Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was hacked one month ago - a person who borrowed my device installed a key logger.

Now, I have a new issue, sometimes when I open my computer in the morning, it is totally low battery, though it was full of battery when I left it and it was closed. Second, it appears that the last modification times of files are not correct. So I suspect the same person

How can I access the history of the activity of my mac for the last hours? Is there a way to detect those kinds of intrusion?

share|improve this question
1  
what OS? Besides, if you think you've been compromised, the only course of action is: backup, format, reinstall. –  Hubert Kario Nov 2 '12 at 10:34
    
@HubertKario He says it's his Mac, so I'm guessing OS X. Might be an older Apple OS version though. –  Polynomial Nov 2 '12 at 10:42
    
@Polynomial I noticed that, but people regularly run Windows or Linux on Apple hardware, we would still call this piece of equipment "a mac"... –  Hubert Kario Nov 2 '12 at 11:06
    
Excuse me, yes it is indeed os x –  Newben Nov 2 '12 at 12:15

3 Answers 3

up vote 1 down vote accepted

There are many ways to "access" a processes history, however none of them will be historic until after you configure the recording mechanism.

Specifically, you can research process tracing: http://www.cyberciti.biz/tips/ktrace-freebsd-macosx-tool-howto.html

But, first you will need to know WHICH process to monitor. If you just want to see all "current" activity try keeping top or something similar running [ in Mac-ese I guess that would be Activity Monitor or Process Viewer ]. Perhaps you'll get lucky and notice something.

Best, find an AV product you like, download the trial version and see if it finds anything malicious on your machine.

Your steps should be along the lines of:

  • unplug machine from network
  • wipe/re-install
  • use a trusted and secured network
  • download/install AntiVirus product
  • scan computer AND archived data

some notes:

  • the network in which your compromised computer was connected, is now also, by definition, compromised. Consider other machines/devices on that network as needing evaluation
  • best would be to install AV product via disc, however if your network is secure, downloading directly from vendor site is okay. Doing so at Starbucks is not ...
share|improve this answer
    
Thanks Daniel ! –  Newben Nov 2 '12 at 16:08

There are ways to detect intrusions which have not been done with all possible stealthiness, e.g. noticing abnormal battery usage or weird modification dates on files. A competent intruder will avoid leaving such clues, so this is not a reliable detection method, but if you actually see something fishy on the machine, then chances are that something fishy happens.

You say that the machine was compromised one month ago. Did you reformat it and reinstall the OS from scratch ? If you did not, then chances are that the machine is still compromised. You cannot be sure that whoever installed a key logger, installed only a key logger. For that matter, nor can that person be sure of it either. Key loggers are software created by people with at least partially malicious intent, and there is no limit to malice; something advertised as a key logger could also plant extra backdoors of its own, unknown to both the target user (you) and the wannabe hacker (the one who installed the key logger).

Thus, no salvation except by nuking the complete machine.

share|improve this answer
    
yes,I reformatted and reinstalled. But is there any way to access the recent process's activity ? –  Newben Nov 2 '12 at 12:16

You need to format the machine, reinstall everything from scratch, and change all your passwords.

Then, if you still see this suspicious poor battery life, you could run a process monitor to see what processes/applications are running. It's possible that there might be some programs running that are depleting the battery. Alternatively, it's also possible that your machine is just getting old. Over time, the battery loses capacity and starts to run out more quickly.

It's not clear what you mean by "last modification times of files are not correct" or how you know they are incorrect. We'd probably need a lot more detail about that before we could provide any evaluation of whether this truly does indicate a potential security compromise.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.