Privacy issues: is someone watching me on my laptop?

Question

Is there any way I can tell if anyone has set up my laptop to where they can see what I'm doing remotely whether it be the camera or surfing? Maybe there is a way I can just look at what programs have been installed recently or what programs are set to run on startup, so I can make sure they all look legit?

I don't have a password set on my laptop.

Some back-story: a (very close but somewhat scary as I get to know him) friend watched my apartment while I was gone and I just want to make sure nothing was tinkered with. I believe he's technically savvy, and familiar enough to try to hide his tracks. It sat out in the open but didn't show signs of having been disturbed. He said nothing to make me think he had done something, but better safe than sorry.

The computer is a MacBook, of a couple years vintage, running OS X 10.6.8, and I don't have backups!

Answer 1

A possibly malicious user with physical access to your machine and practically unlimited time could have indeed done much damage and covered tracks very effectively; the only way to be sure your machine is "safe" is to erase the drive and reinstall the operating system. Should you choose to go this route, back up your data first, then wipe your computer, reinstall OS and software from their install discs, then restore your user files from the backup as needed.

That said, there are indeed ways you can reassure yourself about your computer's safety.

I suppose you could physically look for fingerprints on the keyboard, but that falls outside anything I know how to do. Were you to attempt that, you probably would want to do it before any of these other methods so as not to disturb the evidence.

The program Little Snitch can monitor to see what programs on your computer are sending data to the internet. If someone wanted to spy on you somehow, it would not be enough for your computer to collect data for them; somehow, that data would have to leave your computer and get to them, which means some program would need to communicate with the internet. Little Snitch can find unexpected outbound traffic.

While it's fairly easy to alter this one, if you do find files whose "Last Modified" date was while you were away, that is a sure sign that someone was doing something on your machine during that time period.

If your iSight or FaceTime camera is in use, a green light will appear next to it. If that light unexpectedly appears, this is a sign that something is amiss.

If your machine was off, rather than merely sleeping, when you were away, you can see if it was booted when you were gone. Go to Terminal, and type last |grep console to see a list of the most recent user logins.

Answer 2

To answer you directly, for things that run on start-up, open up System Prefs from the Apple Menu. Then Users. Click on your username and look at the login items.

As for installed programs, that's difficult, because he might have just copied files over. You can use Spotlight to run a search for recently modified files. Open a new finder window then type * into the search box on the top right. Then click the + on the right hand end of the Search bar. Change Name to "Last modified date" is "before" the date you came back, and click + again, and set to "after" the date you went away.

If your laptop was on certain automatic clean-up processes might have run, so you might see stuff here.

If he's that good, he can change these timestamps though.

To add a couple of things to Daniel's post, you can also run "history" from the Terminal (in Applications -> Utilities) to see the last commands run. This is assuming he didn't create then remove a special user to work as.

There are other places you can control stuff from too. /Library/LaunchDaemons and /Library/LaunchAgents, and ~/Library/LaunchDaemons being some.

Given you didn't have a password the system was wide open.

At this point, if you're still concerned, get a friend to help you with a backup/restore, or take it to a Genius at an Apple Store. If you get a friendly one, they might help.

The problem with your situation is that if he's really good, he can leave very few tracks, and if you're not skilled and trained in how to find them, you won't.