4

On my home network, I have a headless mini-mac that I use as a media, plex and security cameras server. I had screen and file sharing enabled, so that I can control it from my regular iMac, since no mouse, keyboard and screen is connected to mini-mac. It is connected to my home wifi and also to my regular mac via thunderbolt connection.

My router had port forwarding enabled for that mini-mac so that I can access cameras from outside.

Yesterday, I was working on my regular mac when suddenly my screen moved to the "login screen". I also noticed the screenshare icon was connected and when I hovered over it, it was my mini-mac ip address. I tried to shut down everything ASAP, mac and mini mac, then restarted and disabled screen sharing and remote login on the regular mac.

What steps do I need to take to confirm or rule out, via logs and queries, that someone was able to:

  1. Gain access to my network
  2. Successfully log into my mini-mac
  3. From mini-mac, successfully gain access to my iMac
  4. If any of the above items, for how long until uncovered?
  5. If they were able to access files, programs, etc.

Basically, I want to assess if indeed I was "hacked" and if so, to what extent.

Thank you!

  • - Which port are being forwarded ? - A list of the listening port of your global ip and mini-mac ip would help you having a precise answer. (search "nmap osx" on the internet) – Baptiste Jun 22 '17 at 1:56
  • 5900, 5901 and 8000, 8001 were enabled. – ogmios Jun 22 '17 at 2:04
3

So your home network should be something like this:

                                          +--------------+ 
                          Cameras<------->+  Cam server  +-+
                                          +-------+------+ |   
                                                  |        |
                                                  |        |
+--------------+     +--------------+   wifi/eth  |        |
| The Internet +-----+ ISP's router +-------------+        | Thunderbolt
+--------------+     +--------------+             |        |
                                                  |        |
                                                  |        |
                                          +-------+------+ |
                                          |     iMac     +-+
                                          +-------+------+  

Analyze

  1. Gain access to my network

You want to check the network logs of the following 3 endpoints:

  • The router (Port 5900, 5901)
  • The cam server (Port 8000, 8001)
  • The iMac (thunderbolt Connection activities)

If you remember when the event occurred, and you know how to read a pcap file you can diagnose what happened.

  1. Successfully log into my mini-mac

On your cam server, check the entry of those log files (App/Utilities/Console):

/var/log/osxvnc.log

/var/log/secure.log

/var/log/system.log

  1. From mini-mac, successfully gain access to my iMac

On your iMac, check the entry of those log files:

/var/log/system.log

Typing last & last username in the command prompt might show some useful info.


Additional information

A VNC server can be bruteforced, look at this example using metasploit and vnc_login module. For preventing it, You can add one of those 2 security layers:

  • Adopt a strong password policy with 12 characters as minimum length.
  1. the use of both upper-case and lower-case letters (case sensitivity)
  2. inclusion of one or more numerical digits inclusion of special characters, such as @, #, $
  3. prohibition of words found in a password blacklist
  4. prohibition of words found in the user's personal information
  5. prohibition of use of company name or an abbreviation
  6. prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers

    source wiki

  • Step up a level by not using a login/password Authentication.

You can find a walkthrough here


Edit 1 : A successful attacker with enough privilege will delete some log entries ( if he knows what he is doing)


Edit 2, (answering comments) :

Also, what specific info should I look for in the logs ?

router: Time & Ip address, Ask yourself those questions:

  • Which IP address has connected to my network when i was home ? You also want to know the global IP address you use when you remotely connect to your home network (favorite coffee shop IP, Workplace IP, Mobile Phone IP...)

  • The odd events occurred at time xx:xx, is there any entries in the router's log corresponding approximately to this time, or few hours before ?

iMac & Minimac: You first need to find a suspicious entry in the router's log, note this suspicious entry timestamp somewhere, then search in the Mini-mac's system.log what occurred at this time. Do the same process with your iMac via sudo last username command.

How would I be able to retrieve more items for last command?

Let me introduce you a famous acronym in the IT world, called RTFM : Read the Fine Manual. look here

  • In router logs, there were entries similar to this one: [LAN access from remote] from 169.53.184.23:38990 to 192.168.1.22:8000, Friday, Jun 23,2017 07:03:14 [LAN access from remote] from 169.53.184.23:10000 to 192.168.1.22:8000, Friday, Jun 23,2017 07:03:13 – ogmios Jun 23 '17 at 17:37
  • I only have system.log on both macs. Also, what specific info should I look for in the system logs? – ogmios Jun 23 '17 at 17:45
  • As for Last, I get this: minimac ttys000 Fri Jun 23 10:46 still logged in minimac console Tue Jun 20 23:40 still logged in reboot ~ Tue Jun 20 23:38 shutdown ~ Tue Jun 20 23:37 minimac ttys000 Tue Jun 20 22:50 - 22:50 (00:00) minimac ttys000 Tue Jun 20 22:06 - 22:06 (00:00) minimac console Tue Jun 20 21:45 - 23:37 (01:51) reboot ~ Tue Jun 20 21:42 – ogmios Jun 23 '17 at 17:49
  • How would I be able to retrieve more items for last command? – ogmios Jun 23 '17 at 18:12
  • @ogmios , please, check the edit2. – Baptiste Jun 26 '17 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.