Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Software - Troubleshooting and Discussion > macOS > Scary OS X behavior

Scary OS X behavior
Thread Tools
UNTeMac
Mac Elite
Join Date: Jan 2001
Location: Denton, TX
Status: Offline
Reply With Quote
Mar 15, 2006, 08:59 PM
 
I left my apartment last week with my room door locked and my computer off. I come back and find my computer on, awake, and logged in as root with the login window sitting on top of everything. Does this mean someone got in over the network? How did they turn on my computer?
"This show is filmed before a live studio audience as soon as someone removes that dead guy!" - Stephen Colbert
     
Tomchu
Mac Elite
Join Date: Sep 2005
Status: Offline
Reply With Quote
Mar 15, 2006, 09:03 PM
 
What do you mean "logged in as root" with the login window sitting on top of everything?

Like literally a desktop, Dock, etc. running under the root account, and then a login window plastered over top of the desktop?
     
rjenkinson
Professional Poster
Join Date: Sep 2000
Status: Offline
Reply With Quote
Mar 15, 2006, 09:16 PM
 
do you have roommates?

-r.
     
Chuckit
Clinically Insane
Join Date: Oct 2001
Location: San Diego, CA, USA
Status: Offline
Reply With Quote
Mar 16, 2006, 02:53 AM
 
It was both logged in and at the login screen? Huh? Like, you have both root and fast user switching enabled and the root account had the icon next to it?
Chuck
___
"Instead of either 'multi-talented' or 'multitalented' use 'bisexual'."
     
UNTeMac  (op)
Mac Elite
Join Date: Jan 2001
Location: Denton, TX
Status: Offline
Reply With Quote
Mar 23, 2006, 11:01 AM
 
Originally Posted by Tomchu
What do you mean "logged in as root" with the login window sitting on top of everything?

Like literally a desktop, Dock, etc. running under the root account, and then a login window plastered over top of the desktop?
There was a Finder window with the root home folder sitting open. Somehow, I got the the finder windows behind the login window and clicked the apple menu. The logout option was "Logout System Administrator" I logged out, and then logged in as normal.
"This show is filmed before a live studio audience as soon as someone removes that dead guy!" - Stephen Colbert
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Mar 23, 2006, 11:48 AM
 
Check NetInfo Admin to see if root is enabled. If it is, someone knows your admin password. And if it isn't, something's very strange.

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
Tomchu
Mac Elite
Join Date: Sep 2005
Status: Offline
Reply With Quote
Mar 23, 2006, 02:25 PM
 
I'm willing to bet it was a friend playing a prank. It could have also been a screenshot set as the wallpaper that possibly contributed to the effect in some way.
     
jasong
Mac Elite
Join Date: Mar 2000
Location: Allston, MA, USA
Status: Offline
Reply With Quote
Mar 23, 2006, 03:15 PM
 
Do you have your computer set to turn on at a certain time? It's not possible to send a remote command to a computer that is truly powered off without using special network cards designed to remotely kill and bring back a locked up server. I doubt you have one of those, so either you didn't turn off your computer when you left, someone broke in and did nothing but turn on your computer, or your computer is set to turn itself on at a certain time and log in automatically in which case the only thing scary here is your memory.
-- Jason
     
jasong
Mac Elite
Join Date: Mar 2000
Location: Allston, MA, USA
Status: Offline
Reply With Quote
Mar 23, 2006, 03:19 PM
 
Oh wait, I thought of something else, do you have your computer set to turn back on after a power loss? If so, maybe you had a power outage? I think if the machine is already off when the power goes out it won't turn on when restored, but I have a powerbook, so my computer doesn't die when the power does.
-- Jason
     
UNTeMac  (op)
Mac Elite
Join Date: Jan 2001
Location: Denton, TX
Status: Offline
Reply With Quote
Mar 23, 2006, 05:48 PM
 
Thanks for the replies.

root is enabled on my computer and it was scheduled to start up everyday at 7:30am. The door to my room was locked so no one had physical access to my computer. It wasn't a wallpaper because I was able to get to the actual finder interface and logout the System Administrator account.

How do I change my root password? It's different than my own user account password? Also, how do I disable root?
"This show is filmed before a live studio audience as soon as someone removes that dead guy!" - Stephen Colbert
     
P
Moderator
Join Date: Apr 2000
Location: Gothenburg, Sweden
Status: Offline
Reply With Quote
Mar 23, 2006, 06:32 PM
 
The root account is an account of its own, so you can change that password any way you can change the password on your regular account when logged in. You can also use the "passwd" terminal command.

To disable root, use the NetInfo Manager in the Utilities Folder of your Applications folder. On one of the menus is an option to enabel or disable root.
     
JKT
Professional Poster
Join Date: Jan 2002
Location: London, UK
Status: Offline
Reply With Quote
Mar 23, 2006, 06:34 PM
 
In /Applications/Utilities, open Netinfo Manager. Under the Security tab on my system, there are three headings:

Authenticate
Change Root password...
Enable Root User

I suspect that the last option will be Disable Root User on your system though I don't know for sure. If it is, you will need to select Authenticate, enter an admin user and password and then you should be able to select the Disable Root User option.

There is bound to be a Terminal method of achieving the same. Try searching e.g. macosxhints.com if the above doesn't work.

Edit: Simulposting with P
     
cybergoober
Mac Elite
Join Date: Jun 2003
Location: Newport News, VA USA
Status: Offline
Reply With Quote
Mar 24, 2006, 10:50 AM
 
Hmmmmm. You don't have Patchlink installed on your system do you?

A nasty (potentially) bug has been discovered recently where Patchlink spawns a Finder process as root, giving anyone who walks up to the system full, unrestricted system access. Root doesn't even need to be enabled for this to occur.
     
UNTeMac  (op)
Mac Elite
Join Date: Jan 2001
Location: Denton, TX
Status: Offline
Reply With Quote
Mar 24, 2006, 11:46 AM
 
No patchlink installed.

I've now changed my root password and main user account passwords. Filevault is also enabled. Not sure what else I could do to secure my system in case this really was a hack.
"This show is filmed before a live studio audience as soon as someone removes that dead guy!" - Stephen Colbert
     
   
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 03:21 AM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,