Beautje

Q: Mavericks or icloud security bug? Has my mac been hacked?

Yesterday I put some music on my ipod and went for a run, leaving the mac on. When came back  the screen of my mac switched on, and with a window open that said home sharing. The screen saver should have made the screen black. Thinking this was strange but maybe not remembering to have opened it, I took a shower. But when I came back to the mac a lot more windows were opened, and shifted to a bottom corner of the screen, and the mouse cursor was moving and even clicked on something. But there was nothing on my desk that could be doing this. Very freaky! So I immediately switched the mac off.

 

Tonight I want to take a look at the mac with the cable modem disconnected, and I've decided to change the computer password first of all. But after that I have no idea where to look for the problem, I'm suspicious of Mavericks and icloud but I'm no expert. Was someone else browsing my mac? And did (s)he get access via wifi, or bluetooth, or some other way? What program or setting enabled this?

 

- mac was upgraded to Mavericks a few days ago

- icloud keychain is enabled for my iphone

- I have time machine running so I can roll back Mountain Lion

- my wifi router is airport express

 

Any idea how this happened, and what I can do to fix it?

MacBook, OS X Mavericks (10.9)

Posted on Jan 9, 2014 12:47 AM

Close

Q: Mavericks or icloud security bug? Has my mac been hacked?

  • All replies
  • Helpful answers

  • by C F McBlob,

    C F McBlob C F McBlob Jan 9, 2014 1:38 AM in response to Beautje
    Level 4 (2,870 points)
    Jan 9, 2014 1:38 AM in response to Beautje

    "and the mouse cursor was moving and even clicked on something"

     

    Someone had connected remotely. I'd call that a "hack" (technically it is), if you have Remote Desktop installed or some other screensharing software (like TeamViewer), someone was using it to gain control of your system.

    If you don't have or use any remote desktiop software, then you need to look at how to lock down your Internet Connection at your router or modem to keep people out of your network.

  • by nbar,

    nbar nbar Jan 9, 2014 1:51 AM in response to C F McBlob
    Level 5 (6,980 points)
    Jan 9, 2014 1:51 AM in response to C F McBlob

    There are many options explaining a moving cursor, the least likely of which is a remote intrusion.

  • by C F McBlob,

    C F McBlob C F McBlob Jan 9, 2014 4:35 AM in response to nbar
    Level 4 (2,870 points)
    Jan 9, 2014 4:35 AM in response to nbar

    And JUST HOW do you "explain away" a self clicking mouse?

     

    I'm probably going to pee myself laughing at that one...

  • by Beautje,

    Beautje Beautje Jan 9, 2014 4:45 AM in response to C F McBlob
    Level 1 (0 points)
    Jan 9, 2014 4:45 AM in response to C F McBlob

    Good to hear I'm not being paranoid

    I think I have remote desktop, but if I do I've never used it. I've never used any such software on this machine.

    My wifi uses WAP2. Our internet provider has decided to share everyone's unused bandwidth with the public, could that be the weak spot?

    I've enabled file sharing to access my music from my macbook.

     

    How can I tell in what way they accessed my mac? I need help to fix this...

  • by thomas_r.,

    thomas_r. thomas_r. Jan 9, 2014 5:01 AM in response to Beautje
    Level 7 (30,944 points)
    Mac OS X
    Jan 9, 2014 5:01 AM in response to Beautje
  • by thomas_r.,

    thomas_r. thomas_r. Jan 9, 2014 5:04 AM in response to C F McBlob
    Level 7 (30,944 points)
    Mac OS X
    Jan 9, 2014 5:04 AM in response to C F McBlob

    And JUST HOW do you "explain away" a self clicking mouse?

     

    It's very common for a hardware issue with a trackpad to cause both random movements and random clicks. If it is clicking constantly, it can look like a purposeful click, since it will click an item that the mouse moves over.

     

    We can't say which of the numerous possible causes for this behavior is the right one without substantially more information, but I've seen seemingly purposeful motions caused by issues other than remote access. We cannot make any assumptions yet, on either side of the remote access fence.

  • by nbar,

    nbar nbar Jan 9, 2014 5:23 AM in response to C F McBlob
    Level 5 (6,980 points)
    Jan 9, 2014 5:23 AM in response to C F McBlob

    Late to reply, I think Mr. Reed pretty much covered that one for you.

  • by Beautje,

    Beautje Beautje Jan 9, 2014 6:28 AM in response to thomas_r.
    Level 1 (0 points)
    Jan 9, 2014 6:28 AM in response to thomas_r.

    That may be the issue here, it's an iMac but I use a bamboo tablet instead of a mouse.

    How can I tell whether this was the problem?

  • by thomas_r.,

    thomas_r. thomas_r. Jan 9, 2014 8:04 AM in response to Beautje
    Level 7 (30,944 points)
    Mac OS X
    Jan 9, 2014 8:04 AM in response to Beautje

    That may be the issue here, it's an iMac but I use a bamboo tablet instead of a mouse.

    How can I tell whether this was the problem?

     

    If the problem recurs, disconnect the tablet and see if the problem stops. You may need to actually uninstall any Bamboo software from your computer, potentially. If it's very sporadic, that may require disconnecting the tablet and uninstalling the software for a period of time to see if it helps.

  • by Linc Davis,

    Linc Davis Linc Davis Jan 9, 2014 10:07 AM in response to Beautje
    Level 10 (208,037 points)
    Applications
    Jan 9, 2014 10:07 AM in response to Beautje

    There are several possible causes for this issue. Take each of the following steps that you haven't already tried until it's resolved. Some may not be applicable.

    1. Follow the instructions in this support article, and also this one, if applicable.

    2. Open the Bluetooth preference pane in System Preferences and check for unknown or forgotten input devices. Disconnect any USB input devices that you aren't using.

    3. Boot in safe mode and test, preferably without launching any third-party applications. If you don't have the problem in safe mode, but it comes back when you reboot as usual, stop here and post your results. If you can't boot in safe mode, do the same. If you booted in safe mode and there was no change, go on to the next step.

    4. Reset the System Management Controller.

    5. If you're using a Bluetooth trackpad, investigate potential sources of interference, including USB 3 devices.

    6. A swollen battery in a portable computer can impinge on the trackpad from below and cause erratic behavior. If you have trouble clicking the trackpad, this is likely the reason. The battery must be replaced without delay.

    7. Press down all four corners of the trackpad at once and release. If there's any effect, it's likely to be temporary, and the unit needs to be serviced or replaced.

    8. There's a report that a (possibly defective) Thunderbolt Ethernet adapter can cause the built-in trackpad of a MacBook to  behave erratically. If you're using such an adapter, disconnect it and test.

    9. There's also a report of erratic cursor movements caused by an external display that was connected but not turned on.

    10. If none of the above applies, or if you have another reason to think that your computer is being remotely controlled, remove it from the network by turning off Wi-Fi (or your Wi-Fi access point), disconnecting from a Bluetooth network link, and unplugging the Ethernet cable or USB modem, whichever is applicable. If the cursor movements stop at once, you should suspect an intrusion.

    11. Make a "Genius" appointment at an Apple Store to have the machine and/or external trackpad tested.

  • by Kingoftypos,

    Kingoftypos Kingoftypos Jan 9, 2014 10:40 AM in response to Beautje
    Level 3 (757 points)
    Jan 9, 2014 10:40 AM in response to Beautje

    Beautje wrote:

     

    Good to hear I'm not being paranoid

    I think I have remote desktop, but if I do I've never used it. I've never used any such software on this machine.

    My wifi uses WAP2. Our internet provider has decided to share everyone's unused bandwidth with the public, could that be the weak spot?

    I've enabled file sharing to access my music from my macbook.

     

    How can I tell in what way they accessed my mac? I need help to fix this...

    You said that you have an Airport Express for your wifi. What is your modem exactly? Is it from your ISP, like Comcast? If so, is it just a modem or does it have wifi built in as well?

     

    If it's a modem/wifi and from your ISP. Then I suggest in buying your own modem. Send the other one back and save the $9 a month they are charging you. I know Comcast, maybe others, are using their equipment to broadcast a separate wifi signal for other people to gain access to. It's supposedly only to the Internet using "guest access". But I personally wouldn't trust it. Which is why I bought my own modem and use an Airport Extreme for my wifi. Besides, I live in an area where there's couple hundred feet between homes.

     

    KOT