Have I been hacked? Netstat

Question

Level 1

4 points

Have I been hacked? Netstat

Hello,

I was attacked via a phishing email and had passwords stolen to several of my websites. I ran netstat to see what was happening with incoming and outgoing connections. Does any of this look suspicious?

dhcp-164-107-230-209:~ michaelvieth$ netstat

Active Internet connections

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp4 0 0 dhcp-164-107-230.50847 a23-60-83-69.dep.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50837 cache.google.com.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50836 ord08s12-in-f10..https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50834 199.16.156.52.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50832 ord08s12-in-f10..https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50830 ord30s21-in-f13..https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50829 ie-in-f154.1e100.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50820 cache.google.com.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50808 ord30s21-in-f2.1.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50806 ord31s22-in-f4.1.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.50804 cache.google.com.https ESTABLISHED

tcp4 0 0 dhcp-164-107-230.49164 17.110.225.201.5223 ESTABLISHED

udp4 0 0 *.* *.*

udp4 0 0 *.62054 *.*

udp4 0 0 dhcp-164-107-230.ntp *.*

udp4 0 0 dhcp-164-107-230.ipsec *.*

udp4 0 0 dhcp-164-107-230.isakm *.*

udp6 0 0 fdbd:9aab:3772:c.ipsec *.*

udp6 0 0 fdbd:9aab:3772:c.isakm *.*

udp6 0 0 fdbd:9aab:3772:c.ntp *.*

udp6 0 0 fe80::511a:c93e:.ntp *.*

udp6 0 0 localhost.ipsec-ms *.*

udp6 0 0 localhost.isakmp *.*

udp4 0 0 localhost.ipsec-msft *.*

udp4 0 0 localhost.isakmp *.*

udp6 0 0 fe80::1%lo0.ipsec-ms *.*

udp6 0 0 fe80::1%lo0.isakmp *.*

udp6 0 0 fe80::5626:96ff:.ipsec *.*

udp6 0 0 fe80::5626:96ff:.isakm *.*

udp6 0 0 fe80::6cd6:dbff:.ipsec *.*

udp6 0 0 fe80::6cd6:dbff:.isakm *.*

udp6 0 0 fe80::511a:c93e:.ipsec *.*

udp6 0 0 fe80::511a:c93e:.isakm *.*

udp6 0 0 *.mdns *.*

udp4 0 0 *.mdns *.*

udp6 0 0 fe80::5626:96ff:.ntp *.*

udp4 0 0 *.* *.*

udp6 0 0 fe80::6cd6:dbff:.ntp *.*

udp6 0 0 fe80::1%lo0.ntp *.*

udp4 0 0 localhost.ntp *.*

udp6 0 0 localhost.ntp *.*

udp6 0 0 *.ntp *.*

udp4 0 0 *.ntp *.*

udp4 0 0 *.* *.*

udp4 0 0 all-systems.mcas.5350 *.*

udp4 0 0 *.* *.*

udp6 0 0 *.mdns *.*

udp4 0 0 *.* *.*

udp6 0 0 *.mdns *.*

udp4 0 0 *.mdns *.*

udp4 0 0 *.* *.*

udp46 0 0 *.* *.*

udp4 0 0 *.* *.*

udp46 0 0 *.* *.*

udp4 0 0 *.* *.*

udp4 0 0 *.netbios-ns *.*

udp4 0 0 *.netbios-dgm *.*

Active Multipath Internet connections

Proto/ID Flags Local Address Foreign Address (state)

icm6 0 0 *.* *.*

Active LOCAL (UNIX) domain sockets

Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr

f3af90fc06115d25 stream 0 0 0 f3af90fc0611548d 0 0 /var/run/mDNSResponder

f3af90fc0611548d stream 0 0 0 f3af90fc06115d25 0 0

f3af90fc061157ad stream 0 0 0 f3af90fc04cc3acd 0 0 /var/run/mDNSResponder

f3af90fc04cc3acd stream 0 0 0 f3af90fc061157ad 0 0

f3af90fc06115acd stream 0 0 0 f3af90fc060febfd 0 0 /var/run/mDNSResponder

f3af90fc060febfd stream 0 0 0 f3af90fc06115acd 0 0

f3af90fc04cc3ded stream 0 0 0 f3af90fc0613fcc5 0 0 /var/run/mDNSResponder

f3af90fc0613fcc5 stream 0 0 0 f3af90fc04cc3ded 0 0

f3af90fc04cc4fe5 stream 0 0 0 f3af90fc04cc4e55 0 0 /var/run/mDNSResponder

f3af90fc04cc4e55 stream 0 0 0 f3af90fc04cc4fe5 0 0

f3af90fc01392c5d stream 0 0 0 f3af90fc060e867d 0 0 /var/run/mDNSResponder

f3af90fc060e867d stream 0 0 0 f3af90fc01392c5d 0 0

f3af90fc0613f365 stream 0 0 0 f3af90fc060e8d85 0 0 /var/run/mDNSResponder

f3af90fc060e8d85 stream 0 0 0 f3af90fc0613f365 0 0

f3af90fc04cc2bf5 stream 0 0 0 f3af90fc04cc30a5 0 0 /var/run/mDNSResponder

f3af90fc04cc30a5 stream 0 0 0 f3af90fc04cc2bf5 0 0

f3af90fc060feb35 stream 0 0 0 f3af90fc06115555 0 0 /var/run/mDNSResponder

f3af90fc06115555 stream 0 0 0 f3af90fc060feb35 0 0

f3af90fc04cc474d stream 0 0 0 f3af90fc04cc2105 0 0 /var/run/mDNSResponder

f3af90fc04cc2105 stream 0 0 0 f3af90fc04cc474d 0 0

f3af90fc0613ffe5 stream 0 0 f3af90fc0719b3d5 0 0 0 /Users/michaelvieth/Library/Group Containers/gdrive/tmpGCO86B

f3af90fc06114fdd stream 0 0 0 f3af90fc06115235 0 0 /var/run/usbmuxd

f3af90fc06115235 stream 0 0 0 f3af90fc06114fdd 0 0

f3af90fc04cc3f7d stream 0 0 0 f3af90fc04cc4045 0 0 /var/run/mDNSResponder

f3af90fc04cc4045 stream 0 0 0 f3af90fc04cc3f7d 0 0

f3af90fc04cc41d5 stream 0 0 0 f3af90fc04cc410d 0 0 /var/run/mDNSResponder

f3af90fc04cc410d stream 0 0 0 f3af90fc04cc41d5 0 0

f3af90fc04cc429d stream 0 0 0 f3af90fc01392d25 0 0 /var/run/mDNSResponder

f3af90fc01392d25 stream 0 0 0 f3af90fc04cc429d 0 0

f3af90fc04cc4bfd stream 0 0 f3af90fc04d2f885 0 0 0 /var/folders/1f/w1ck_fqx65d2dhg78tsx6y6r0000gn/T/icssuis501

f3af90fc01391105 stream 0 0 0 f3af90fc013911cd 0 0

f3af90fc013911cd stream 0 0 0 f3af90fc01391105 0 0

f3af90fc013920a5 stream 0 0 0 f3af90fc01391fdd 0 0 /var/run/mDNSResponder

f3af90fc01391fdd stream 0 0 0 f3af90fc013920a5 0 0

f3af90fc01391bf5 stream 0 0 0 f3af90fc01391d85 0 0 /var/run/mDNSResponder

f3af90fc01391d85 stream 0 0 0 f3af90fc01391bf5 0 0

f3af90fc01391b2d stream 0 0 0 f3af90fc01391cbd 0 0 /var/run/mDNSResponder

f3af90fc01391cbd stream 0 0 0 f3af90fc01391b2d 0 0

f3af90fc0139199d stream 0 0 0 f3af90fc01391a65 0 0 /var/run/mDNSResponder

f3af90fc01391a65 stream 0 0 0 f3af90fc0139199d 0 0

f3af90fc0139180d stream 0 0 0 f3af90fc01391745 0 0 /var/run/mDNSResponder

f3af90fc01391745 stream 0 0 0 f3af90fc0139180d 0 0

f3af90fc0139135d stream 0 0 f3af90fc03bbd6a5 0 0 0 /private/tmp/com.apple.launchd.ObqKYE2jcu/Listeners

f3af90fc01391295 stream 0 0 f3af90fc03bbd885 0 0 0 /private/tmp/com.apple.launchd.Cg8VYT50uA/Render

f3af90fc01391425 stream 0 0 f3af90fc03bbda65 0 0 0 /var/tmp/filesystemui.socket

f3af90fc0139216d stream 0 0 0 f3af90fc01392235 0 0 /var/run/mDNSResponder

f3af90fc01392235 stream 0 0 0 f3af90fc0139216d 0 0

f3af90fc0139248d stream 0 0 0 f3af90fc01392555 0 0 /var/run/mDNSResponder

f3af90fc01392555 stream 0 0 0 f3af90fc0139248d 0 0

f3af90fc013931d5 stream 0 0 f3af90fc02216885 0 0 0 /var/run/pppconfd

f3af90fc0139342d stream 0 0 f3af90fc0168de25 0 0 0 /private/var/run/cupsd

f3af90fc013934f5 stream 0 0 f3af90fc0162e4c5 0 0 0 /var/run/usbmuxd

f3af90fc013935bd stream 0 0 f3af90fc016123d5 0 0 0 /var/run/systemkeychaincheck.socket

f3af90fc01393685 stream 0 0 f3af90fc015eb1f5 0 0 0 /var/run/portmap.socket

f3af90fc0139374d stream 0 0 f3af90fc015eb795 0 0 0 /var/run/vpncontrol.sock

f3af90fc01393815 stream 0 0 f3af90fc015ae975 0 0 0 /var/rpc/ncacn_np/wkssvc

f3af90fc013938dd stream 0 0 f3af90fc015aec45 0 0 0 /var/rpc/ncalrpc/wkssvc

f3af90fc013939a5 stream 0 0 f3af90fc015aef15 0 0 0 /var/rpc/ncacn_np/srvsvc

f3af90fc01393a6d stream 0 0 f3af90fc0159f105 0 0 0 /var/rpc/ncalrpc/srvsvc

f3af90fc01393b35 stream 0 0 f3af90fc0159f3d5 0 0 0 /var/rpc/ncalrpc/NETLOGON

f3af90fc01393bfd stream 0 0 f3af90fc0159f5b5 0 0 0 /var/rpc/ncacn_np/mdssvc

f3af90fc01393cc5 stream 0 0 f3af90fc0159f6a5 0 0 0 /var/rpc/ncacn_np/lsarpc

f3af90fc01393d8d stream 0 0 f3af90fc0159fb55 0 0 0 /var/rpc/ncalrpc/lsarpc

f3af90fc01393e55 stream 0 0 f3af90fc015215b5 0 0 0 /var/run/mDNSResponder

f3af90fc06115b95 dgram 0 0 0 f3af90fc060e8425 f3af90fc060e8425 0

f3af90fc060e8425 dgram 0 0 0 f3af90fc06115b95 f3af90fc06115b95 0

f3af90fc06115f7d dgram 0 0 0 f3af90fc06114cbd f3af90fc06114cbd 0

f3af90fc06114cbd dgram 0 0 0 f3af90fc06115f7d f3af90fc06115f7d 0

f3af90fc06114425 dgram 0 0 0 f3af90fc06114295 f3af90fc06114295 0

f3af90fc06114295 dgram 0 0 0 f3af90fc06114425 f3af90fc06114425 0

f3af90fc0613f8dd dgram 0 0 0 f3af90fc060fefe5 f3af90fc060fefe5 0

f3af90fc060fefe5 dgram 0 0 0 f3af90fc0613f8dd f3af90fc0613f8dd 0

f3af90fc04cc2fdd dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc060e8f15

f3af90fc04cc4f1d dgram 0 0 0 f3af90fc060e8fdd f3af90fc060e8fdd 0

f3af90fc060e8fdd dgram 0 0 0 f3af90fc04cc4f1d f3af90fc04cc4f1d 0

f3af90fc060e8f15 dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc0613fe55

f3af90fc0611593d dgram 0 0 0 f3af90fc0613fa6d f3af90fc0613fa6d 0

f3af90fc0613fa6d dgram 0 0 0 f3af90fc0611593d f3af90fc0611593d 0

f3af90fc06115875 dgram 0 0 0 f3af90fc04cc4815 f3af90fc04cc4815 0

f3af90fc04cc4815 dgram 0 0 0 f3af90fc06115875 f3af90fc06115875 0

f3af90fc0613ff1d dgram 0 0 0 f3af90fc0613fd8d f3af90fc0613fd8d 0

f3af90fc0613fd8d dgram 0 0 0 f3af90fc0613ff1d f3af90fc0613ff1d 0

f3af90fc061144ed dgram 0 0 0 f3af90fc06114d85 f3af90fc06114d85 0

f3af90fc06114d85 dgram 0 0 0 f3af90fc061144ed f3af90fc061144ed 0

f3af90fc04cc4685 dgram 0 0 0 f3af90fc061153c5 f3af90fc061153c5 0

f3af90fc061153c5 dgram 0 0 0 f3af90fc04cc4685 f3af90fc04cc4685 0

f3af90fc061152fd dgram 0 0 0 f3af90fc04cc44f5 f3af90fc04cc44f5 0

f3af90fc04cc44f5 dgram 0 0 0 f3af90fc061152fd f3af90fc061152fd 0

f3af90fc04cc442d dgram 0 0 0 f3af90fc04cc4365 f3af90fc04cc4365 0

f3af90fc04cc4365 dgram 0 0 0 f3af90fc04cc442d f3af90fc04cc442d 0

f3af90fc01392b95 dgram 0 0 0 f3af90fc01392acd f3af90fc01392acd 0

f3af90fc01392acd dgram 0 0 0 f3af90fc01392b95 f3af90fc01392b95 0

f3af90fc060fe29d dgram 0 0 0 f3af90fc04cc45bd f3af90fc04cc45bd 0

f3af90fc04cc45bd dgram 0 0 0 f3af90fc060fe29d f3af90fc060fe29d 0

f3af90fc0611561d dgram 0 0 0 f3af90fc061150a5 f3af90fc061150a5 0

f3af90fc061150a5 dgram 0 0 0 f3af90fc0611561d f3af90fc0611561d 0

f3af90fc0613fe55 dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc04cc3a05

f3af90fc04cc3a05 dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc04cc4cc5

f3af90fc04cc4cc5 dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc01391f15

f3af90fc01391f15 dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc01392f7d

f3af90fc013915b5 dgram 0 0 0 f3af90fc0139167d f3af90fc0139167d 0

f3af90fc0139167d dgram 0 0 0 f3af90fc013915b5 f3af90fc013915b5 0

f3af90fc013914ed dgram 0 0 0 f3af90fc013918d5 f3af90fc013918d5 0

f3af90fc013918d5 dgram 0 0 0 f3af90fc013914ed f3af90fc013914ed 0

f3af90fc013922fd dgram 0 0 0 f3af90fc013923c5 f3af90fc013923c5 0

f3af90fc013923c5 dgram 0 0 0 f3af90fc013922fd f3af90fc013922fd 0

f3af90fc0139261d dgram 0 0 0 f3af90fc013926e5 f3af90fc013926e5 0

f3af90fc013926e5 dgram 0 0 0 f3af90fc0139261d f3af90fc0139261d 0

f3af90fc013927ad dgram 0 0 0 f3af90fc01392875 f3af90fc01392875 0

f3af90fc01392875 dgram 0 0 0 f3af90fc013927ad f3af90fc013927ad 0

f3af90fc0139293d dgram 0 0 0 f3af90fc01392a05 f3af90fc01392a05 0

f3af90fc01392a05 dgram 0 0 0 f3af90fc0139293d f3af90fc0139293d 0

f3af90fc01392ded dgram 0 0 0 f3af90fc01392eb5 f3af90fc01392eb5 0

f3af90fc01392eb5 dgram 0 0 0 f3af90fc01392ded f3af90fc01392ded 0

f3af90fc01392f7d dgram 0 0 0 f3af90fc01393fe5 0 f3af90fc01393f1d

f3af90fc01393045 dgram 0 0 0 f3af90fc0139310d f3af90fc0139310d 0

f3af90fc0139310d dgram 0 0 0 f3af90fc01393045 f3af90fc01393045 0

f3af90fc0139329d dgram 0 0 0 f3af90fc01393365 f3af90fc01393365 0

f3af90fc01393365 dgram 0 0 0 f3af90fc0139329d f3af90fc0139329d 0

f3af90fc01393f1d dgram 0 0 0 f3af90fc01393fe5 0 0

f3af90fc01393fe5 dgram 0 0 f3af90fc0137f1f5 0 f3af90fc04cc2fdd 0 /private//var/run/syslog

Registered kernel control modules

id flags pcbcount rcvbuf sndbuf name

1 9 0 131072 8192 com.apple.flow-divert

2 1 1 16384 2048 com.apple.nke.sockwall

3 9 0 524288 524288 com.apple.content-filter

4 9 0 8192 2048 com.apple.packet-mangler

5 1 2 65536 65536 com.apple.net.necp_control

6 9 1 524288 524288 com.apple.net.utun_control

7 1 0 65536 65536 com.apple.net.ipsec_control

8 0 13 8192 2048 com.apple.netsrc

9 18 0 8192 2048 com.apple.network.statistics

a 5 0 8192 2048 com.apple.network.tcp_ccdebug

Active kernel event sockets

Proto Recv-Q Send-Q vendor class subcla

kevt 0 0 1 1 2

kevt 0 0 1 6 1

kevt 0 0 1 1 1

kevt 0 0 1 1 10

kevt 0 0 1001 5 11

kevt 0 0 1 1 2

kevt 0 0 1 6 1

kevt 0 0 1 1 2

kevt 0 0 1 6 1

kevt 0 0 1 1 0

Active kernel control sockets

Proto Recv-Q Send-Q unit id name

kctl 0 0 1 2 com.apple.nke.sockwall

kctl 0 0 1 5 com.apple.net.necp_control

kctl 0 0 2 5 com.apple.net.necp_control

kctl 0 0 1 6 com.apple.net.utun_control

kctl 0 0 1 8 com.apple.netsrc

kctl 0 0 2 8 com.apple.netsrc

kctl 0 0 3 8 com.apple.netsrc

kctl 0 0 4 8 com.apple.netsrc

kctl 0 0 5 8 com.apple.netsrc

kctl 0 0 6 8 com.apple.netsrc

kctl 0 0 7 8 com.apple.netsrc

kctl 0 0 8 8 com.apple.netsrc

kctl 0 0 10 8 com.apple.netsrc

kctl 0 0 11 8 com.apple.netsrc

kctl 0 0 12 8 com.apple.netsrc

kctl 0 0 13 8 com.apple.netsrc

kctl 0 0 20 8 com.apple.netsrc

dhcp-164-107-230-209:~ michaelvieth$

Thanks in advance!!

MacBook Pro, OS X Yosemite (10.10.1)

Posted on Feb 22, 2015 4:08 PM

Reply

Answer 1

Oct 25, 2017 2:41 PM in response to aviolas

This thread is quite old.

Unfortunately, knowing that Apple has been issued the IPv4 address block known as 17/8 (the addresses from 17.0.0.1 to 17.255.255.254) will not indicate whether any particular network connections are legitimate, as Apple and other providers routinely use other IP address blocks and Apple and other providers also commonly use content delivery networks — web and file caching services and other such — in other IPv4 address ranges. More than a few network connections now use IPv6 and not IPv4, too. These connections are both for Apple's services and apps, as well as server-related connections for other services and other apps that might be legitimately present on the computer.

With a computer that's associated with a particular organization such as is this case, the folks that are responsible for the system and network security for that organization are usually the best contacts for further assistance, as they're both familiar with tracing connections — though that necessity is pretty rare — and are also usually familiar with the particular risks and vulnerabilities and requirements. These can be very specific to the individuals and to the particular organization involved. Best to contact the organization's security folks directly for assistance on an actual or suspected breach, whether due to social engineering or otherwise.

Please also see the previous discussions and links in the thread on system security and system hardening, as well.

Reply

Answer 2

aviolas

Level 1

9 points

Oct 25, 2017 1:27 PM in response to GreenMamba

If you are chasing down internet connections, then do this:

Applications>Utilities>Terminal

your window will open with something like this:

Last login: Wed Oct 25 12:02:45 on ttys000

Restored session: Wed Oct 25 12:06:44 AKDT 2017

computername:~ username$

that last line- 'computername:~ username$'

is your command prompt. so if your name is bob, and your computer is named Sponge, it will read something like:

Sponge:~ bob$

at the $ type the whois command and the IP address you're suspicious of, like this:

Sponge:~ bob$whois 17.248.185.69

and hit enter. you'll get:

#

# ARIN WHOIS data and services are subject to the Terms of Use

# available at: https://www.arin.net/whois_tou.html

#

# If you see inaccuracies in the results, please report at

# https://www.arin.net/public/whoisinaccuracy/index.xhtml

#

# Query terms are ambiguous. The query is assumed to be:

# "n 17.146.232.38"

#

# Use "?" to get help.

#

# The following results may also be obtained via:

# https://whois.arin.net/rest/nets;q=17.146.232.38?showDetails=true&showARIN=false &showNonArinTopLevelNet=false&ext=netref2

#

NetRange: 17.0.0.0 - 17.255.255.255

CIDR: 17.0.0.0/8

NetName: APPLE-WWNET

NetHandle: NET-17-0-0-0-1

Parent: ()

NetType: Direct Assignment

OriginAS:

Organization: Apple Inc. (APPLEC-1-Z)

RegDate: 1990-04-16

Updated: 2017-07-08

Ref: https://whois.arin.net/rest/net/NET-17-0-0-0-1

OrgName: Apple Inc.

OrgId: APPLEC-1-Z

Address: 20400 Stevens Creek Blvd., City Center Bldg 3

City: Cupertino

StateProv: CA

PostalCode: 95014

Country: US

RegDate: 2009-12-14

Updated: 2017-07-08

Ref: https://whois.arin.net/rest/org/APPLEC-1-Z

OrgTechHandle: ZA42-ARIN

OrgTechName: Apple Computer Inc

OrgTechPhone: +1-408-974-7777

OrgTechEmail: Apple-NOC@apple.com

OrgTechRef: https://whois.arin.net/rest/poc/ZA42-ARIN

OrgAbuseHandle: APPLE11-ARIN

OrgAbuseName: Apple Abuse

OrgAbusePhone: +1-408-974-7777

OrgAbuseEmail: abuse@apple.com

OrgAbuseRef: https://whois.arin.net/rest/poc/APPLE11-ARIN

That's who your computer is connecting to.

Hey, guess what? you're using a mac, and that's a registered Apple server. Huh. go figure. AND SO ON.

You can waste a lot of hours with this. but if all the IP's fall within the range noted:

NetRange: 17.0.0.0 - 17.255.255.255

in this particular case, and you have lots of IP's going to a number in between those two values, then it's probably ALLLL Apple....

have fun. Make some fresh coffee first, you can be at that stuff for days. Anybody who's a decent hacker can figure out a way around it. all you can do is have good practices, use passwords, secure login ins, etc.

Reply

Answer 3

Oct 18, 2016 7:29 AM in response to GreenMamba

That netstat shows two dangling IPv4 TCP connections. To a web server, based on what's shown. Those are harmless, will eventually time out and self-resolve, or will clear after the next reboot. The only similar site I can see on the 'net is a UK site, and what I'd assume is a display-formatting artifact in the domain name displayed from the netstat command — if you widen your terminal window and re-issue the command, you'll get the full domain with a trailing http to indicate the network protocol used. Either you've connected to that site, or some software that's been configured or installed has connected, or attempted to connect.

If you want to change what you've reported in the other reply — the models and details of internal devices and such — you'll need to swap the Mac. Google Chrome data is whatever has been downloaded, and a disk wipe and reinstall will require that to be re-downloaded. If you want to change the Google chrome data, you'll have to install a different version of Google Chrome or switch to and use a different browser.

I'm not going to be able to provide further assistance with this, as — if I can't see the code, I can't determine what it is, whether it's expected and part of macOS — screen sharing is — or if there's something added either locally through the configuration or installation of packages, or added remotely by some other apparently-unauthorized user. Without that, I don't see evidence of anything untoward here.

Reply

Answer 4

Oct 25, 2017 6:20 PM in response to MrHoffman

Oye! Finally Mr Hoffman! Me claps.. heh. Those 17. iP ranges aren’t always trustworthy. And /Whois’ing an IP is an almost every other minute event for me to the poster above. As of now be mindful of Proton & Fruitfly -

Reply

Answer 5

Oct 14, 2015 3:46 PM in response to mavieth

I would like to ask if you notice the symptom where your "activity monitor" shows processes that aggregate to more than 100% for all processes. This tends to occur when the CPU fan is on and does not happen all the time.

Reply

Answer 6

etresoft

Level 9

56,326 points

Feb 10, 2017 8:44 AM in response to kingrosa

Hello again kingrosa,

As I said in your other thread (help please! worried about hack), you have not been hacked.

I encourage you to change your internet passwords, make sure to never re-use any passwords, and make sure your fully understand what you are doing on your web sites. Those are, by far, the most likely avenue for attack. Your Mac is, by far, the least likely venue for attack.

Reply

Answer 7

Oct 14, 2015 5:12 PM in response to mavieth

Passwords to websites can mean you're accessing remote web sites, or that you're running local web sites and a local web server — as it's somewhat more severe, I'll assume the latter for parts of this reply; that you are running a server here. Some details of your posting — such as what appears to be DHCP addresses, and that it's a MacBook Pro — implies that you're not running local web services here; that you're not looking for help with a server configuration.

The netstat doesn't have enough nearly details here — more than a few of the fields have been truncated. It's also not clear whether the existing connections are themselves intended or incidental or not — that depends on knowledge of what the box is doing and serving. Further, whether or not there are connections now, if there's unauthorized software or if there've been passwords changed or accounts added onto the box, unfortunately there can be connections later. (Note that there are accounts that show up in System Preferences, and more than a few — such as the www account that's used by the Apache web server — that do not appear in System Preferences.)

Change your passwords and preferably to a length of twelve or more characters, change all of your web and email passwords, rotate your backups including keeping copies entirely offline from the server, implement web server isolation and probably via a DMZ on your network if you're serving files from a home or small business network (this if you're running a local web server here), and generally have a good look at your security.

If you have particularly valuable passwords, consider enabling two-factor authentication on services where that's available.

If there was credit card information present on the system, notify your credit card company and then monitor that carefully.

If your system has potentially been accessed as could be inferred by your use of netstat, then you can either hope there's been no backdoor left — finding those is tedious at best, and success here is very far from guaranteed — or you can wipe and reinstall from known-good OS X distros and known-good backups, and not transferring any applications over from the hacked server. This is unfortunately also the way out of these cases that has the best likelihood of closing any back doors and removing any untoward software — wipe the disk and roll in the last good pre-breach backup and start over from that, or wipe and install and roll in specific files and start over. (If you do choose this route, make a full backup of the current disk contents, on the off chance you need something — again, no applications, get new copies of those if they're newer than your last backup — from the potentially-breached environment.)

Activity Monitor and fans spun up might arise with a breach that's spun up a whole lot of computing on the box, but that's only one sort of attack.

The referenced IP address implies an affiliation with a larger organization and one that has undoubtedly had some experience dealing with breaches, and I'd suggest contacting the IT or network services folks from that organization, and ask them for their recommendations.

Reply

Answer 8

Oct 12, 2016 4:43 PM in response to MrHoffman

Question. I know something isn't right with my rMBP and somehow I was hacked and Remote Client was turned on and also Screen Sharing. I have been able to turn Remote Client off but even though screen view is off in my settings when I use terminal to see if its running the response comes back "enabled".

So I decided last night after a new install (I believe the hack is in the EFI partition) to turn off all of the keychains, add journaled plus password and basically get rid of every cert in the Keychain.

After a reboot the first item in netstat was this:

iBOO:~ solid$ netstat

Active Internet connections

Proto Recv-Q Send-Q Local Address Foreign Address (state)

tcp4 0 0 192.168.1.4.49232 jeeves.markallan.http SYN_SENT

tcp4 0 0 192.168.1.4.49231 jeeves.markallan.http LAST_ACK

What in the world is jeeves.markallan.http? Maybe my iPhone 6s+ was hacked and the boot corrupted my mac? I would LOVE some help on this subject.

This recent discussion will explain more without giving away whatever hack this is. I know its something sophiscated so I don't want to "share" the code itself. I can say one thing a few key words brought me to a website called "exploit database" with a bunch of kids talking like 13 year olds, but could probably hack me. Lol.

Reply

Answer 9

Oct 12, 2016 4:52 PM in response to MrHoffman

One more thing.

Why is it IMPOSSIBLE to delete EVERYTHING? And do a real fresh installation.

APPLE SSD SD0128F:

Capacity: 121.33 GB (121,332,826,112 bytes)

Model: APPLE SSD SD0128F

Revision: A223321

Serial Number: 1435NC416822

Native Command Queuing: Yes

Queue Depth: 32

Removable Media: No

Detachable Drive: No

BSD Name: disk0

Medium Type: Solid State

TRIM Support: Yes

Partition Map Type: GPT (GUID Partition Table)

S.M.A.R.T. status: Verified

Volumes:

EFI:

Capacity: 209.7 MB (209,715,200 bytes)

BSD Name: disk0s1

Content: EFI

Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B

disk0s2:

Capacity: 120.47 GB (120,473,067,520 bytes)

BSD Name: disk0s2

Content: Apple_CoreStorage

Boot OS X:

Capacity: 650 MB (650,002,432 bytes)

BSD Name: disk0s3

Content: Apple_Boot

Volume UUID: 988F6D76-AD94-38B6-83A6-132AE2AAF3B4

#

Then look at this ludicrous update:

Google Chrome 53.0.2785.143-54.0.2840.59 Update:

Available: Zero KB

Capacity: 28 MB (27,963,392 bytes)

Mount Point: /private/tmp/KSInstallAction.cF5O23bimG/m

File System: HFS+

Writable: No

Ignore Ownership: Yes

BSD Name: disk3s2

Volume UUID: A3FF3247-89E5-3EB3-80D8-F45117617A4F

Physical Drive:

Device Name: Disk Image

Media Name: Apple UDIF read-only compressed (zlib) Media

Protocol: Disk Image

Internal: No

Partition Map Type: APM (Apple Partition Map)

Reply

Answer 10

Oct 25, 2016 9:46 AM in response to MrHoffman

Thanks MrHoffMan I will chalk it up to the taskt "issue".

Is this normal though? On a boot with nothing running except for 1Password.

Active Multipath Internet connections

Proto/ID Flags Local Address Foreign Address (state)

mptcp/00 00000000/00000004 ESTABLISHED

[tok(0x237b19bc) snd(0xdbce1ed673e98531) rcv(0xd947bf76addf3fde) aid(2)]

tcp4/01 000c20c9 192.168.1.108.49280 17.174.3.5.https ESTABLISHED

[dsn(0xdbce1ed673e98531), relseq(4772), err(0)]

icm6 0 0 *.* *.*

Reply

Answer 11

Nov 1, 2016 8:39 AM in response to GreenMamba

You have a network connection to Apple. There are usually more than a few of those connections arising and transpiring on macOS and Apple apps, and to various of the IP addresses in the Apple IPv4 address block.

Reply

Answer 12

Nov 13, 2016 6:12 PM in response to MrHoffman

Thanks again. I have looked into this again. It's a "linode" server poking my rMBP and did something to my EFI. Reinstalls don't fix the problem. But I am looking to buy a new pro soon anyway. Thank you for your in depth response.

Reply

Answer 13

Nov 28, 2016 8:22 PM in response to GreenMamba

There's no obvious connection between network connections from macOS to Apple or Linode, "did something to my EFI", and a MacBook Pro that won't reinstall.

Some of the reports of problems reportedly caused by viruses or hacks — those sorts of weird problems not resolved by reinstallation from backup or recovery from software distributions — have been found caused by hardware problems. Failing disk drives or other glitches, for instance, can cause (other) weird software behaviors. Computers — hardware and software — are complex devices, after all.

If you're a journalist, activist or other potential target of sophisticated security attacks, or if you have somebody with physical access or means and that really doesn't like you — and even most of those breaches have tended to involve phishing for credentials or otherwise getting folks to open up remote access or install random stuff or physical access, and not any "fancy" security attacks — then you really want to acquire much better and more direct assistance with establishing and maintaining your computer security; practices, policies, tools, authentication, etc. More than can be reasonably provided here. While there are security-hardening guides posted, getting real and good and reliable information specific to your particular risks can be critical.

Reply

Answer 14

Feb 10, 2017 8:19 AM in response to kingrosa

kingrosa: There's nowhere near enough detail in that screenshot of active network connections, nor enough details around why you think there might be a problem. What you've shown can very easily be entirely normal and benign. But if something sketchy was downloaded and invoked, all bets are off.

Please get in contact your local security folks, and explain your concerns, and ask for assistance.

Please also don't go looking for easy answers or quick fixes, because there aren't any. There's far too much snake oil and some entirely too sketchy "security" software available here, unfortunately. Folks that are fearful and scared are not an underserved market, and it's a very profitable market.

Please do not take advice from random 'net folks. Like me. Please use your own organization's knowledge and staff.

As for that posting of open IP networking ports, I see a bunch of random UDP ports chattering and some NTP timekeeping traffic, an HTTPS browser connection to some Amazon service, and a TCP Jabber (XMPP) chat connection to Apple. What's on the TCP ports listening and what those UDP ports are being used for — and macOS normally has a bunch of random TCP and UDP ports open, as part of normal operations of macOS and the installed applications — is not available from what's been shown, and I'm not in a position to dig into your local system configuration right now; what's installed and what processes are active. (The rest of the netstat output, lsof, logs, installed config, etc. Takes a while to wade through all that, and cross-check.)

I would discuss your local security requirements with your local security folks before making any changes, too. Making changes sometimes can cause problems. If you and the local team think your Mac have have been breached, they may want a look.

Here's a short write-up covering securing macOS:

https://medium.com/be-secure/securing-mac-os-x-90137aac6144

The previously-linked discussion of hardening:

https://github.com/drduh/macOS-Security-and-Privacy-Guide

Here's some very detailed reading:

https://benchmarks.cisecurity.org/tools2/osx/CIS_Apple_OSX_10.12_Benchmark_v1.0. 0.pdf

But again, you're best served by chatting directly with your local IT security folks.

Reply

Answer 15

Apr 15, 2017 5:04 PM in response to MrHoffman

Thanks for your response way back when. I wasn't able to provide "in depth" details due to the bug. It wasn't patched with Apple yet. It is now. There is still a small flaw. A fella I know and chat with (Pat Wardle) had almost came to the same conclusion as me and he ended up getting the problem patched. He blogged about it on synack.com/blog and his own site objective-see.com ... anyway it was quite sophisticated and only happened to me due to some work of the research/work I do. I bought a new machine since then. I still own that rMPB. Now I use it solely for "work". With all of that being said when I posted this I was very angry I somehow had a log clipping loadable kernel module added to my Mac being fairly secure. I am now in the Beta program for macOS and after using Linux and DOS again Darwin is still the most secure system for personal use. If I created anyone to feel like they aren't secure with their Mac think again. Mac also has a new iMac as well as a Mac Pro at a lower price point with unreal specs coming out.

Reply