Is my iMac being hacked?

Question

Level 1

9 points

Is my iMac being hacked?

My iMac was hacked into several months ago and after doing everything humanly possible to get rid of the malware that was on my harddrive Im still a little gun shy so Im constantly looking for abnormalities in my file system. Yesterday I checked my Firewall and Apple File Server configurations.

The files below are whats being allowed to get through my firewall settings. I realize that bonjour is one of the files that has permission but I've read parts of the discoverd (bonjour) file and there was some things in the file that increased my concern enough to create this post.

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>allowsignedenabled</key>

<key>applications</key>

<key>exceptions</key>

<array>

<dict>

<string>/usr/libexec/configd</string>

<key>state</key>

</dict>

<dict>

<string>/usr/sbin/mDNSResponder</string>

<key>state</key>

</dict>

<dict>

<string>/usr/sbin/racoon</string>

<key>state</key>

</dict>

<dict>

<string>/usr/bin/nmblookup</string>

<key>state</key>

</dict>

<dict>

<string>/System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/readconfig</string>

<key>state</key>

</dict>

<dict>

<string>/usr/libexec/discoveryd</string>

<key>state</key>

</dict>

</array>

<key>explicitauths</key>

<array>

<dict>

<string>org.python.python.app</string>

</dict>

<dict>

<string>com.apple.ruby</string>

</dict>

<dict>

<string>com.apple.a2p</string>

</dict>

<dict>

<string>com.apple.javajdk16.cmd</string>

</dict>

<dict>

<string>com.apple.php</string>

</dict>

<dict>

<string>com.apple.nc</string>

</dict>

<dict>

<string>com.apple.ksh</string>

</dict>

</array>

<key>firewall</key>

<dict>

<key>Apple Remote Desktop</key>

<dict>

<string>AppleVNCServer</string>

<key>state</key>

</dict>

<key>FTP Access</key>

<dict>

<key>state</key>

</dict>

<key>ODSAgent</key>

<dict>

<string>ODSAgent</string>

<key>servicebundleid</key>

<string>com.apple.ODSAgent</string>

<key>state</key>

</dict>

<key>Personal File Sharing</key>

<dict>

<string>AppleFileServer</string>

<key>state</key>

</dict>

<key>Personal Web Sharing</key>

<dict>

<string>httpd</string>

<key>state</key>

</dict>

<key>Printer Sharing</key>

<dict>

<string>cupsd</string>

<key>state</key>

</dict>

<key>Remote Apple Events</key>

<dict>

<string>AEServer</string>

<key>state</key>

</dict>

<key>Remote Login - SSH</key>

<dict>

<string>sshd-keygen-wrapper</string>

<key>state</key>

</dict>

<key>Samba Sharing</key>

<dict>

<key>state</key>

</dict>

<key>firewallunload</key>

<key>globalstate</key>

<key>loggingenabled</key>

<key>loggingoption</key>

<key>stealthenabled</key>

<key>version</key>

</dict>

</plist>

I have never set my computer up to do any kind of sharing but apparently python, ruby, javajdk, Apple File Server, Printer Sharing, Remote Login - SSH and Samba Sharing all have exclusive authorization. I've enable Stealth in my Firewall but according to the config file Stealthenabled is disabled (0).

Like I said I have never set my computer up to be a server but it appears that Apple File Server configuration says other wise. What confuses me about this file the very first line says its disabled but I've seen it running in my activity monitor and Enabled Transactions are allowed

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>Disabled</key>

<true/>

<key>EnableTransactions</key>

<true/>

<key>GroupName</key>

<string>wheel</string>

<key>Label</key>

<string>com.apple.AppleFileServer</string>

<key>MachServices</key>

<dict>

<key>com.apple.AppleFileServer</key>

<dict>

<key>HideUntilCheckIn</key>

<true/>

</dict>

<key>ProgramArguments</key>

<array>

<string>/usr/sbin/AppleFileServer</string>

</array>

<key>Sockets</key>

<dict>

<key>Listener</key>

<dict>

<key>Bonjour</key>

<true/>

<key>SockServiceName</key>

<string>afpovertcp</string>

</dict>

<key>WaitForDebugger</key>

</dict>

</plist>

iMac, OS X Yosemite (10.10.1)

Posted on Mar 9, 2015 8:32 PM

Reply

Answer 1

BobHarris

Level 9

56,933 points

Jun 28, 2017 8:57 AM in response to Community User

Nicki20202 wrote:

I have a similar situation. Is there a way to know or a separate and safe app that I could implement to know for sure if someone has any kind of surveillance on me? I do know this person and his attorney had me under surveillance using a Verizon program. I have ridded of that however, that does't deter them from using something else. I do suspect it and it's a big concern for me with safety.

Any thoughts or suggestions are greatly appreciated.

Thank you for your time.

This is an old post, so you might be better starting a new Post (see the "Post" button at the top of this page". Also this is the Yosemite 10.10 forum. If you are running a different operating system version, it would be best to use that forum.

In your new post, I suggest you provide the

EtreCheck output

<https://discussions.apple.com/docs/DOC-6174> or <https://etrecheck.com>

If, when trying to post the output, you get the error:

"The message contains invalid characters"

then try posting to PasteBin.com, and give us a pointer.

<http://pastebin.com/>

.

EtreCheck is a tool that helps Apple Support Community volunteers debug problems without any access to the troubled computers. Debugging problems can be a difficult task even when the machine is in front of you. Attempting it via a discussion forum is extremely difficult. EtreCheck has been a great help.

If there is unwanted 3rd party software, chances are EtreCheck will display it.

You could just backup your system (2 backups, to 2 different backup devices, using 2 different backup utilities, if you are paranoid about not loosing data; which I am), then erase your system, do a clean install of your operating system (or make a Genius Bar appointment at your local Apple store for aid in doing this), then restore "JUST" your data, and reinstall any apps you use directly from the vendor. Do you restore from your backups, so that you do not bring back anything that might be compromised.

If you want active monitoring, you might consider Little Snitch. To monitor your activity from your Mac, the software would need to establish an external connection.

Little Snitch monitors all out-bound network connections, and will prompt you to approve them. The 'bad' news is that your Mac makes a lot of out-bound connections, so Little Snitch can be very annoying.

Little Snitch has also been guilt of sometimes blocking a connection that you really want to make, but because you approved the blockage months ago, you do not understand why you cannot make the connection you want to make today.

A lot of the forum Volunteers do not really like Little Snitch because it can be confusing to someone that does not understand networking, nor how to review connection logs, etc... to find false positives (blocking when it shouldn't).

But if you want to know if anyone if "Phoning Home", Little Snitch is a way to do this.

I think Little Snitch has a demo mode, so you could maybe try it for a little while to put your mind at ease.

Reply

Answer 2

Jul 30, 2018 1:14 AM in response to Linc Davis

I have a similar situation. Is there a way to know or a separate and safe app that I could implement to know for sure if someone has any kind of surveillance on me? I do know this person and his attorney had me under surveillance using a Verizon program. I have ridded of that however, that does't deter them from using something else. I do suspect it and it's a big concern for me with safety.

Any thoughts or suggestions are greatly appreciated.

Thank you for your time.

Reply

Answer 3

Mar 9, 2015 8:34 PM in response to tug_slug1

The firewall will allow those services through if they're turned on in the sharing pane. Are they checked in the sharing pane? If they are, and you're not using them, turn them off.

Reply

Answer 4

Linc Davis

Level 10

209,739 points

Mar 10, 2015 8:08 AM in response to tug_slug1

If you're behind a router on a private network, the firewall does absolutely nothing to protect you from the kind of attack you seem to be afraid of. You should turn it off.

Reply

Answer 5

tug_slug1 Author

Level 1

9 points

Mar 10, 2015 10:31 AM in response to Linc Davis

Thanks for taking the time to reply but I havent told you the whole story. 18 months ago I broke up with my g/f, while I was inside getting my belongings together she went out to my truck and got my iPhone. I had so much stuff in the bed and the cab of the truck I didnt realize my iPhone was missing. When I started to unload my truck I noticed my iPhone was gone. Not thinking she would ever stoop so low as to steal my iPhone out of my truck I thought I lost it.

After the 3rd day of looking every where for my phone I gave up and bought a used iPhone. On the 4th day I called her and told her I knew she had my phone and wanted it back. She said she wasn't going to give it back but when I threatened to call the police she knew she had no choice. Once I had it reactivated it wasn't functioning correctly but I just thought it was a glitch in the software. After 3 months I finally found the time to take to the Apple store and have a genius look at it. He asked me how long the phone had been jailbroke and I said never. He told me someone jailbroke my iphone and there was some software on it that would monitor everything that was going on with my phone. During that time every email account I had, had been hacked into and all my email had been deleted. In one account alone I lost 11 years worth of email so I had to create all new email accounts and shut the others down.

Soon after my laptop became infected with a virus than I bought my iMac not knowing the iphone had some sort of virus on it I backed up my iPhone on it and my iMac has never been the same. I formatted the HD last night and now I cant access the apple store to download my purchases, I keep receiving an error message stating Im not connected to the internet but as you can see thats not true due to the fact Im able to create this post.

I've had the Apple store format the hard drive several times not to mention the number of times I formatted the hard drive. I went as far as booting up to an external hard drive so I could use diskutil in terminal to delete partitions that I couldn't normally delete on the hard drive but I still keep seeing error messages like the one below.

3/10/15 10:59:00.376 AM sandboxd[692]: ([684]) mdworker(684) deny file-read-xattr /Users/admin/Library/Application Support/Firefox/Profiles/yz174gs3.default/sessionstore-backups/recovery.bak (pre-plugin fstype:hfs fsflag:480D000 flags:240000005E diag:0 uti:com.netscape.javascript-source plugin:/Library/Spotlight/RichText.mdimporter - find suspect file using: sudo mdutil -t 680729)

Reply

Answer 6

Linc Davis

Level 10

209,739 points

Mar 10, 2015 11:01 AM in response to tug_slug1

That log message doesn't mean that your computer is infected with a "virus," nor does anything else in your story suggest it. If the phone was jailbroken, there could have been malware on it, but that wouldn't affect the Mac.

Clearly your ex-SO used your phone to get into your Internet accounts. All of those accounts, including your Apple ID, should be considered compromised. If you haven't already done so, sign in to appleid.apple.com and check the status of the account.

Reply