So your home network should be something like this:
+--------------+
Cameras<------->+ Cam server +-+
+-------+------+ |
| |
| |
+--------------+ +--------------+ wifi/eth | |
| The Internet +-----+ ISP's router +-------------+ | Thunderbolt
+--------------+ +--------------+ | |
| |
| |
+-------+------+ |
| iMac +-+
+-------+------+
Analyze
- Gain access to my network
You want to check the network logs of the following 3 endpoints:
- The router (Port 5900, 5901)
- The cam server (Port 8000, 8001)
- The iMac (thunderbolt Connection activities)
If you remember when the event occurred, and you know how to read a pcap file you can diagnose what happened.
- Successfully log into my mini-mac
On your cam server, check the entry of those log files (App/Utilities/Console):
/var/log/osxvnc.log
/var/log/secure.log
/var/log/system.log
- From mini-mac, successfully gain access to my iMac
On your iMac, check the entry of those log files:
/var/log/system.log
Typing last & last username in the command prompt might show some useful info.
Additional information
A VNC server can be bruteforced, look at this example using metasploit and vnc_login module. For preventing it, You can add one of those 2 security layers:
- Adopt a strong password policy with 12 characters as minimum length.
- the use of both upper-case and lower-case letters (case sensitivity)
- inclusion of one or more numerical digits inclusion of special characters, such as @, #, $
- prohibition of words found in a password
blacklist
- prohibition of words found in the user's personal information
- prohibition of use of company name or an abbreviation
prohibition of passwords that match the format of calendar dates, license plate numbers, telephone numbers, or other common numbers
source wiki
- Step up a level by not using a login/password Authentication.
You can find a walkthrough here
Edit 1 : A successful attacker with enough privilege will delete some log entries ( if he knows what he is doing)
Edit 2, (answering comments) :
Also, what specific info should I look for in the logs ?
router: Time & Ip address, Ask yourself those questions:
Which IP address has connected to my network when i was home ? You also want to know the global IP address you use when you remotely connect to your home network (favorite coffee shop IP, Workplace IP, Mobile Phone IP...)
The odd events occurred at time xx:xx, is there any entries in the router's log corresponding approximately to this time, or few hours before ?
iMac & Minimac: You first need to find a suspicious entry in the router's log, note this suspicious entry timestamp somewhere, then search in the Mini-mac's system.log what occurred at this time. Do the same process with your iMac via sudo last username command.
How would I be able to retrieve more items for last command?
Let me introduce you a famous acronym in the IT world, called RTFM : Read the Fine Manual. look here
