3

I'm the only user on my personal laptop (MacBook Pro) running macOS Sierra. I discovered today that a suspicious user with a Chinese name appeared next to mine in the finder. Please see the attached picture below:

picture of finder

I googled for "Linchengzhang" but nothing turned up. What's scary is that's a lot of "auth" files furthest down the file tree. However I have no idea what this really means.

Furthermore, I've not downloaded any programs recently, nor used Xcode in a very long time (Xcode is actually broken for me at the moment).

I only use this laptop for occasional surfing on the web (no shady sites) and couple of programming projects now and then and additionally use Avast.

The only thing I found related to this (very closely) is this thread: link. However, the original poster claims it has to do with some cryptocurrency. I've never mined/bought/traded cryptocurrencies, so I don't think it has to do with that.

Any help would be greatly appreciated, I don't know if my computer (and/or passwords?) are compromised.

  • 1
    Too little details. @Full Array answers most of the possibilities. Investigate the system log on activities related to the folder creation date is another way. – mootmoot Nov 8 '18 at 9:07
  • What more details could I provide to help figure this out? – Philippa Nov 8 '18 at 16:14
6

I would doubt that's a hacker as the most successful attacks are through social engineering schemes. Few "completely technical" attacks are successful. There's always a flavor of inadvertence by the user and a bit of information security malpractice when attacks are successful.

Now, the account you're showing could be five things.

  1. You let another person use your Mac and that person created an account to separate his/her archives from yours.
  2. You hired a local IT technician who created an account to troubleshoot your Mac.
  3. You rely on cloud managed services, e.g. Azure uses ADAL token (jwt) authentication with an implementation specifically on objective-c (XCode is a dependecy)
  4. The network services at your job rely on Cloud SaaS (Software as a Service) solutions such as Microsoft Office Subscriptions (among other types of software) that uses ADAL token-based authentication.
  5. Some programs create accounts. You may have installed a program which created an account as part of the installation process and such program last used token-based authentication on October 23 2018 at 18:47.
  • 1. Then name does not really seem Chinese. 2. Do not assume a real hacker would use a Chinese name, that could choose any name they wanted. 3. My guess is someone—perhaps a friend—added the account just as a joke. – zaph Nov 8 '18 at 7:34
  • A hacker won't use a name. They'll use something like 'OS' or some technical sounding name to hide their presence. This is probably a prank than anything. – Nelson Nov 8 '18 at 8:24
  • I agree with both of you. As I mentioned in my post above, my hypothesis, without seeing the system in person, is that a program recently installed created the account or a friend/coworker created an account. – Full Array Nov 9 '18 at 0:25
2

Given how close your symptoms are to the link you posted it's possible your computer has been infected with cryptomining malware. As your link mentions, the files you've uncovered are created by the Bytecoin wallet software. Though cryptomining attacks have mostly moved to the browser, there are still cases where a cryptominer attempts to trick users into installing software directly onto their computer.

Are you certain you haven't downloaded anything lately? Known attacks include disguising the download as a flash update, distributing through compromised software-download sites, installing download scripts that may remain dormant for a period of time.

  • Upon further investigation, I saw that the folder was created at October the 10th. I checked install logs from that date and I had downloaded Foxit Reader that day, one minute after downloading Foxit, this folder was created. Maybe it is legit? – Philippa Nov 8 '18 at 17:39
  • 1
    @Philippa as I mentioned in my post, Some programs create accounts. You may have installed a program which created an account as part of the installation process and such program last used token-based authentication on October 23 2018 at 18:47. Foxit (I use it) has an ADAL token-based communication channel that checks your FoxiT version type and monitors some usage. – Full Array Nov 9 '18 at 0:21
1

I had the same issue with a User named Linchengzhang. I googled it, and it seems to be the user name of a contributor to the Open-Falcon Project, that can be downloaded from GitHub. See this link: Open-Falcon on GitHub

If so, then Open-Falcon is described on this web page: Open-Falcon

However, I did not knowingly download it, although I do use GitHub, as well as Xcode. And it is the first time I have ever had a new User account made on my Profiles without my knowledge.

I downloaded the Open-Falcon clone, and opened the package. It seems to contain Python script, which I don't read. I am just a user.

I THINK that the Open-Falcon Project is run by Dashboad, and it seems to be a bit like "R", a database visualization and programming language. But maybe that's wrong.

Maybe someone else can explain if loading this will also make a User Account with the name linchengzhang.

In addition I posted a question about it on the Google Groups Discussion forum about Open-Falcon: Google Groups Open-Falcon

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.