Terminal Screen Shot

plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned.

Additional information:
Since we are in the same school, we are connected to the same network which is protected by mac address registration. I have done some research on the names of the deleted users and they are not the "hacking type". It is also possible that someone else used their name to create the accounts. I am still looking into other files to find some clues.

  • 3
    Sorry, just dumping screenshots on SO sites is not 'good enough'. You will have to quote the essential parts of that picture in text, so that is searchable. Please edit your question. While you are doing that please also fix the lack of white space/new lines, – user13695 Nov 6 '16 at 8:09
  • 1
    I'm confused. Is this your personal computer or a shared computer? We need context. Why are you surprised to see these accounts? – schroeder Nov 6 '16 at 8:38
  • @schroeder I'am confused too bro believe me. It is a personal computer. I am assuming you did not ask: "Why are you surprised to see these accounts?". I'll be glad if you could inform me of any other system files that may have kept a log of the actions of these deleted user. Otherwise thanks for your help. – user129770 Nov 6 '16 at 9:04
  • No - I literally meant, why you are surprised ... – schroeder Nov 6 '16 at 9:33
  • well, this is my personal computer. I am no computer whiz, yes I know some java, c++, and I code some stuff on matlab, but all science related (physics and math) stuff. I was just wondering around to find the preference list files related to the dock on my mac to increase the animation speed and by accident I found some names on a plist file. So of course I was surprised. Since the names included some characters that only my language has, I googled them, just to learn that I'm going to the same school with them. So that is why I was surprised. – user129770 Nov 6 '16 at 12:28

The only information in that screenshot is just deleted users so there is not much for me to go off of. With the information provided, this could be a hack but also it is also likely it could not be. Maybe they just needed to create a temporary user on the machine, so they just created a new account using your user preferences pane if it was unlocked at the time. Or it could have been a hack. They could have used the "single user mode" to create an administrator account so they would have a user account will full access.

Without more information there is not really any telling how they created those accounts, what type of privileges the accounts they made had, or what there intentions were.

If you are really concerned that this is a hack I would seek the help of a computer forensics professional.

In the meantime if you would like to lock down your computer, there is a setting on the mac called "fire vault", it encrpyts your disk and will prevent hackers from exploiting the "single user mode".

  • What other directories do you think I should look. Is there any other files that I could look which would provide important information? – user129770 Nov 6 '16 at 7:42
  • @user129770 I did some research and I found some more directories you could search which might provide more information. Using these directories you could see if they left a trail in any of the selected directories like they did in the "deleted users". I will put a link to a source of my research that also contains directories you can check link – user121738 Nov 6 '16 at 17:48
  • @user129770 If these directories create more concern, I would highly suggest you take my old advice and speak to a computer forensics professional. They then can pull deleted files from those user accounts to get a bigger idea of what they did. – user121738 Nov 6 '16 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.