I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards.
Normally, Little Snitch will report every app that uses the internet. Every time my router light flashes, Little Snitch shows the app (or system) that is doing it.
After I allowed this person to insert his USB drive into my Mac, the router shows an occasional flash or two that does not show up in Little Snitch. Even Activity Monitor shows the data being sent out, but Little Snitch doesn't show the app doing it.
I inserted my system disks and did a restore from a time machine backup that occurred before the USB was put in. I completely formatted and restored the drive.
The router and activity monitor still show the occasional network activity.
So my questions are:
How can I find out what is sending out the data?
Since I restored from an earlier time machine backup, I can only assume the firmware was modified...so how do I verify it wasn't? Is there a way to run a check sum or hash check? Is there something else I should be checking or considering?
I'm assuming this person was able to observe my admin password and would have full access to the machine.
At this point I'm considering getting a new mac altogether as I don't know how to stop or at least determine what this outbound traffic is. I'm grateful for any help (because new Macs aren't cheap).