I was working from Starbucks today on my Macbook Air running OS X 10.11.5, and a strange thing happened.

I was in Chrome and browsing the web, when a Bluetooth connection request popped up from an unknown device. I rejected the connection, and continued on, assuming someone had simply accidentally requested to pair with the wrong device. A few minutes later, another pairing request from the same device, I rejected it again, and then turned off Bluetooth. (I noticed that there were two trusted devices listed - an apple keyboard and trackpad.)

I was working in Chrome and had several windows open, and within a few minutes, it had completely bogged down and was beginning to lock up (somewhat unusual, but not entirely unprecedented since it'll occasionally max out on RAM with lots of chrome tabs open, but usually it's a far larger number).

I decided to reboot, so I closed out everything and hit restart. During reboot, it briefly showed some error messages and text over an image background. Unfortunately, I wasn't able to read much of the text before it moved on, but it mentioned the registry and listed out lots of memory locations like 0x01515125125 etc. I've never had any issues with it or seen the screen before. It did a quick cycle through and then presented me with the normal login screen.

It seemed very fishy to me at this point, so I loaded into the guest account. I was googling around to see if it's even possible to get hacked via an open Bluetooth connection, and then a box popped up saying 'Safari wants to use your "login" keychain', which I canceled (never seen before, but then again - I don't use safari), and continued browsing. A few minutes later it popped up again and I was like "f it I'm out" and left. Booted my laptop on the way home and logged into my admin account and disabled Wi-Fi.

Am I being super paranoid here? Is this even possible to get a keylogger or malware like that? How could I verify?

  • OS X does not have a "registry" (AFAIK, Windows is the only OS with such a thing). Perhaps you saw "registers"? Maybe check Google images to see if you can find a similar screen. Anyhow, there's not really much we can do but say: Maybe? These issues aren't terribly compelling and could be explained by any number of things though. – Alexander O'Mara Aug 25 '16 at 20:45
  • Yes, pardon me, it was registers actually. The screen looked similar to these: i.stack.imgur.com/hs0SJ.jpg i.stack.imgur.com/nI9zx.jpg – Cameron Shaw Aug 25 '16 at 20:57
  • 4
    Ok, so you had a kernel panic on reboot. Can't really draw any conclusions about it though. – Alexander O'Mara Aug 25 '16 at 20:59
  • Fair enough. Time to wait and see I guess. I downloaded MalwareBytes for Mac from my desktop and transferred it via USB to the mac and ran it. It found one "infection" called 'Spigot', but I suspect that's more of a PUP / adware. And most of the google results for it are a few years old anyway. I logged my google account out of chrome and wiped browser cache, history, and stored passwords. Thanks for your help so far. Anything I could do to/run to detect if there was any type of keylogger/rootkit/etc, short of sniffing all my IP traffic? – Cameron Shaw Aug 25 '16 at 21:04

It could potentially have been an early variant of 'Blueborne' (there's been 8 identified so far). Perfect for an MITM attack in a cafe:

New Bluetooth Malware Affects Billions of Devices, Requires No Pairing

  • That would suggest a targeted attack, which is probably not the case here unless the author is a high-value target. – André Borie Oct 26 '17 at 13:59
  • 3
    According to the article, macOS is not one of the targeted OSs. Also, it states that no user interaction is required, so it would be odd that a pairing request would pop up if the whole point of it is that pairing isn’t required. – saltthehash Oct 26 '17 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.