MacBook – Is the computer being controlled

macbook pro

I recently encountered a person on Skype that I don't know. I've heard about people being able to access your computer remotely. How can I tell if my computer has been compromised?

Best Answer

Applications like Little Snitch can be very useful for figuring out if your computer has been compromised, as they can detect incoming and outgoing connection attempts.

I would say that most likely the appearance of an unexpected person on Skype is just due to a spammer or scammer adding people at random from a list of names or email addresses. It's also possible that it's a case of mistaken identity, where the person on the other end is trying to contact someone with a similar name. Be wary of social engineering attempts, and do not open any links or attachments from this person!

If the person is bothering you or you're just weirded out, you can block the individual by right-clicking their contact portrait and choosing "Block (name)...".

Related Solutions

MacBook – Problem with malicious Traffic in the MacBook

The malware may be transmissible by macs, it's uncertain. Regardless, you might, in addition to checking DHCP:

Ensure that your search domains in Directory Utility are not set to "Automatic", which will leave you open to rogue DHCP servers on your network.
Consider arpsniff or ArpSpyX or some modern equivalent. Those rogues would gain access possibly via ARP poisoning ( google that)
Little Snitch or some other application firewall would be useful here as well.
Turn off Xgrid, in fact, turn off sharing unless you are using it.

MacBook – My MacBook was stolen: can the thief access the files without the account password

I'm sorry your MacBook was stolen. That really sucks.

Sadly, there are numerous ways to read the data ranging from removing the drive or placing the Mac in target mode. Your password only protects things when the mac is booted into your unmodified OS.

To answer your question, Physical access is total access.

It would be trivial for someone to boot using a Linux LiveCD and mount your drive, thus accessing your files. All they'd have to do to get past your sleep/password would be to hard power down the system.

Additionally, from the link above:

Mac OS X: Single User Mode

To boot a Mac into “Single User mode”, simply boot the computer and press Apple + S when blue first shows up on the screen. Next, mount the harddrive, and either dump the password and crack it with a tool like John the Ripper, or simply overwrite the root password:
# /sbin/mount -wu /
# /sbin/SystemStarter
To dump the existing root password:
# nidump passwd
To create a new root password:
# passwd root

Best Answer

Related Solutions

MacBook – Problem with malicious Traffic in the MacBook

MacBook – My MacBook was stolen: can the thief access the files without the account password

Related Question