You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

What is BRCM-LVG under shared? Is my computer being hacked?

Recently, a PC device called brcm-lvg has been showing up on my network in the finder sidebar under sharing.


It started showing up around the time that I upgraded to Yosemite, V 10.10.4. This could just be coincidence.


I have no idea what this device is and a Google search returns unhelpful results. After upgrading to Yosemite, I noticed my Firewall had been turn off. When it's turned off, it says I'm connected to the "brcm-lvg" device as a guess. This device contains one empty folder called "Shared." How could I possibly be connected to this device if I never connected myself to it?


When I turn the firewall on, the mysterious device says the Connection Failed. However, I can't remove the device from the sidebar at all. Even when I press the eject button, it stays there.


What is this "brcm-lvg" device? Is my computer being hacked?


Thank you for your help

MacBook Pro (Retina, 15-inch, Late 2013), OS X Yosemite (10.10.4), null

Posted on Aug 19, 2015 11:08 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 7, 2017 11:46 PM

Actually, "brcm-lvg" is a file server built into the router - it's nothing to worry about. If you plug a USB stick or drive into the back of the router, brcm-lvg will be the "device" to which the USB storage is attached.

46 replies

Aug 20, 2015 3:42 PM in response to cbg2115

Do you have any ideas as to how this device was able to gain access to my password protected network?

If it wasn't wired to your router, and wasn't on a layer-2 VPN such as Hamachi, then it would have had to get into the Wi-Fi network. If you have a weak network password such as a dictionary word, it could be cracked easily in a few minutes. Changing the password would be a good idea, regardless of how strong it is.

Aug 31, 2015 3:47 PM in response to cbg2115

I am just now having exactly the same issue. And it appeared simultaneously on both my and my wife's MacBook Pros.


It also showed up when Time Warner Cable (TWC) "upgraded" my cable modem/router to a Technicolor model TC8715D. This had not occurred anytime previously.


Based on the update to the original post noting the poster's similar "upgrade" to a Technicolor modem/router, I would venture that it is either a 1- feature of that line or 2- TWC is capturing data. Either case makes me very anxious because the main folder is labeled storage; and I have no idea what it intends to "store." Finder's 'Get Info' only shows that folder as a 16KB space with 16KB free (at this time, anyway.)

I have admin access to the modem; but a cursory review of settings did not appear unusual. I do intend to do some additional digging about and locking down.

Sep 1, 2015 4:11 PM in response to cbg2115

A correction and some additional information--and possible explanation.


Correction of my original post: 'Get Info' does not provide any information--just goes into permanent "fetching" status; 'Quick Look' identifies the root folder "storage" as a 16KB space with no data.


While I consider it reprehensible that cable companies mount file systems on peoples networks without explanation, this may become more prominent in the future--here is what I've been able to determine.


Time Warner and Arriss-Technicolor have signed on to MoCA (Multimedia over Coax Alliance) and DLNA (Digital Living Network Alliance) both developing protocols for delivering streaming media, VOIP, and Internet of Things. The Gateway modems such as the Technicolor, are taking on more of the work to deliver performance.


It appears that multimedia modem-routers with the Broadcom chipset use internal Linux procedures to operate. Many of the process identifiers are labeled "BRCM[hyphen]<nomen>. I can't absolutely verify this; information does not seem available to the layperson. I have found instances of BRCM-2.4, BRCM-test-SSID, and such.


My modem settings do have MoCA currently "disabled" (but available.) DLNA is "enabled" to "allow sharing of digital media between devices such as computers, laptops...and other multimedia products." Does not detail what those "products" are. Onboard-help also states, "DLNA can be enabled or disabled. When enabled, the gateway acts as a Digital Media Server." Additionally, my Gateway has QoS (Quality of Service) enabled to "...provide better performance for latency sensitive communication such as voice or video, especially during high traffic."


I am confident that this is BRCM-lvg is a Gateway internal multimedia server as mentioned in the onboard-help; but I don't seem to have the "creds" to absolutely verify that.


If apple is monitoring this discussion, I would submit that it would be a service to us to verify this; and provide detail in a Knowledge Base entry. Apple users are generally more discerning about what they allow mounting to the file system; and we have a right to know.

Sep 2, 2015 12:30 PM in response to OBother

I noticed the SAME THING on my new laptop as I was setting up the network in my NYC apartment yesterday!! the brcm-lvg "data storage" icon. The internet connection is provided by Time Warner Cable, of course, in a building on the UWS. CREEPED ME OUT. Now that I am away from that location -- 100 miles away, in fact -- the icon is still there under "Recent Items," "Servers," then an icon that says "storage" next to it. When I click on it now, it says " The server may not exist or it is unavailable at this time. Check the server name or IP address, check your network connection, and then try again."


So is it just something that anyone who is using a TWC wireless network in their home is going to end up using, like it or not? Like you, I would like to know the whole story behind it.


Thanks.

Sep 17, 2015 5:00 PM in response to cbg2115

This post describes exactly what you should do to rid yourself of this parasitic brcm-lvg that is definitely a security issue. Please read this entire post to understand. I read all these threads below, and called Time Warner Cable (TWC) Tier 3 Tech Support, but the the technician couldn't help. He said it wasn't TWC responsibility. When I explained that the Technicolor Router was TWC property, and indeed, that its security was their responsibility, he put me on hold to check with somebody. Then he had me repeat everything. I repeated all the symptoms for him numerous times as he checked this and that. I told him about this thread on Apple, and asked him to help me block any foreign MAC addresses as per one of the helpful people here. He kept telling me that all he could advise was to change my password. (This much I know and have been doing, like, daily since this breach/hack) Knowing there was nobody to escalate to (I'm already talking to the Executive Office at TWC for this breach of security, but nobody seems to understand what to do about it), I asked the TWC technical representative to help me log onto the router myself, which he did. He told me 'Everything looks fine. Firewall's up and running. Again, I think you need to change your password.' I started asking about all the unrecognized devices connected, and the custom firewall settings which were set to DISABLE my firewall under the appearance of it being enabled. I reset my ip4 to maximum security, and made the mistake of telling him, which he had strong negative opinions about. I also reset my ip6, and some other settings to the 'recommended' settings (that's not where they were). And I went in and deleted a mac address that had no business being on my router. Wish I'd had the foresight to take a photo. All passwords reset, router gateway reset, brcm-lvg and its ominous Sharepoint storage device - gone for now. If someone can please tell me how to take this to the next legal level with TWC or somebody, I'd be grateful.

Sep 17, 2015 8:02 PM in response to cbg2115

I have very little technical knowledge about this, but I was having problems getting kicked off my TWC modem. A technician came out and said that this was their newest modem and that there had been a lot of people experiencing the same problem as me. The tech went out to box outside and did something. When he came back he said that they were aware of the problem and that they would be monitoring the modem remotely and that they would analyze data and send patches when available. Is this the reason for "brcm-lvg?"

Feb 23, 2016 3:07 AM in response to cbg2115

Like others here, I have a new 'Technicolor' Time Warner modem device. I plugged in a USB device for the first time since getting the new modem and when I took it out this brcm-lvg showed up in Finder as a Shared folder, which I never set up. Also, under Devices, a Remote Disc now also appears. What the....!?!?


It concerns me that both the shared folder and the Remote Disk are suddenly showing up in Finder. I turned off 'Screen Sharing' but still this brcm-lvg shared folder is showing up. Unlike others here, I don't know enough about all of these things and it's concerning me that this is a security issue....and this thread seems to have thoughts in both directions on that....so now I don't know what to do. Anyone....?

Feb 23, 2016 3:15 AM in response to hackermonk

How do I find the ip4 and ip6 to reset them? And also, how do I find who is on my router? Although, since I am next to the router I am actually not on WiFi with this modem but using the ethernet cable to save bandwidth.


How did you get to custom firewall settings? Also, did you reset the router's password or your computer password? <sigh> I'm so confused about what to do. This brcm-lvg AND an unknown 'Remote Disk' are showing up in my Finder since yesterday when I put a USB thumb drive into download some files.

I guess I should call TimeWarner but fear that I will be met with the same 'no one knows' thing you found.

Do you think I should be worried? So may opposing opinions here, the most recent one seeming to say it is innocuous.

Mar 8, 2016 10:26 AM in response to diana from new york

I don't know if this helps, I do not use either they modems described or the services. However, I just installed Skype, which is somehow also using Microsoft systems, to run the software. This is almost immediately, when this showed up on my Mac for the first time. I wonder if this is something done during the installation of Skype? Perhaps there is a connection?

What is BRCM-LVG under shared? Is my computer being hacked?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.