Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Using the "Console" app within OS X and viewing the "syslog" file I can see the user shutdown their laptop (it was a HALT operation) around 10:22PM. For some reason, 9 seconds after midnight (12:00:09) the machine would boot up on its own. I looked through the log files to see if it was doing something suspicious. I saw the launch process followed by an mDnsResponder process, followed by a process trying to connect to the wifi network, followed by iCal, MobileMe, processes trying to perform a synchronization. Nothing really looked like it was doing something bad.

But why would the computer be starting up on it's own every night at exactly the same time?

Are there any good apps out there I can use to see if the machine has been hacked?

Is there a way I can temporarily "harden" the machine to see if the behavior disappears?

What are good command line utilities I can use to gather all / any information?

share|improve this question
    
This question might be better suited on superuser.com –  Hammo Jun 21 '13 at 2:20

2 Answers 2

up vote 3 down vote accepted

I saw the launch process followed by an mDnsResponder process, followed by a process trying to connect to the wifi network, followed by iCal, MobileMe, processes trying to perform a synchronization.

There you have it. The machine was probably calling home to update the various applications whose data reside in Apple's cloud somewhere. I really doubt it's anything malicious.

If you are really worried, start up wireshark and monitor the network traffic during that time.

share|improve this answer
    
But none of this should happen if the computer is turned off. Why would it boot up like this? What if I don't want it to boot up automatically? –  user1068636 Jun 21 '13 at 3:36

Macs can be scheduled to power on at a given time; pmset -g sched lists these times, though they're also in the file /Library/Preferences/SystemConfiguration/com.apple.AutoWake.plist

You can cancel these startups/wakeups using pmset schedule cancel <details>, or the Energy Saver preference pane under "Schedule...".

I agree with Terry's answer, that the likely root cause is that the Mac is signed up for MobileMe. It has its own preference panel.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.