"atos needs to take control…": Where does it come from? What does it mean?

Question

Level 3

581 points

"atos needs to take control…": Where does it come from? What does it mean?

I got a warning window unexpectedly when I was working on many xterm windows (XQuartz), Finder windows and Firefox windows:

I already read many discussions on this worrying message: I am not using "Bento".

I found a command line tool "atos" which I installed with the "Command Tools", but there is no evidence this graphical alert windows might be related with this command line. Moreover, I didn't use "atos".

My MacOS X is a just freshly installed El Capitan (10.11.6) on which I am installing progressively all the MacPorts I need to work.

Where is this alert window coming from? I mean from which application?

What is the correct method to identify, verify the origin of this alert window?

How may I get which account and password are requested?

What is the feedback address at Apple to report this security problem?

a few iMac, MacBook Pro, iPhone 6

Posted on Aug 30, 2016 7:20 AM

Reply

Answer 1

JimmyCMPIT

Level 7

29,306 points

Aug 30, 2016 7:25 AM in response to Zorba_le_grec

are you running filemaker or bento? if so that prompt could be coming from there.

Reply

Answer 2

etresoft

Level 9

57,554 points

Aug 30, 2016 8:38 AM in response to Zorba_le_grec

Hello daniel,

There is no need to report this to Apple. Apple's software is working as designed. This is likely a problem somewhere in MacPorts. The MacPorts maintainers probably won't care either because none of the software they maintain is their own.

Some program somewhere attempted to run atos as root and needs your password to do so. I think this is something that Bento would do so that is why everyone talks about Bento. But any program could do it too. The problem with running command line tools from scripts like this is that you can't tell where the request is coming from.

I strongly suggest you click "Cancel". If something breaks, then maybe you will have found out who is requesting that. To be clear, something IS breaking in your MacPorts workflow. I just don't know what it is or what the end results are.

Reply

Answer 3

Zorba_le_grec Author

Level 3

581 points

Aug 30, 2016 12:15 PM in response to JimmyCMPIT

None of them. I didn't install either of these programs. The focus of my question is: "What is the correct method to identify, verify the origin of this alert window?"

Reply

Answer 4

etresoft

Level 9

57,554 points

Aug 30, 2016 12:49 PM in response to Zorba_le_grec

daniel Azuelos wrote:

What is the correct method to identify, verify the origin of this alert window?

Hello again daniel,

The origin of that alert window is neither identifiable nor verifiable. All you can ever tell about it is that some app named "atos" wants to take control of your machine (and all of your data, either on the machine or in the cloud, now and forever). You also know that "atos" has an icon that kind of looks like a terminal.

What you have to do now is locale all executables named "atos" on your machine (using methods that are probably not available to you - i.e. a Spotlight search will NOT work). Then, find out which of those apps would present an icon that kind of looks like a terminal, and in which context.

In this case, it sounds like some command-line tool has issued an AppleScript "do shell script" command to run the "atos" tool from Xcode Command Line Tools. But it could also be some malware. For all intents and purposes, there is no way for you to tell them apart. If you didn't directly initiate the dialog, I strongly suggest that you do not supply a password.

Reply