Questions tagged [macos]
macOS (formerly Mac OS X and OS X) is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc.
353
questions
1
vote
0answers
43 views
OSX: Momentary appearance of a .dmg modal, when opening an image
I had a situation that struck me as odd.
I opened an image which I had downloaded via browser save-as.
After the finder/OS initiated the file-open,
a modal dialog momentarily flashed, typical to ...
0
votes
0answers
45 views
Diff files between two HFS volumes
I currently have two HFS volumes that I would like to compare in order to see which files have been added or modified. It's a Mac OS X 10.9 (Mavericks) install.
First volume is the system as of today....
0
votes
0answers
26 views
OS X: Is there a way to block all incoming / outgoing connections EXCEPT for localhost? [migrated]
Wondering if there's a way for me to block the internet except for localhost while I'm developing on a local machine.
0
votes
0answers
80 views
New user has appeared on my Macbook Pro [duplicate]
Today I noticed the addition of a new user "Linchengzhang" on my MacBook pro. Apparently the user was added 25th April 2019 (according to the folder creation) and it appears to have an identical ...
0
votes
1answer
41 views
OS X Firewall Block all incoming Connections Affecting Software Updates?
I just bought a 2017 Macbook Pro with the latest OS (Mojave). In the OS X Mojave Security and Privacy-Firewall settings, I set Firewall to "Block all incoming connections" as I am extra cautious, but ...
0
votes
0answers
38 views
CSP/KSP module for MacOS
My company developed a custom Key Storage Provider for Microsoft CAPI so that CNG-using Windows apps can perform signatures using a remote signature service.
I would like to know if there is support ...
0
votes
2answers
130 views
I am getting “Your connection is not private” error and it disappears when I use a VPN
I use a Mac (running macOS Sierra). Yesterday I was watching a movie online from some not-so-trustworthy website and when I clicked the pause button, a tab appeared and suddenly disappeared.
From ...
1
vote
1answer
104 views
How secure is a Mac if it passes Apple Diagnostics?
Recently I brought my MacBook Air to a Genius Bar to perform a clean MacOS installation. For security purposes, I asked for a hardware check as well. The Genius Bar technician ran Apple Diagnostics, ...
1
vote
0answers
50 views
Bruteforcing via port 88 on MacOS
Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how?
If the vncserver is active, it is possible to know also the username (by ...
28
votes
2answers
5k views
How is it possible for user's password to be changed after storage was encrypted? (on OS X, Android)
There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android.
On OS X: to enable encryption current user must have a password protected account. After enabling the ...
0
votes
0answers
38 views
Files Accessed over macOS's SMB Sharing Encryption
I have an iMac on the same network as my Windows desktop. Both are on the local network at my university.
I am sharing a folder on the iMac using the built-in sharing utility (via SMB) with everyone ...
0
votes
0answers
63 views
iOS Security Architecture-Encryption Keys
As per iOS Security 12.1 documentation(Page-15), there are individual UID and GID for each processing unit i.e AP(Application Processor) and Secure Enclave.
The application processor and Secure ...
34
votes
3answers
5k views
Is it insecure to send a password in a `curl` command?
Here’s an example request we can make to the GitHub API:
curl 'https://api.github.com/authorizations' --user "USERNAME"
This will prompt for the account password, to continue:
Enter host password ...
2
votes
1answer
108 views
Why are there no free resources on exploit development on macOS? [closed]
There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube.
Why are there no write-ups on macOS exploitation ...
0
votes
1answer
1k views
Random Chrome Notifications and Strange Source Code
My elderly parents are receiving chrome notifications from a strange URL on their iMac:
(https://s1.snc.com.ru:443)
Example Messages
• Pending Payment: Paypal Has Sent You $65,900
• Clean your mac....
0
votes
0answers
36 views
How to protect certain macOS user directory from unauthorized access?
I have several directories on my Mac, two most popular examples are:
~/.aws
~/.ssh
They can be read by any script file or third-party app in system.
I do not see a way to protect them in macOS (...
0
votes
1answer
53 views
print statements
Is it possible for a bad guy to read print statements done in the swift programming language?
Ex. If I release an app to the Apple Appstore and it has following print line:
print("my-secret-password"...
0
votes
1answer
202 views
Have I been hacked? Terminal shows me in a different hostname than my machine [duplicate]
Sorry for the generic title but really don't know how to call this.
I've just upgraded my MacBook Air to macOS Mojave 10.14.3.
Usually, when opening the terminal it would show something like ...
4
votes
1answer
126 views
How to Best Minimize Damage After Loss of Computer
Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
0
votes
1answer
728 views
hashcat specify number of characters
I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
0
votes
1answer
146 views
Local Video Screenshot during Netflix
I was just binge watching Netflix from my MacBook Pro on a TV streamed using HDMI. It automatically started the final episode of the season but about 20 seconds into it, a screenshot from a local ...
3
votes
0answers
275 views
Why is Spotify using my webcam (AppleCamera)
I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam.
lsof | grep "AppleCamera"
Google and Spotify showed up:
Spotify 668 ...
1
vote
1answer
140 views
Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim
If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface.
meterpreter > run getgui -u loneferret -...
0
votes
1answer
277 views
How can I safely use potentially infected USB sticks from a previous OS installation?
So I recently upgraded an old MB Pro to Mojave because I was concerned I could've infected it.
Now I'm probably overreacting to all of this but since I was using all of my USB sticks in the previous ...
1
vote
0answers
235 views
Weird Python script found on a Mac Os X client machine
I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder.
8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist
8 -rw-r--r-- 1 XX ...
3
votes
3answers
434 views
New user with Chinese name appeared on MacOS. Hacker?
I'm the only user on my personal laptop (MacBook Pro) running macOS Sierra. I discovered today that a suspicious user with a Chinese name appeared next to mine in the finder. Please see the attached ...
6
votes
1answer
461 views
How Homebrew may impact your Mac's security [duplicate]
I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
1
vote
0answers
44 views
Increase password iterations?
Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
3
votes
1answer
112 views
How to enforce on the OS level to recognise only certain keyboards
I give employees AES wireless keyboards.
I would like to enforce the OS to only recognise the keyboard we supply.
Is that possible?
Assuming my employees OS are Windows 10, Ubuntu, Mac OSX.
How could ...
1
vote
0answers
22 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
5
votes
5answers
215 views
Unix Privilege Escalation: “sudo must be owned by uid 0 and have the setuid bit set”
It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error:
"sudo must be owned ...
2
votes
2answers
92 views
Home environment for MacOS detection tools
I was recently introduced to a variety of detection/hunting tools for MacOS. Listed below are some of the tools I am interested in learning to broaden my toolkit and better learn Mac security.
Google ...
2
votes
0answers
94 views
macOS Data Protection without FileVault
I'm running macOS 10.14, and have encountered a problem which prevents me from enabling FileVault. As best as I can determine, there are no free and convenient alternatives for full disk encryption, ...
5
votes
0answers
183 views
How to send Wi-Fi management frames from macOS?
I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
3
votes
1answer
236 views
MacBookPro's OSX install.log has entries that predate the initial unboxing
Basically what the title says. I recently had a look at my /var/log/install.log and the earliest entries are from about 2 full months prior to me unboxing the computer.
The packaging had cellophane, ...
7
votes
4answers
505 views
Freaked out by “impossible click” in logs
I was staging an isolated production environment and accessing it's remote PHP script from my local mac on
http://example.com/XbAM7Kt7SJj3M8ytJfEQZbwcBLzg0gNWGfyCHL2b0f0
I saw my click in the log as ...
-2
votes
1answer
100 views
Security testing alternatives on MacOS [closed]
Is it possible/feasible to set up a hacking machine that rivals a distribution like Kali Linux on MacOS, or will it never be possible for MacOS to rival a distribution like Kali in terms of hacking ...
1
vote
2answers
106 views
Is setting a firmware password on a Macbook enough to prevent cold boot attacks?
I have a Macbook configured with a firmware password required to boot from any media other than the built-in NVMe drive. In theory, this means without my password you can't boot from removable media. ...
4
votes
1answer
2k views
What are the security implications of homebrew and macports?
macports
binaries are useable from /opt/local/bin/, i.e. for tesseract
bin$ which tesseract
/opt/local/bin/tesseract
bin$ ls /opt/local/bin/tesseract
-rwxr-xr-x 1 root admin 28120 15 Sep 2016 /...
0
votes
0answers
76 views
Capturing Dot11 (802.11) headers on Mac OSX
I'm trying to obtain remote signal strength indication (RSSI) from received packets by sniffing the ones having Dot11 headers. But I've heard somewhere that WLAN interface of Mac OSX (en1 interface as ...
1
vote
1answer
139 views
Somebody called a number from a pop-up on their MacOS computer and installed a program called GoToAssist. What is the best course of action now? [duplicate]
Somebody I know saw a pop-up on their iMac running Sierra (10.13.5) that advised them to call 877-336-5833.
They called the number and the representative advised that they install a program called "...
0
votes
3answers
146 views
Does installing undercover (macbook theft software) increase risk of attack, privacy breach
http://orbicule.com/undercover/mac/
I stumbled upon this page today and am intrigued by the service, it offers a lot of features that I have been interested in since my last computer was stolen in a ...
1
vote
0answers
48 views
Second User On My Computer Via iCloud? [closed]
Disclaimer: I have tried looking for an answer to this, but I couldn't find anything. I also am learning the basics of internet security and I have recently discovered the Objective See security apps ...
0
votes
2answers
108 views
Is revealing login name of macOS into internet a security risk?
For example, sometimes I need to post debug messages to internet like this:
No such file : /Users/xxxxx/Documents/test.sh
My question is, is forgetting replacing the login name into xxxxx a security ...
1
vote
0answers
124 views
What encryption method is used on macOS Preview.app?
In order to send a file securely, I am going to encrypt/password protect a PDF file with Preview on macOS.
Other question(s), such as this one have asked the method of encryption for PDF's in ...
2
votes
2answers
87 views
What format is an decrypted RSA private key in, specifically in OS X Keychain?
I was trying to extract an un-exportable key from OS X Keychain. I used this tool to extract the key. The tool gives me a hexdump of the private key. An RSA 2048 bit key came out to be 2441 bits, ...
2
votes
1answer
87 views
Why does not updating a MacOS keychain password cause applications to become troublesome? [closed]
I've changed my Macbook computer's password in using recovery mode. I'd changed it once normally, then it suddenly "stopped working" (or I started "mis-remembering" it after using it a few times, ...
8
votes
1answer
2k views
What encryption method is used by the zip program in macOS?
In order to send a file securely I am going to encrypt/password protect a zip file. (Why I am doing this). I am using macOS Sierra 10.12.6 and through my research I have concluded that encrypting a ...
2
votes
1answer
38 views
How save, on a log file, all IP inbound/outbound connected to my Mac under MacOsX 10.9.5?
During its operation, the computer connects and disconnects to and from numerous servers - which are identified by a specific IP address.
Is there a solution to trace the ip addresses of all the ...
4
votes
2answers
19k views
gpg: decryption failed: No secret key
I cannot seem to get gnupg to decrypt files encrypted with my keys. I've tried migrating my secret key from an old laptop to a new one, and I keep getting the same error:
gpg: decryption failed: No ...
