New Terminal Results 4 Spyware / Keylogger Detection Review

morning sun wrote:

/Library/Internet Plug-Ins:

SurveillanceClient.plugin

Is this something you installed to view surveillance cameras?

AVG and MacKeeper aren't spying on you, but I doubt that running them is going to serve any useful purpose here.

If there is anything there that could be used to spy on you, it's "NetShade," which routes web traffic through a proxy server controlled by its developer, and can also function as a VPN client. I have no other information about it.

nothing came up via MacScan (other than tracking cookies), AVG AntiVirus (which is supposed to check for spyware), and MacKeeper AntiVirus

All of which are completely useless and should be removed.

do you think I'm safe?

I can't do a forensic analysis of your computer. Apart from what I mentioned, you have no obvious signs of vulnerability.

I've been using NetShade infrequently for several months now. The developer is Rayners Software, LLC which was founded in 2011 and located in San Jose, CA. They have a well stated privacy policy. Servers are located in the US, Canada, UK, France, Czech Republic, Germany and the Netherlands.

It's certainly conceivable that a US based company in Silicon Valley is harvesting and selling privacy information, but unlikely IMHO.

morning sun wrote:

I do have a surveillance camera system around my home yes I did install the app to view the cams from my mac. Could that plug in be spyware? I doubt they would name something that obvious...

I just noted that it is designed to work with almost thirty different surveillance systems so I suppose it could, but since you are the one that installed it I doubt that anybody would be able to adapt it's use to operating you camera and streaming it over your network.

morning sun wrote:

I love how a program designed to keep you private online can end up turning on you it's almost like there is no end to the potential to be spied on...

Even if NetShade is all that they claim, it still only secures you as far as their servers. From that point to your final destination, everything you have not encrypted on your computer is in clear text. But a person would have to know that you are using a specific server and when in order to be able to have any chance of tracing it back to you. VPN / Proxy services such as these are not perfect, but they do serve to protect you against having your local network (public or private) hacked.

MacScan is worthless. See MacScan disappoints.

AVG isn't much good at detecting Mac malware. See Mac anti-virus testing 2014.

MacKeeper is a scam product that is currently the subject of two separate class-action lawsuits.

None of these would be spying on you, but all should be removed.

As to the hacking, there is absolutely nothing that we can do to guarantee that your machine is clean. A Mac security expert with hands-on access to your machine might be able to make that determination... depending on how good he/she is. As Linc says, there's no sign of anything suspicious, but that could just mean something is well-hidden.

Personally, I think it's unlikely that you have actually been hacked. I've seen people overreact to strange problems, blaming them on hacking, countless times. Hacking of your computer to gain remote access would most typically require physical access or your cooperation in the installation of malware. Remote access could also be accomplished through a series of multiple vulnerabilities in how you have configured your computer - for example, if you have some kind of remote access enabled on your machine and have set up port forwarding in your router to make the computer accessible directly over the internet.

If you feel that any of these scenarios are likely, given your knowledge of the situation, then you should wipe the computer clean. See How to reinstall Mac OS X from scratch.

(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

know my webcam was hijacked at one point. I believe it was probably done through a website and not installed malware.

There is no known method for remotely accessing a modern Mac's webcam in this manner. Unless your Mac was one of a few specific models made in 2008 and earlier, which were found to have a webcam vulnerability, or unless you granted permission to a website that asked to access your webcam, it's not known to be possible to do what you say happened. A webcam hack would have to be delivered through malware or physical access to your Mac.

What specifically happened that makes you believe your webcam was accessed?

The most suspicious activity that I HAVE seen actually occur on my MacBook Pro was after coming back to my Mac from dinner and waking my Mac up from sleep there was a dialog box saying that my computer had been booted off the network and another computer had been added to the network

That sounds like a very common IP address conflict message, which occurs when one or more devices on your network are misconfigured. This is not indicative of any kind of hack, just a problem with the setup of your network. Probably, some device on your network is set to have a static IP address on your network, and that address is within the range of addresses reserved by the router to assign to devices that join the network. When your computer woke up, the router tried to assign it an address that should have been free, only to find that something was using it.

I believe I read that Maverick itself has a anti keylogger feature that scrambles all keys entered at the root level of the software to prevent a keylogger program from producing any readable output.

That's not something that I've ever heard of. I think you must have misinterpreted something, perhaps a story about address space layout randomization (ASLR), a security feature that randomizes data storage in RAM. ASLR has been in place in limited fashion in Mac OS X as far back as 10.5 (Leopard), and became system-wide in 10.8 (Mountain Lion). It would not protect you against a keylogger.

Mac OS X also has basic anti-malware protections built in, but that is also not new to Mavericks. See How does Mac OS X protect me?.

(Fair disclosure: The Safe Mac is my site, and contains a Donate button, so I may receive compensation for providing links to The Safe Mac. Donations are not required.)

morning sun wrote:

I can't get into details of the webcam incident but it did happen. I never had any file sharing turned on my Mac at all but my Firewall was turned off on my Mac. I do have a WiFi signal running so that is how I was thinking that my Mac could be accessed to install spyware.

I did find out that my internet access router does have a firewall built in and was set to medium grade protection.

Medium protection is almost certainly as good as it would be to have your Mac Firewall on. Many routers have been found to have backdoors or left set to allow access from the Internet with the default login/password which has been used mostly to redirect users to ad sites, but could potentially allow a firewall to be turned off or other changes. I believe the majority of these vulnerable routers have been identified and firmware updates provided to prevent this, but you'd have to check on yours.

morning sun wrote:

I read that there was anti keylogger protection on Mavericks built in on a designers blog from England...

I have not run across that either, so let us know if you come across a link.

I did a complete overhaul of my Router networks settings with a strong user/pass, the highest firewall protection setting, and wep2 wireless signal protection

Then I would have to agree that there is a finite chance that somebody close by could have gotten into your local network before you did all that. Hacking even the original WPA networks can be done in just a few minutes by a knowledgable hacker with the right tools. But even with your firewall off, you would still have to have some sort of shared access enabled in order for the hacker to have gained access to the computer itself.

morning sun wrote:

Recently my Mail accounts got switched to be associated with the "notepad" app instead of my Mail app in the Mail, Contacts & Calendars System Prefs. There was a new dialog box added that specifies "Use With" then the Mail App icon and Notes App icon show up with a selection box next to them to either select them or not... This is very strange...

I take it this is on some sort of iDevice as there is no such System Preference Pane for the Mac?

On a Mac this sort of thing happens all the time as various apps decide to hijack documents owned by other apps. I've not observed the same thing with my wife's iPad, but can see how it could happen.

As you probably know there is no currently known way to hack an iDevice that hasn't been jailbroken.