I had recently upgraded from OS X 10.10 (Yosemite) to OS X 10.11 (El Capitan) from a bootable drive that the Genius Bar of one of the my city's Apple stores has, and I installed the 10.11.1 update from my home wifi network. The Macbook I currently use is about a month old. I practise safe browsing practices and I have Little Snitch installed.
I've been (maybe overly) paranoid recently because on my old machine, I was definitely compromised due to cracked software (lesson learnt), so I erased the hard drive and reinstalled the OS from a bootable drive at an Apple approved repair centre, but I kept noticing behaviour I would deem suspicious. Reinstalling the OS from a base backup, changing all passwords, then noticing strange behaviour. Just an endless cycle of doing this.
And even on this new Macbook. After another erase of the HD and a reinstall from a base backup I made at the Apple store for this new Macbook, I've been noticing strange or suspicious behaviour. In this instance, I signed into iCloud on my Macbook and my iPhone where I removed all calendar entries previously added and manually re-added all entries after the process of changing all my passwords. This was at night time.
So far, so good. The next morning when I turn my Macbook on for the first time of the day and check my calendar, one entry was edited that I definitely did not and would not edit. I narrowed down the time of the edit between the night I re-added all my entries and when I turned on my Macbook for the first time the next day - I did so by restoring the latest backup of the calendar (dated 'today XX:XXam') that is available when one signs into iCloud via a browser (the backup had the edit I did not make).
Now, I use Little Snitch to monitor network activity. I don't notice anything unusual when I'm actually using my Macbook (except for maybe a random connection attempt to google.com on port 80 when all my Google connections are via port 443?).
But given that potentially, whoever/whatever could've edited my calendar entry did so when I was asleep and my Macbook wasn't on, observing Little Snitch for unusual network activity when I'm actually using my Macbook would be pointless, yes?
I'm not sure what to do at this point. I've erased and reinstalled many times and I always notice something worthy of suspicion.
It's not a shared calendar and I haven't wilfully given anyone my Apple ID details.
If this compromise wasn't still freaking me out a little bit, the "strange behaviour" probably wouldn't be considered strange. Sometimes I think I'm clicking the keyboard shortcut for a new tab. But Chrome closes the current open window, yet the application is still open. When I click the application icon in my dock, the window with everything I browsing pops back up. Generally speaking, you would see that minimised browser in your dock, but it never does appear there. Also just jittery/quick up/down movements in Chrome at speeds not observed by normal keyboard up/down shortcuts. This could just be a bug in Chrome itself but I'm not too sure. Sometimes I would get connection alerts for websites I am 100% sure I would've made permanent the first time I got them. It could be a dev bug, but given that making rules about what you allow/deny permanent is a really important part of LS, I figure the devs would make strides to fix it ASAP if it was a bug.
The automatic backup before the one with the strange edit is irrelevant because it was a backup of when I had made a previous restore.
Let's assume this base backup I made at the Apple store (the reinstalled OS, four third-party applications [Chrome, Little Snitch, Flux and the Spotify laptop app] all directly downloaded from the devs, and a couple of podcasts from the iTunes store) is somehow compromised (I did download these things via the store's unsecured wifi). Somehow, there's a backdoor or a RAT on the backup.
I only have a basic working knowledge of infosec, but I presume with malware of that nature, it's possible for someone to access the iCloud-connected Calendar app on my laptop as if they were physically sitting in front of my Macbook. Because I narrowed the time the edit was made when I was asleep and my Macbook was off, I figure that the person who made the edit is potentially in a different timezone.