macOS Security – Chinese Username Writing Files into ‘Users’ Folder

hackinghigh sierramacosSecurityxcode

I'm the single user of my personal MacBook (macOS High Sierra 10.13.3 (17D102)), using it only inside my single apartment, not inside a network, not connected to anything beside my router, and a user called "Linchengzang" has created a user folder inside my filesystem and is writing Xcode files into it.

The user is not know to the system. I never used Xcode (but I am a developer), and I didn't install any software in the last few days, but these files and folders appered within the last few hours.

It's creepy that these files have suspicios names, all related to auth things.

Can somebody please give me a hint what is going on here ?

Big thanks!

Best Answer

I finally found the answer by myself and can reproduce the above scenario: The official wallet software of the cryptocurrency Bytecoin is creating this user and these files.

Not sure if this is legit or part of a scam :/

Related Solutions

MacOS – File named zero

You might try running the command

sudo dtrace -qn 'syscall::open:entry /arg1&O_CREAT/ {printf("%5d %s file:%s\n",pid,execname,copyinstr(arg0));}' | grep '[:/]0$'

in a terminal window. The dtrace output will list the process ID, process name, and filename argument for any open() call with the O_CREAT flag set, meaning it will create the file if it does not already exist. Drop the final grep bit if you want to see all potentially file creating open() calls, but then the output might possibly overwhelm you. Hit ctrl-C when you're done with it.

If something keeps creating files named 0, the culprit ought to show up in the output.

(Edit: Fixed the grep invocation.)

MacOS – Xcode 4.2 Snow Leopard Doesn’t Install

Just change date to January 2012 or something, it will install just fine. The certificate expired in March.

Updated, steps:

turn off automatic synchronization of date & time
change actual date of the system to 01.01.2012 (for example, prior to 26.03.2012)
install the Xcode
turn the automatic synchronization back on.

Best Answer

Related Solutions

MacOS – File named zero

MacOS – Xcode 4.2 Snow Leopard Doesn’t Install

Related Question