The logo on the back of my MacBook was glowing when it was in sleep mode. This happened a couple of times when I was out of my room for about 15 mins, the apple logo which wasn’t glowing initially started to glow.It stopped glowing by the door sound.Is there a possibility that my Laptop is hacked?
The laptop is MacBook Air 2015 model currently on Mac OS Mojave 10.14.6.
It was this thing which made me more suspicious:
When I did ssh to a specific IP in our network It showed a warning stating remote host identification has changed and that it could be man in middle attack
Has the MacBook been hacked
Security
Related Solutions
Popmoi, the last login on console is exactly that: Somebody (likely you) logged into a bash session on your computer at 2:02:18 on Sep 30. Generally, 'console' is shown for the first shell login and then ttys000 would be the next. I see this every login/reboot for my Terminal group, which opens two bash sessions in different tabs.
If you are absolutely certain that your Mac has been hacked I'd strongly recommend that you erase your hard drive, reinstall OS X and manually copy you data back from Time Machine:
- Back up your Mac.
- Restart and hold Command+R to enter OS X Recovery (http://support.apple.com/en-us/HT4718).
- Select 'Disk Utility' and reformat your hard drive (http://support.apple.com/kb/PH5849).
- Quit 'Disk Utility' and select 'Reinstall OS X'. Note that (from http://support.apple.com/en-us/HT4718):
Reinstalling OS X using Recovery requires broadband access to the Internet using a Wi-Fi or Ethernet connection. OS X is downloaded over the Internet from Apple when OS X Recovery is used for reinstallation. You must use DHCP on your Wi-Fi or Ethernet network to reinstall OS X using OS X Recovery. If you bought OS X from the Mac App Store, you may be prompted to enter the Apple ID and password you used to purchase OS X.
- When OS X is up and running, plug your external Time Machine drive, open it in Finder, open the folder named after your Mac and then the 'Latest' folder (http://www.macissues.com/2014/04/14/how-to-restore-files-from-time-machine-manually/).
- Browse to 'Applications' and copy non-Mac App Store applications back to '/Applications'. Note that some apps (for example VMware Fusion) won't work properly if copied, you must reinstall them with the installer provided by the manufacturer.
- Install Mac App Store applications from the App Store.
Browse to 'Users/[your username]' and copy Documents, Pictures, Movies, Music, and any other folder that contains important data to your new home folder.
I would refrain from copying 'Library', although that's where your settings are located. If you have iCloud Mail, Contacts, Calendars, Reminders, Safari, Notes and Keychain synchronization enabled most of your settings will rebuild themselves just fine. You may want to selectively copy application settings from 'Library/Application Support' after checking the files' contents.
- If you share your Mac with other people repeat steps 8. and 9. for their accounts.
iCloud synchronization is especially important for Keychain, and I talk from experience: I had a pretty hard time exporting and importing Keychain after installing OS X Yosemite from scratch without restoring from a Time Machine backup.
A piece of advice: It is best practice that the login account you use on a daily basis doesn't have administrative rights. You should create an administrative account instead. I usually call it admin:
while my account is 'Standard'. The side effect is that OS X will prompt you to type admin's password every now and then, for example to edit settings in System Preferences:
Good luck!
Best Answer
Yes, there's always a possibility that a laptop has been hacked. Are the observations you have cause for concern - not really.
macOS contains a feature named "Power Nap" which allows the Mac to wake itself up from sleep to perform routine activities for a short while, and then go back to sleep. This is stuff like receiving new emails, syncing calendars and iCloud documents - or when connected to a charger - downloading software updates, taking backups, etc.
You can read about the feature here:
https://support.apple.com/en-bn/HT204032
Regarding SSH remote host identification changed: You'll need to contact the owner/administrator of that host to confirm whether or not the remote host identification change is a problem or not. It can happen for completely benign reasons such as reinstalling the computer, changing SSH configurations, etc.
In addition, it doesn't mean that your computer has been hacked. Rather it means that someone could be tampering with the remote computer or the network in between.