Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > Mac OS X > Is this indicative of hacking? (seriously)

Is this indicative of hacking? (seriously)
Thread Tools
Tee
Mac Enthusiast
Join Date: Oct 1999
Status: Offline
Reply With Quote
Sep 20, 2008, 12:03 AM
 
Noticed these entries in the console log of 10.4.11 PPC

2008-09-18 23:38:29.036 System Events[400] .scriptSuite warning for attribute 'currentUser' of class 'NSApplication' in suite 'SystemEvents': 'Accounts.User' is not a valid type name.
2008-09-18 23:38:29.037 System Events[400] .scriptSuite warning for to-many relationship 'loginItems' of class 'NSApplication' in suite 'SystemEvents': 'logi' is not the Apple event code of any known scriptable class.
2008-09-18 23:38:29.037 System Events[400] .scriptSuite warning for to-many relationship 'localUsers' of class 'NSApplication' in suite 'SystemEvents': 'uacc' is not the Apple event code of any known scriptable class.

Is this bad?
If not, what the heck is it?
     
Clinically Insane
Join Date: Oct 2001
Location: San Diego, CA, USA
Status: Offline
Reply With Quote
Sep 20, 2008, 03:06 AM
 
I don't see any reason to believe it's bad. It looks like some program is sending malformed Apple Events. What or why, I don't can't tell just from the log, but feel free to run any antivirus software if you're suspicious. ClamXav is free.
Chuck
___
"Instead of either 'multi-talented' or 'multitalented' use 'bisexual'."
     
Tee  (op)
Mac Enthusiast
Join Date: Oct 1999
Status: Offline
Reply With Quote
Sep 20, 2008, 05:23 AM
 
How can I figure out what is going on?
Those are the only entries like that in the Console logs and I haven't been able to reproduce them.
Doesn't it seem like something is trying to get access to account/login related info (ie passwords)?
     
Administrator
Join Date: Apr 2001
Location: San Antonio TX USA
Status: Offline
Reply With Quote
Sep 20, 2008, 07:07 AM
 
To figure out what's going on, go back in your logs to see where this behavior started, then see if you added any apps or changed any settings (particularly about apps automating their actions) before that point in time.

It is highly unlikely that someone has a) found a way to invade a Mac remotely without your ACTIVE cooperation, and b) that the way you'd find out about it is through a log file rather than something "interesting" like having something corrupted or lost, or getting some external indication like losing access to an online resource or forum. If you're really worried, change your Keyring password every other day or so until you get a warm-fuzzy feeling about the root cause of these log entries. But I think you're just seeing an app doing something poorly instead of evidence of something malicious. (On the other hand, it's a good idea to figure out what is causing these log entries so the rest of us know about it and maybe the software writer can fix his/her goof.)
Glenn -----
OTR/L, MOT, Tx
     
Tee  (op)
Mac Enthusiast
Join Date: Oct 1999
Status: Offline
Reply With Quote
Sep 20, 2008, 07:25 AM
 
I have not been able to reproduce the entries.
Is there some way to find out what app issued the commands which were logged by the console?
     
   
Thread Tools
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Top
Privacy Policy
All times are GMT -5. The time now is 01:38 AM.
All contents of these forums © 1995-2011 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.7 © 2000-2011, Jelsoft Enterprises Ltd., Content Relevant URLs by vBSEO 3.3.2