[sfcaine]

Hi, new to the forums, so excuse the lack if proper etiquette, if any..

I recently have been monitoring my firewall logs, because my facebook got hacked. Even before that, my mac was running unfathomably slow..

When I tried unlocking my facebook, it said that the access point was in Cambodia....definitely never been there. I guess my hacker probably hasn't either, and is just using a fake IP...

Anyways, I'm concerned especially since when I tried logging into facebook, I got a "cannot find server" page (perhaps it's an "evil twin" style attack, which means any new password I create could be comprimised..)

Here's what the log looks like:


Sep 30 01:48:13 wireless-224-156 Firewall[62]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 501 proto=6
Sep 30 01:48:19 wireless-224-156 Firewall[62]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 01:48:19 wireless-224-156 Firewall[62]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 01:48:45 wireless-224-156 Firewall[62]: AppleFileServer is listening from :::548 uid = 0 proto=6
Sep 30 01:48:45 wireless-224-156 Firewall[62]: AppleFileServer is listening from 0.0.0.0:548 uid = 0 proto=6
Sep 30 08:57:21 matthew-lemieuxs-macbook Firewall[62]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 08:57:21 matthew-lemieuxs-macbook Firewall[62]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 08:57:28 wireless-224-156 Firewall[62]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 08:57:28 wireless-224-156 Firewall[62]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 09:05:20 wireless-224-156 Firewall[62]: Allow AppleVNCServer connecting from 128.135.224.68:52348 uid = 0 proto=6
Sep 30 09:05:50: --- last message repeated 1 time ---
Sep 30 10:04:54 wireless-224-156 Firewall[62]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 0 proto=6
Sep 30 10:23:41 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 10:23:41 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 10:23:50 wireless-224-156 Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 10:23:50 wireless-224-156 Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 10:23:56 wireless-224-156 Firewall[74]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 0 proto=6
Sep 30 10:33:53 wireless-224-156 Firewall[74]: Allow AppleVNCServer connecting from 128.135.224.68:55249 uid = 0 proto=6
Sep 30 10:34:05: --- last message repeated 1 time ---
Sep 30 10:34:05 wireless-224-156 Firewall[74]: Allow AppleVNCServer connecting from 128.135.224.68:55237 uid = 0 proto=6
Sep 30 10:34:16: --- last message repeated 2 times ---
Sep 30 10:34:16 wireless-224-156 Firewall[74]: Allow AppleVNCServer connecting from 128.135.224.68:55256 uid = 0 proto=6
Sep 30 10:34:22: --- last message repeated 2 times ---
Sep 30 10:34:22 wireless-224-156 Firewall[74]: Allow AppleVNCServer connecting from 128.135.224.68:55246 uid = 0 proto=6
Sep 30 10:34:52: --- last message repeated 2 times ---
Sep 30 11:48:27 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 11:48:27 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 11:48:29 wireless-224-156 Firewall[74]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 501 proto=6
Sep 30 11:48:33 wireless-224-156 Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 11:48:33 wireless-224-156 Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 11:53:11 wireless-224-156 Firewall[74]: Allow AppleVNCServer connecting from 128.135.169.134:54296 uid = 0 proto=6
Sep 30 12:33:52 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:33:52 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:33:57 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:33:57 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:34:15 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:34:15 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:34:22 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:34:22 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:34:29 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:34:29 matthew-lemieuxs-macbook Firewall[74]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:48:07 matthew-lemieuxs-macbook Firewall[74]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 0 proto=6
Sep 30 12:52:07 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:52:07 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:52:09 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:52:09 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 12:52:10 wireless-224-156 Firewall[48]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 0 proto=6
Sep 30 12:52:16 wireless-224-156 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 12:52:16 wireless-224-156 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 13:19:52 wireless-224-156 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 13:19:52 wireless-224-156 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 13:19:54 wireless-224-156 Firewall[48]: AppleVNCServer is listening from ::ffff:0.0.0.0:5900 uid = 501 proto=6
Sep 30 13:19:55 wireless-224-156 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 13:19:55 wireless-224-156 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 13:21:00 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 13:21:00 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 13:21:06 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 13:21:06 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 13:21:12 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 13:21:12 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:35:43 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:35:43 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:35:50 wireless-224-156 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:35:50 wireless-224-156 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:35:55 wireless-224-156 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:35:55 wireless-224-156 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:36:05 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:36:05 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:36:08 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:36:08 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:42:55 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:42:55 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 14:42:58 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 14:42:58 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 19:22:02 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 19:22:02 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 19:22:05 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 19:22:05 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 22:50:55 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 22:50:55 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Sep 30 22:50:58 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Sep 30 22:50:58 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Oct 1 00:43:33 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Oct 1 00:43:33 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Oct 1 00:43:36 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Oct 1 00:43:36 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Oct 1 01:29:29 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Oct 1 01:29:29 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Oct 1 01:29:35 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Oct 1 01:29:35 matthew-lemieuxs-macbook Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Oct 1 01:29:41 wireless-205-208-125-207 Firewall[48]: krb5kdc is listening from :::88 uid = 0 proto=6
Oct 1 01:29:41 wireless-205-208-125-207 Firewall[48]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 2 23:10:59 new-host-3 Firewall[52]: Deny nmbd data in from 192.168.1.2:137 uid = 0 proto=17
Aug 2 23:10:59 new-host-3 Firewall[52]: Deny nmbd data in from 192.168.1.3:137 uid = 0 proto=17
Aug 2 23:11:00 new-host-3 Firewall[52]: Deny nmbd data in from 192.168.1.2:137 uid = 0 proto=17
Aug 2 23:11:00 new-host-3 Firewall[52]: Deny nmbd data in from 192.168.1.3:137 uid = 0 proto=17
Aug 2 23:32:19 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.3:61898 uid = 0 proto=6
Aug 2 23:32:19 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.3:61899 uid = 0 proto=6
Aug 3 00:55:35 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.13:49156 uid = 0 proto=6
Aug 3 00:55:35 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.13:49157 uid = 0 proto=6
Aug 3 00:55:35 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.13:49158 uid = 0 proto=6
Aug 3 01:02:56 new-host-3 Firewall[52]: java is listening from ::ffff:0.0.0.0:0 uid = 501 proto=6
Aug 3 08:02:41 new-host-3 Firewall[52]: krb5kdc is listening from :::88 uid = 0 proto=6
Aug 3 08:02:41 new-host-3 Firewall[52]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 3 08:02:46 new-host-3 Firewall[52]: krb5kdc is listening from :::88 uid = 0 proto=6
Aug 3 08:02:46 new-host-3 Firewall[52]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 3 08:03:46 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.3:55536 uid = 0 proto=6
Aug 3 08:03:46 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.3:55537 uid = 0 proto=6
Aug 3 08:03:46 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.3:55538 uid = 0 proto=6
Aug 4 14:52:09 matthew-lemieuxs-macbook-2 Firewall[52]: krb5kdc is listening from :::88 uid = 0 proto=6
Aug 4 14:52:09 matthew-lemieuxs-macbook-2 Firewall[52]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 4 14:58:48 matthew-lemieuxs-macbook-2 Firewall[52]: krb5kdc is listening from :::88 uid = 0 proto=6
Aug 4 14:58:48 matthew-lemieuxs-macbook-2 Firewall[52]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 4 14:58:53 new-host-3 Firewall[52]: krb5kdc is listening from :::88 uid = 0 proto=6
Aug 4 14:58:53 new-host-3 Firewall[52]: krb5kdc is listening from 0.0.0.0:88 uid = 0 proto=6
Aug 4 15:00:01 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.2:60951 uid = 0 proto=6
Aug 4 15:00:01 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.2:60952 uid = 0 proto=6
Aug 4 15:00:01 new-host-3 Firewall[52]: Allow smbd connecting from 192.168.1.2:60953 uid = 0 proto=6
Aug 4 15:06:11 new-host-3 Firewall[52]: Stealth Mode connection attempt to TCP 192.168.1.4:54230 from 23.0.252.106:443
Aug 4 15:06:11 new-host-3 Firewall[52]: Stealth Mode connection attempt to TCP 192.168.1.4:54231 from 23.0.252.106:443
Aug 4 15:57:56 new-host-3 Firewall[52]: Stealth Mode connection attempt to UDP 192.168.1.4:61660 from 192.168.1.7:50496


I have no idea why the months are so screwed up, but as you can see, I only turned on my firewall and stealth mode in the past day or so.
I guess I'd like to not go through the pain of a system restore, but I will do so unless I can guarantee that my mac will be 100%

[mduell]

What is your question here?

First your facebook is hacked, then your mac is running slow, then you have some connectivity issue, then you're worried about evil twins, then you post some giant logfile dump, then you're considering a system restore... what?

[sfcaine]

My goodness, I suppose I was mistaken. For some reason, I thought this was a site where other respectable, knowledgeable people helped other (usually less-knowledgeable) people work through problems, and not a forum for demonstrating how one can most concisely make an ass of oneself in a couple lines of text.

Just in case someone else was honestly mistaken, like myself, I should be more clear for them:
-I'd like to know if my computer has been compromised, and if so, if it can be cleaned without performing a system restore.

-I have decent evidence that my system was compromised, including dramatic decrease in speed (before the facebook hack, as noted), my facebook was hacked when I only access it from this device only, the redirection to a 'server not responding' page after typing in passwords to a couple websites, and a great increase in speed after going into stealth mode.

-I'll refrain from posting any more log files, but please feel free to ask for any relevant ones.

-(As noted), I am new to the forums. Please do feel free as well to welcome me in a way that's un-4chan-y

[Spheric Harlot]

Hey, at least he didn't post photochopped porn of your girlfriend with a horse getting his head ripped off by Sarah Palin with a chainsaw.

[sfcaine]

Yes, that was its one sparing grace.

[mduell]

You probably haven't been compromised, and if you are you probably can't clean it up without a system restore.

Facebook hacking isn't particularly indicative, especially if you use public wifi or have a weak password or use the same password on other sites that have been compromised, etc.

Are you using Safari? It's notorious for showing the server not responding error for no particular reason.

Stealth mode is unlikely to significantly alter the performance of your machine; all it does it not reply to connection attempts instead of saying no.

And now, porn of your girlfriend with a horse getting his head ripped off by Sarah Palin with a chainsaw.

[Spheric Harlot]

Your link isn't working...

[sfcaine]

Yes, I am a Safari user, and I considered that I possibility. I just was already in suspicious mode when facebook asked me if I signed in from Cambodia...

When I said that my speed improved by using stealth mode, I was implying that the attacker could no longer reconnect with my computer (assuming he already had) if it was not responding. But then again, that might not make sense if he has already connected...I am unsure.

Anyway, thanks for the help!

[chocolatemalt]

The "Stealth Mode connection attempt to ..." firewall messages are most likely legit packets that are being refused due to long delays or an app (e.g. browser) that you shut down, thereby closing the host-based firewall hole. A few of your logs show the sender as "23.0.252.106:443" which is simply Akamai using https, extremely unlikely to be a hacker. These are just stray packets from the browser you just quit.

However, did you start a VNC server for any reason? This can be useful for remote control of your Mac from another PC of yours, for spanning desktops, etc, but if you're unaware of this then you should have alarm bells ringing. VNC is a common hackers' backdoor, and if you got infected via some other route it's possible for a hacker (or botware) to have started up a local VNC server to control you. Check out http://www.dssw.co.uk/blog/2010/08/13/setting-up-the-vnc-server-in-mac-os-x-10-6/ for a walk-thru on the current settings.

[sfcaine]

So yes, I did figure that the stealth connection attempts were legit packages, since they started coming from google.

As to the second point. I've never heard of a VNC server until you mentioned it now (though I wish I did, this actually sounds cool if you're not getting hacked).
When I checked the settings, I see that it is not enabled, but screen sharing was (I did that); does it look to you like VNC was ever enabled?
General questions: - can a VNC server operate one's computer remotely if the computer is closed or asleep? (ie, can it 'wake it up'?)
- Could skype conversations in which screen sharing took place trigger such a warning sign?
- If the worst should have happened -- an attack via VNC -- could I ensure it won't happen again on this machine without performing a system restore? (my original inquiry)

Thanks for your help!

[chocolatemalt]

Skype might explain it. To be safe (paranoid) you might want to disable screen sharing until required. Adopt a "default deny" philosophy on all firewall permissions -- if you don't need it, disable it.

For more info you could look into "netstat -a | egrep -i estab" or just "netstat -a" (or "netstat -an" if dns is too slow) for any suspicious connections, then follow up with "whois" and "mtr" on the IPs, but this can get time-consuming and require quite a bit of research on the basics of TCP/IP to make sense of. Shut down extraneous apps if you go this route in order to reduce noise. A more thorough analysis can be done with tcpdump or Wireshark (friendlier but still complex).

[mduell]

Originally Posted by sfcaine 

- If the worst should have happened -- an attack via VNC -- could I ensure it won't happen again on this machine without performing a system restore? (my original inquiry)

No, there's nothing you can do to prevent others from attempting to connect to you.