8

I have a late model Mac computer. I allowed someone to plug in a USB drive, and my network activity changed afterwards.

Normally, Little Snitch will report every app that uses the internet. Every time my router light flashes, Little Snitch shows the app (or system) that is doing it.

After I allowed this person to insert his USB drive into my Mac, the router shows an occasional flash or two that does not show up in Little Snitch. Even Activity Monitor shows the data being sent out, but Little Snitch doesn't show the app doing it.

I inserted my system disks and did a restore from a time machine backup that occurred before the USB was put in. I completely formatted and restored the drive.

The router and activity monitor still show the occasional network activity.

So my questions are:

  1. How can I find out what is sending out the data?

  2. Since I restored from an earlier time machine backup, I can only assume the firmware was modified...so how do I verify it wasn't? Is there a way to run a check sum or hash check? Is there something else I should be checking or considering?

I'm assuming this person was able to observe my admin password and would have full access to the machine.

At this point I'm considering getting a new mac altogether as I don't know how to stop or at least determine what this outbound traffic is. I'm grateful for any help (because new Macs aren't cheap).

Improve this question
4
  • 6
    That's simple... everyone knows Macs can't be hacked or get virus', so it must be you reading things wrong.
    – WernerCD
    Dec 22, 2010 at 18:27
  • @wernercd: that's just demonstrably incorrect. I have worked with people who have Macs in both of those states.
    – user185
    Dec 26, 2010 at 10:18
  • 2
    Sorry... Didn't realize I needed to include sarcasm tags. Poking fun at the mac is safe myth and all. I'll include sarcasm tags next time, pinkie swear :)
    – WernerCD
    Dec 26, 2010 at 16:52
  • 5
    @wernercd: the problem with unmarked sarcasm is that it is indistinguishable from both idiocy and dishonesty. You're not guilty of either, so it's best to try and demonstrate that in knowledge-sharing websites ;-)
    – user185
    Dec 27, 2010 at 11:26

4 Answers 4

Reset to default
7

Try using Wireshark to do a packet capture and see whats data is being sent out.

Then you should at least be able to tell if its anything to worry about.

Alternatively try using the netstat -p command that will list what programs are currently listing on ports and you can see if there is anything strange.

Improve this answer
2
  • 3
    Identifying "anything strange" in a netstat run implies that you have a baseline, i.e. that you know what "not strange" looks like.
    – user185
    Dec 22, 2010 at 14:32
  • stop all services and everything left is strange. If one of the services was hacked, you are out of luck though...
    – goteguru
    Sep 18, 2015 at 12:11
2

If you are worried that your firmware is hacked, there is no amount of software you can install on the machine that you can be assured is working properly.

I don't know anything about Little Snitch, so I can't comment on it. Does it trigger on ARP traffic? Your router light blinking is a really really bad measure of traffic. Are you positive it never blinked without triggering an alert?

A new machine might be using NTP or system updates (which may or may not trigger an alert).

Improve this answer
1
  • 1
    I've used Little Snitch (I found it more annoying than useful), it seems to only get triggered by socket connections.
    – user185
    Dec 24, 2010 at 12:50
1

How did you activity change? My recommendation is that you first establish that there is actually movement of data. You should have a separate machine sniffing your network. Also, how do you know that it's not the router that wasn't hacked? That's more likely.

Improve this answer
1
  • I only have my Mac, so a second machine wouldn't be possible. I'm not a network guru, either, so setting up one would be a little much for me =) About the router, the same activity occurs even if I'm on a wireless network, not using the router. The occasional outbound data in Activity Monitor doesn't show up in Little Snitch.
    – mobileGuy
    Dec 22, 2010 at 12:52
1

Does your router have linux, or is it linux-flashable? (DD-WRT or another flavor.) If so, you can run tshark on the router to record all of your traffic, and compare it to a local wireshark capture. They should be identical (except for traffic that's entirely within 127.0.0.1). It might be simpler to have a buddy come over with a laptop to monitor side-by-side, actually.

Consider running tripwire to do a full audit of your system, then shutting down to boot from CD to run another full audit offline. If they don't match, find out why and what changed.

A final option is to just reflash the EFI, the disk drives, and anything else you think could possibly be affected. That should clear it if it's really firmware, right?

Hopefully it's just paranoia, but paranoia's a good way to learn new tricks.

Improve this answer
0

You must log in to answer this question.