most certainly change your public IP Address.

No it will not.

jackm831 wrote:

System Preferences>Sharing make sure everything is turned off. Unfortunately, that setting can't be locked making it possible to change without needing the admin password.

That's incorrect. If the checkbox marked below is checked, Sharing, or anything for that matter, will require an admin password for unlocking.

oh thanks i've never seen that before.