remote sharing/hacked

Question

Level 1

13 points

remote sharing/hacked

Trying to track down how my computer is hacked and my screen is being remotely shared. All of my screen sharing settings have always been off, and my firewall is always set to the highest level of security.

I ran ps -A | grep Remote in terminal and here are the results:

Nmap done: 1 IP address (1 host up) scanned in 1.68 seconds

MacBook-Air:~ time$ sudo ps -A | grep Remote

7236 ?? 0:03.64 /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted

7934 ?? 0:00.18 /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagen t

10061 ?? 0:00.03 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

14665 ttys000 0:00.01 grep Remote

MacBook-Air:~ time$

sh-3.2# ps -A | grep Remote

69 ?? 0:00.20 /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted

384 ?? 0:00.10 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

386 ?? 0:00.03 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

387 ?? 0:00.10 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

572 ?? 0:00.43 /System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XP CServices/localAuthenticationRemoteService.xpc/Contents/MacOS/localAuthenticati o nRemoteService

699 ttys000 0:00.01 grep Remote

also, as additional information, when checking screen sharing in terminal

MacBook-Air:~ time$ [[ -f /etc/com.apple.screensharing.agent.launchd ]] && echo 'enabled' || echo 'disabled'

The reply is that screensharing is enabled

MacBook Air, macOS High Sierra (10.13.3)

Posted on Feb 9, 2018 1:46 PM

Reply

Answer 1

Best reply

sflawton81 Author

Level 1

13 points

Feb 9, 2018 7:50 PM in response to tygb

Thanks, I'm not using any remote screen sharing programs/3rd party remote screen sharing apps. I've never used any on this machine. From what I know, it's also very easy to turn the screen sharing icon off-so it doesn't display:

http://drsavoye.blogspot.com/2010/03/disable-screen-sharing-menu-icon.html

For example: If you are using Apple Remote Desktop (ARD) to control Screen Sharing, you may simply hide it:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/k ickstart -activate -clientopts -setmenuextra -menuextra no

Is there a way in the command line to figure out what the process the hacker might be running to allow screen sharing?

Reply

Answer 2

Feb 17, 2018 1:41 PM in response to sflawton81

Hi,

EDIT for grammar and spelling. (Does not mean I haven't missed something)

Bit late to the party I know.

This is iMessages Login process

10061 ?? 0:00.03 /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent

Little Snitch should list it if you are running it.

Little Snitch as a Firewall app first and foremost with the additional Functions of being able to help, sometimes, with what is happening with incoming and outgoing connections.

That said I have never tried it with the Block in the Mac Firewall.

That said, many Process like this that help an app to run don't appear in the Mac Firewall.

It is also used when the iMessages account uses the Details option top right of the chat window and Screen Sharing is used.

I don't know enough about "grep" to be able to say if that is saying it is ready to run or the process is started up and running.

I would be looking in Activity Monitor.

In early versions of Messages (or rather when Screen Sharing became a iMessage invocation) it used to require that Screen Sharing in Internet Preferences > Sharing used to have to be On.

You clearly have it set to Off. You also are not using Remote Access (Apple Remote Desktop) which uses the same components is also Off.

Screen Sharing from starting in an iMessages conversation also includes an Audio component that is not obvious if you just use the app itself (Hard Drive Name/System/Library/Core Services/Applications).

I would also add that there seems to be a lack of info that could be said to be an Active Screen Sharing session actually going on.

9:37 pm Saturday; February 17, 2018

 iMac 2.5Ghz i5 2011 (Sierra)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
 iPhone 6 iOS 11.x and an iPad (2)

Reply

Answer 3

sflawton81 Author

Level 1

13 points

Feb 9, 2018 5:01 PM in response to Kurt Lang

Thanks Kurt, here's my EtreCheck report.

EtreCheck version: 3.4.6 (460)

Report generated 2018-02-09 16:59:31

Download EtreCheck from https://etrecheck.com

Runtime: 7:05

Performance: Below Average

Click the [Lookup] links for more information from Apple Support Communities.

Click the [Details] links for more information about that line.

Problem: Other problem

Hardware Information: ⓘ

MacBook Air (13-inch, Early 2015)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Air - model: MacBookAir7,2

1 1.6 GHz Intel Core i5 (i5-5250U) CPU: 2-core

4 GB RAM Not upgradeable

BANK 0/DIMM0

2 GB DDR3 1600 MHz ok

BANK 1/DIMM0

2 GB DDR3 1600 MHz ok

Handoff/Airdrop2: supported

Wireless: en0: 802.11 a/b/g/n/ac

Battery: Health = Normal - Cycle count = 211

Video Information: ⓘ

Intel HD Graphics 6000 - VRAM: 1536 MB

Color LCD 1440 x 900

Disk Information: ⓘ

APPLE SSD SM0256G disk0: (251 GB) (Solid State - TRIM: Yes)

[Show SMART report]

EFI (disk0s1 - MS-DOS FAT32) <not mounted> [EFI]: 210 MB

(disk0s2) <not mounted> [APFS Container]: 250.79 GB

USB Information: ⓘ

USB30Bus

Apple Inc. BRCM20702 Hub

Apple Inc. Bluetooth USB Host Controller

Thunderbolt Information: ⓘ

Apple Inc. thunderbolt_bus

Virtual disks: ⓘ

Macintosh HD (disk1s1 - APFS) / [Startup]: 250.79 GB (57.56 GB free)

Physical disk: disk0s2 250.79 GB (57.56 GB free)

(disk1s2) <not mounted> [Preboot]: 250.79 GB

Physical disk: disk0s2 250.79 GB

(disk1s3) <not mounted> [Recovery]: 250.79 GB

Physical disk: disk0s2 250.79 GB

(disk1s4) /private/var/vm [VM]: 250.79 GB

Physical disk: disk0s2 250.79 GB

System Software: ⓘ

macOS High Sierra 10.13.3 (17D47) - Time since boot: about one hour

Gatekeeper: ⓘ

Mac App Store and identified developers

Kernel Extensions: ⓘ

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (4.0.2 - SDK 10.11) [Lookup]

[loaded] com.comodo.kext.FileAccessFilter (1.0.2 - SDK 10.10) [Lookup]

System Launch Agents: ⓘ

[not loaded] 9 Apple tasks

[loaded] 178 Apple tasks

[running] 83 Apple tasks

[killed] 20 Apple tasks

20 processes killed due to insufficient RAM

System Launch Daemons: ⓘ

[not loaded] 38 Apple tasks

[loaded] 186 Apple tasks

[running] 87 Apple tasks

[killed] 21 Apple tasks

21 processes killed due to insufficient RAM

Launch Agents: ⓘ

[running] at.obdev.LittleSnitchHelper.plist (Objective Development Software GmbH - installed 2017-08-30) [Lookup]

[running] at.obdev.LittleSnitchUIAgent.plist (Objective Development Software GmbH - installed 2017-08-30) [Lookup]

[running] com.comodo.Agent.plist (? ad1f90d6 c39330b3 - installed 2018-01-14) [Lookup]

[running] com.comodo.TrayMenu.plist (? eb04919d 2a09a6d5 - installed 2018-01-14) [Lookup]

[loaded] com.google.keystone.agent.plist (Google, Inc. - installed 2017-10-04) [Lookup]

Launch Daemons: ⓘ

[running] at.obdev.littlesnitchd.plist (Objective Development Software GmbH - installed 2017-08-30) [Lookup]

[loaded] com.apple.installer.osmessagetracing.plist (Apple, Inc. - installed 2018-01-19)

[running] com.comodo.fileaccessdaemon.plist (COMODO Security Solutions, Inc - installed 2016-06-22) [Lookup]

[loaded] com.google.keystone.daemon.plist (Google, Inc. - installed 2017-10-12) [Lookup]

[running] com.objectiveSee.blockblock.plist (Objective-See, LLC - installed 2018-01-31) [Lookup]

[loaded] com.xujiwei.PortsMonitor.Helper.plist (Jiwei Xu - installed 2017-08-23) [Lookup]

User Launch Agents: ⓘ

[running] com.objectiveSee.blockblock.plist (Objective-See, LLC - installed 2018-01-31) [Lookup]

[running] com.spotify.webhelper.plist (Spotify - installed 2018-02-09) [Lookup]

User Login Items: ⓘ

OverSight Helper Application (Objective-See, LLC - installed 2017-09-24)

(/Applications/OverSight.app/Contents/Library/LoginItems/OverSight Helper.app)

Wondershare Helper Compact Application

(~/Library/Application Support/Helper/Wondershare Helper Compact.app)

Internet Plug-ins: ⓘ

o1dbrowserplugin: 5.41.3.0 (installed 2017-10-04) [Lookup]

googletalkbrowserplugin: 5.41.3.0 (installed 2015-12-11) [Lookup]

QuickTime Plugin: 7.7.3 (installed 2018-02-09)

Safari Extensions: ⓘ

None

3rd Party Preference Panes: ⓘ

None

Time Machine: ⓘ

Time Machine not configured!

Top Processes by CPU: ⓘ

30% diagnosticd

29% Xcode

23% Console

11% mdworker

10% mdworker

Top Processes by Memory: ⓘ

610 MB kernel_task

142 MB com.apple.WebKit.WebContent

115 MB Finder

110 MB Safari

96 MB Console

Top Processes by Network Use: ⓘ

Input Output Process name

2 MB 207 KB Spotify

26 KB 23 KB mDNSResponder

5 KB 7 KB apsd

5 KB 558 B netbiosd

0 B 64 B SystemUIServer

Top Processes by Energy Use: ⓘ

5.32 diagnosticd

5.20 coreaudiod

4.06 Console

3.96 Activity Monitor

2.60 com.apple.WebKit.WebContent

Virtual Memory Information: ⓘ

1.12 GB Available RAM

255 MB Free RAM

2.88 GB Used RAM

891 MB Cached files

60 MB Swap Used

Software installs (last 30 days): ⓘ

Comodo-AV-Installer: (installed 2018-01-14)

Slack: 3.0.5 (installed 2018-01-20)

Wireshark 2.5.0 Intel 64: (installed 2018-02-06)

ReimageCleanerApp: (installed 2018-02-09)

ReimageCleaner: (installed 2018-02-09)

Install information may not be complete.

Diagnostics Events (last 3 days for minor events): ⓘ

2018-02-09 15:08:42 Last shutdown cause: 3 - Hard shutdown

2018-02-09 14:57:16 RansomWhere High CPU use [Open] [Details]

2018-02-08 09:45:37 com.apple.WebKit.Networking High CPU use [Open] [Details]

2018-02-06 23:43:45 Wireshark.app Crash [Open]

2018-02-06 22:44:02 Where.app Crash [Open]

Files deleted by EtreCheck: ⓘ

2018-02-09 16:13:31 - ~/Library/LaunchAgents/com.dropbox.DropboxMacUpdate.agent.plist - Unknown

2018-02-09 16:13:31 - ~/Library/LaunchAgents/com.wondershare.TunesGoHelper.plist - Unknown

2018-02-09 16:34:30 - /Library/LaunchDaemons/com.reimage.cleaner.plist - Unknown

Reply

Answer 4

John Galt

Level 10

141,502 points

Feb 9, 2018 6:18 PM in response to sflawton81

Concerns about privacy while using Google products illustrates cognitive dissonance.

It's far more likely that your Apple ID credentials have been stolen. That's extremely common.

If you think your Apple ID has been compromised - Apple Support

Stop using "anti-virus" junk and things like "RansomWhere" that grant access to macOS at a privileged level. Installing such things increases your threat profile when your objective ought to be to reduce it. They will convey no benefit, while opening the door to various exploits that would otherwise not be possible.

Reply

Answer 5

tygb

Level 9

64,604 points

Feb 9, 2018 10:29 PM in response to sflawton81

See these articles Use the kickstart command-line utility in Apple Remote Desktop - Apple Support

Allow Remote Desktop to access your Mac - Apple Support

You can click on the link Remote Desktop Help to get more information .

Reply

Answer 6

Cpc94118

Level 1

8 points

Feb 9, 2018 2:28 PM in response to sflawton81

I read online somewhere that there was a bug in the software that allowed hackers to access laptops via the latest High Sierra update. I put off installing the update for about 2 months but one day, the computer just updated without my permission (all updates have to be manually installed on my laptop) and now I have lots of major probs.

Reply

Answer 7

Kurt Lang

Level 9

58,428 points

Feb 9, 2018 2:32 PM in response to Cpc94118

There is no such hack. And why would it only be laptops? Desktop Macs run the same version of High Sierra.

The bug was a flaw in the admin password dialogue. That has been fixed, if you have your Mac up to date.

Reply

Answer 8

John Galt

Level 10

141,502 points

Feb 9, 2018 4:08 PM in response to sflawton81

sflawton81 wrote:

also, as additional information, when checking screen sharing in terminal

MacBook-Air:~ time$ [[ -f /etc/com.apple.screensharing.agent.launchd ]] && echo 'enabled' || echo 'disabled'

That does not do what you think it does.

If Screen Sharing is de-selected, then Screen Sharing is disabled. You're barking up the wrong tree.

Reply

Answer 9

sflawton81 Author

Level 1

13 points

Feb 9, 2018 4:58 PM in response to sflawton81

As a side conversation --- (my main problem is that my computer is hacked, and screen is being shared and I'm trying to diagnosis how it's happening -- what does this "enabled" reply in command line mean? That Screen Sharing is enabled and ready to go once it's selected in system preferences?

Reply

Answer 10

Feb 9, 2018 5:21 PM in response to sflawton81

FWIW, 4GB is the minimum one would want to run High Sierra. Among other problems, you have so much running in the background you're lucky it runs at all. You have Comodo AV installed, not only do Macs not need Av programs but you installed the AV program that has the largest negative impact on performance. You should uninstall it. You should also uninstall LittleSnitch among several other programs.

Once those are uninstalled post a new EtreCheck report.

Reply

Answer 11

sflawton81 Author

Level 1

13 points

Feb 9, 2018 6:05 PM in response to sflawton81

My hacking/remote screen sharing problem isn't stemming from antivirus software. I'll remove Commodo anyway just to free up resources. Little snitch is useful in terms of getting an understanding of incoming and outgoing connections.

My computer is being accessed remotely, and my screen is being shared. I need to understand how it's happening.

Is there any other information I can provide that would help facilitate investigating how my screen is being shared?

Reply

Answer 12

John Galt

Level 10

141,502 points

Feb 9, 2018 6:08 PM in response to sflawton81

sflawton81 wrote:

-- what does this "enabled" reply in command line mean? That Screen Sharing is enabled and ready to go once it's selected in system preferences?

No. It means that file exists on your Mac. The "enabled" text is something you put there. It might as well say "bravo sierra".

If you're concerned about being "hacked" you're going to need to provide more information... a lot more. Start by describing the reason for your concern. If someone or some thing is watching what you're doing the very last thing you should be doing is using the very same Mac you suspect is being tampered with. Disconnect it from the Internet, and then shut it down in the usual manner—in that order. Then, remove the garbage from your Mac. Start with "Comodo".

If you're justifiably concerned the only remedy is to erase the Mac completely.

Reply

Answer 13

tygb

Level 9

64,604 points

Feb 9, 2018 7:40 PM in response to sflawton81

Are you using Bomgar services for screen sharing ( when screen sharing is in process two very small flashing rectangles overlapping appear on top right corner of the desktop , in case it will remove automatically if you click on yes button to stop screen sharing .

Or using any third party remote screen sharing app .

Reply

Answer 14

KiltedTim

Level 10

195,951 points

Feb 17, 2018 1:56 PM in response to sflawton81

sflawton81 wrote:

My computer is being accessed remotely, and my screen is being shared. I need to understand how it's happening.

Is there any other information I can provide that would help facilitate investigating how my screen is being shared?

Yes. Why do you think your screen is being shared? You haven't actually told us what's going on other than a vague claim that your machine has been 'hacked', which I assure you it has not been.

Reply

Answer 15

Kurt Lang

Level 9

58,428 points

Feb 9, 2018 2:17 PM in response to sflawton81

Download and run EtreCheck. Post the results here.

My guess is you have a desktop sharing app installed. Such as Teamviewer.

Reply

remote sharing/hacked

Similar questions