Welcome to the MacNN Forums.

Tyler McAdams · Sep 1, 2004, 07:41 PM

I was not even on my computer... I just walked in my room and all of a sudden my desktop prefs system prefs window just popped up... Is my computer hacked? Why the fsck my window prefs?

ManOfSteal · Sep 1, 2004, 07:53 PM

That's peculiar.

Tyler McAdams · Sep 1, 2004, 08:37 PM

Originally posted by manofsteal:
That's peculiar.

To say the least... I'm going to kill... somebody if they're on my machine.

chris v · Sep 1, 2004, 09:10 PM

Well, you CAN ssh into a machine and use the 'open' command to launch apps or files on that machine, but I have no idea if you could launch the preferences for an app remotely.

(I made a .rtf file that say's "Time to go to bed!" and I'll pop it on my kid from the living room sometimes, just for fun.

Tyler McAdams · Sep 1, 2004, 09:48 PM

Originally posted by chris v:
Well, you CAN ssh into a machine and use the 'open' command to launch apps or files on that machine, but I have no idea if you could launch the preferences for an app remotely.

(I made a .rtf file that say's "Time to go to bed!" and I'll pop it on my kid from the living room sometimes, just for fun.

I have ssh disabled... and everything else for that matter... it's either a very big bug, my machine it psychic or somebody is screwing around with me.... more than likely it's the last. 2 firewalls, snort, and tripwire. But physical access to the machine is rather easy. About a week ago I came in to my house to see my computer and all the perifs out of order... when I asked my little bro he said one of my frat bros came over to use my camera... Tonight I told him to kill anybody who touched my computer.

I've got financial records and sensive data on that computer. I don't want anybody but myself on the computer. That's why it's in my room...sheesh.

And you people wonder why I'm so crazy...

ManOfSteal · Sep 1, 2004, 09:50 PM

You should lock down your screen and/or use FUS to swich to another user (standard account with limitations) when you are gone in that case then...

chris v · Sep 1, 2004, 09:51 PM

Originally posted by Tyler McAdams:
I have ssh disabled... and everything else for that matter... it's either a very big bug, my machine it psychic or somebody is screwing around with me.... more than likely it's the last. 2 firewalls, snort, and tripwire. But physical access to the machine is rather easy. About a week ago I came in to my house to see my computer and all the perifs out of order... when I asked my little bro he said one of my frat bros came over to use my camera... Tonight I told him to kill anybody who touched my computer.

I've got financial records and sensive data on that computer. I don't want anybody but myself on the computer. That's why it's in my room...sheesh.

And you people wonder why I'm so crazy...

Log out when you leave. Duh.

Tyler McAdams · Sep 1, 2004, 10:05 PM

Originally posted by chris v:
Log out when you leave. Duh.

I leave my computer on with the screensaver locked. That should be good enough.

But why my system prefs pane?

Tyler McAdams · Sep 1, 2004, 10:05 PM

Originally posted by manofsteal:
You should lock down your screen and/or use FUS to swich to another user (standard account with limitations) when you are gone in that case then...

FUS? What does that stand for?

ManOfSteal · Sep 1, 2004, 10:08 PM

Originally posted by Tyler McAdams:
FUS? What does that stand for?

Fast-User Switching.

Tyler McAdams · Sep 1, 2004, 10:52 PM

Originally posted by manofsteal:
Fast-User Switching.

Ok... I've got that on. But back to that logging out thing... I should not have to worry about that since whatever happend was by remote access. Logging out is not a security fix. There's an issue at hand that needs to be resovled.

chris v · Sep 2, 2004, 08:19 AM

What proof do you have that someone remotely accessed your machine? You really think someone broke in through your firewall and user passwords from another machine just to launch your Finder prefs pane? (not that it's impossible, but I find it highly improbable, unless you've got ports open, AND someone knows your password)

I'm not an expert on this, but it there a log somewhere that lists users and IP addresses that they logged in from, like 'w' in Terminal, but historical?

Besides, above, you said the problem was "physical access," hence my "log out" comment. Are you using your bithday for a password or something? Maybe one of your "friends" has guessed it, and you just need to change it to something more random.

Tyler McAdams · Sep 2, 2004, 06:57 PM

Originally posted by chris v:
What proof do you have that someone remotely accessed your machine? You really think someone broke in through your firewall and user passwords from another machine just to launch your Finder prefs pane? (not that it's impossible, but I find it highly improbable, unless you've got ports open, AND someone knows your password)

I'm not an expert on this, but it there a log somewhere that lists users and IP addresses that they logged in from, like 'w' in Terminal, but historical?

Besides, above, you said the problem was "physical access," hence my "log out" comment. Are you using your bithday for a password or something? Maybe one of your "friends" has guessed it, and you just need to change it to something more random.

I have no proof... but it was really really odd... no? If it was a hacker I'm sure they wopuld have deleted/modified any logs if they knew what they were doing.

What the oddest part about the whole thing is that I had spent my entire day configuring the XF86config window manager settings on my linux box.... setting up dual head twinview... messing around with resolution settings... then I finish... I come downstairs from my office to my bedroom to my mac and all of a sudden the window prefs window pops open right in front of me, w/o me touching my mac at all...

I look at it and it pops out as if to say "would you like to configure me too?"

chris v · Sep 2, 2004, 07:58 PM

Originally posted by Tyler McAdams:
I have no proof... but it was really really odd... no? If it was a hacker I'm sure they wopuld have deleted/modified any logs if they knew what they were doing.

What the oddest part about the whole thing is that I had spent my entire day configuring the XF86config window manager settings on my linux box.... setting up dual head twinview... messing around with resolution settings... then I finish... I come downstairs from my office to my bedroom to my mac and all of a sudden the window prefs window pops open right in front of me, w/o me touching my mac at all...

I look at it and it pops out as if to say "would you like to configure me too?"

Keep a Terminal window open. If you're there when the suspicious activity takes place, then real quick, type a simple w in a terminal window, and it'lll list who's logged in, and from where.

In the meantime, delete any unneccessary user accounts, turn off all the sharing options, both in the Sharing prefs, and in Directory Accesss, and change your passwords. Go over your router, too. You haven't set your Mac as a DMZ on your router, have you? Unplug the router for a while, so you get assigned a new IP adress.

I'd be extremely surprised if someone was able to hack in with it locked down as such, without having a password of some sort.

Tyler McAdams · Sep 3, 2004, 04:06 AM

Originally posted by chris v:
Keep a Terminal window open. If you're there when the suspicious activity takes place, then real quick, type a simple w in a terminal window, and it'lll list who's logged in, and from where.

In the meantime, delete any unneccessary user accounts, turn off all the sharing options, both in the Sharing prefs, and in Directory Accesss, and change your passwords. Go over your router, too. You haven't set your Mac as a DMZ on your router, have you? Unplug the router for a while, so you get assigned a new IP adress.

I'd be extremely surprised if someone was able to hack in with it locked down as such, without having a password of some sort.

That's good advice. Thanks for the help.

Who ever it is, if it's not a bug, I might be going to jail for, bc I'm going to kill them. People never learn until they've been beaten into retardation... so it'll be my duty to help keep whoever it is in their prestine retarded state for the reset of their life. My computer is holy and sacred to me (thus the chime at boot time)... it's not for Everquest or porn surfing, it's for my private usuage and that's how it's going to stay.

Appleman · Sep 3, 2004, 06:08 AM

Originally posted by Tyler McAdams:
Ok... I've got that on. But back to that logging out thing... I should not have to worry about that since whatever happend was by remote access. Logging out is not a security fix. There's an issue at hand that needs to be resovled.

How can I log in if I do not know your password? (not remotely, but being your brother f.i. being at your Mac).

Tyler McAdams · Sep 3, 2004, 09:50 AM

Originally posted by Appleman:
How can I log in if I do not know your password? (not remotely, but being your brother f.i. being at your Mac).

You could use some sort of hack tool to decrypt the hash... off hand in the windows world you could boot to knoppix (which is avail for powerpc) get he hash files (sam file in windows... etc shadow in unix) and use a program like lophtcrack or jack the ripper to break the hash encryption. But this is not my brother's work... he's too dumb for this. this is either him and somebody else. the FBI and a van outside my house... or somebody trying to get my attention. Or best case one freaky bug.

Whatever the case, I'm going to crack somebody's head. There's really only one thing I value... and that's my privacy, you can have the money, the fame, the fast cars, the beach house, I really don't give a fsck.

So whatever the case... wow you must be 1337. killer dude, I'm so impressed. Now leave me the fsck alone jackA$$... thanks.

(not you, Appleman... unless you broke in, lol)