Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

So, I needed to reformat the HD in my mid 2011 Mac Mini (done) and plan to reinstall Mountain Lion on it. I created an SDXC install disk to do this.  I'm curious to know if the disk2 partition with the Mac OS X Base System that appears in Disk Utility (as well as any other hidden partition) is the original boot partition from the previous installation of Mountain Lion carried over or is it all new from the install disk I created?

Here is why I ask...I had a nasty and reappearing hack, Trojan, Bot, or Malware of some sort that I want to make sure there are no remnants of when I do this install again. Over the course of almost three months, I have done this process twice, as have the folks at the Genius bar, and it keeps coming back. What ever it is, also appeared on my iMac (running Snow Leopard), but I did not have any luck after wiping and reinstalling the OS from the CD, twice as well. It also appeared on my Windows laptop (running Vista), which is currently sitting with the battery removed, and the iMac is unplugged, while I focus on my Mac Mini. One note of similarity with all of this is that there was a significant amount of network activity on all of these PC's, even without an Ethernet connection/cable attached, and with the connections disabled as well, including wifi and Bluetooth. My AEBS has also been factory reset many times. It was thought that my iPhone was somehow providing the internet connection, which has also been wiped twice, as well as my iPad. I do know that my network was hacked internally by my ex, who is my ex for this very reason. 

The one difference with my attempt at the OS install this time is that the install disk that I am using has been reformatted and the copy of Mountain Lion I am using was created from a newly downloaded file, versus the previous disk I had made, that was accessible to my ex, and could have possibly been tampered with. I have considered reflashing the EFI too, as I have read here that it could also be a hiding place for whatever this is, but I thought I would try this first, as I would be able to tell fairly quickly if it reappears, based on the network activity that shows up.

I hope the predicament I'm in makes some sense to those that happen to read it, because the scouring of Google, and forum after forum for answers has grown tiresome, which is why I now turn to this highly knowledgeable and collaborative community for help.  I do consider myself to be technically skilled, and have learned a lot more about this stuff than I ever wanted to know, but it is all worth it's weight in gold to me, including my new found love and appreciation using Terminal...who knew! ;-)

Let me thank you all in advance for any and all help, tips, pointers, etc. that come my way...they are all very much appreciated. I hope that this, being my first post, is fomatted and worded in the way that is preferred by this community, and has provided enough detail, thought and questions to garner some initial input,

Merry Christmas,

Jimmy

share

2 Answers 2

This sort of infection is extremely rare in the OS X world. Getting reinfected over and over again is even less likely. Not saying it's impossible, but very unlikely.

I would start by installing Little Snitch and setting it to monitor outgoing connections. Also monitor your launchd folders using http://www.circl.lu/pub/tr-08/

The first step I would recommend is changing all of your passwords and using something like 1password so your ex can't get into something again.

Marking this as a wiki so others can add suggestions since this isn't an "answer" per se.

[2013-04-14: There's also Radio Silence which is an outbound filter like Little Snitch but supposedly simpler and less "chatty".]

share
    
Hi TJ, thank you for your reply. Yeah, it sounds pretty crazy, trust me. I did try using Little Snitch for a while, but it was honestly very cumbersome to manage, and seemed more of a pain to actually get what I was hoping to get from it, because there seemed to be so many false positives showing up up all of the time, and the time involved in researching them was counterintuitive. As soon as I get the OS reinstalled, I will definitely add Circld monitoring for the launchd folders though, as that tool seems very well suited to what I need. –  JimmySD Dec 27 '12 at 2:08
    
Luckily, I am a user of 1Password on all of my devices, and for quite some time, though I did remove it because I saw that some of the files were tampered with (opened, taken), but I plan to add it back and start using the more secure password naming built in, versus my own. –  JimmySD Dec 27 '12 at 2:13
    
I just noticed the use of (@Name), so I will use this going forward. My apologies. –  JimmySD Dec 27 '12 at 3:42

Unless something kinky is going on (and whenever an ex might be involved, the potential kinkiness increases), the Mac OS X Base System is the hidden "recovery partition" your Mac uses to store the essential core replicating booting from the install CD in the old days, by holding Command+R during boot. From here you can do an internet reinstall or run Disk Utility. You can read more about it here http://support.apple.com/kb/HT4718.

This post might not get a second look if today was April 1, but what you described leads me to repeat one of my long-held beliefs: Just because you're paranoid doesn't mean they're not out to get you.

A couple of questions to get you thinking:

  • How is your network configured?
    • Internet--> gateway--> WiFi router --> computers
    • Internet--> gateway/WiFi router--> computers
  • If you have a combined gateway/WiFi router, did your DSL or Internet company provide this?
  • Who installed your Internet gateway/wireless router?
  • What brand is the router?
  • Did your ex use any remote management accounts or VPN to access your home systems?
  • Did you have the OS X firewall enabled prior to this mess?
  • Are there any "mystery devices" that show up on your network subnet? Before you shut down your current router, check its list of attached devices. Can you identify every device on that list? Wondering if your ex might have left something behind for gaining access.
  • Are their any strange devices that attach to your computers (either the Mac or Windows machine?) Looking for key loggers here.
  • Have you seen any anomalies with credit cards or bank statements?
  • If this continues, are you willing to file a police report?

Remember that any security modifications you make to your Mac you'll want to make analogous changes to your Vista laptop.

Here is a good start procedures to block something nefarious from happening. Don't be alarmed at the length or complexity of this post. Many of these items are straightforward once you are in the router/gateway configuration utility.

  1. Reset all your passwords: routers, computers, email, banks, management accounts, etc. Get and install a password manager like 1Password and use it to create "hideously long and complex passwords" (either long, randomly generated collections of UPPER+lower-alphanumerics or multi-word sentences of gibberish--the longer the better).
  2. Reinstall OS X while attached to a different network: at a friend's house, Starbucks, the library, etc. make sure you apply all needed patches to your system before you bring the computer home.
  3. Upgrade your Windows laptop to Windows 7 or 8. Both these Microsoft OSs have a better security subsystem than Vista. Regardless of OS version, be sure to stay up to date on security patches.
  4. Use a firewall. Either the native OS X firewall or Little Stitch as TJLumona suggests.
  5. Turn off the guest accounts on all your computers.
  6. Go hardwired for a short while. Turn WiFi off at your router. Turn WiFi off on both computers. Run cable to your computers... and if you can, run this way for a week or so. If nothing weird happens in this time, you might have shut off your ex's access.
  7. Enable your router's firewall. Turn off all but the minimally required ports to shut down any outside access through your router. If your ex is as powerful as you say, you might want to replace the router.
  8. Enable access logs on your router and/or gateway. Look for anyone attempting to gain access via both the Internet and via WiFi.
  9. Configure a white-list of devices allowed on your network. Do this on your WiFi router and Internet gateway,using the MAC address you read from the Physical device. While this isn't a perfect blockade, it's one more layer of defense.
  10. Periodically monitor the devices attached to your network. With a white list you shouldn't see anything except what you've allowed, but worth checking nonetheless. If your ex is spoofing a MAC address, you can potentially spot it by powering down all your devices and making sure they disappear from your network.
  11. Build a timed-access list on your network. (or turn off your gateway and/or router) Disallow network and/or WiFi access by time based on MAC address. If no one is home during the day, or if no one is awake at night, no one needs to use the network... including unauthorized people.

Good luck "locking your door".

share
    
Hi Tom, thank you for your very detaild response. I hear ya on the April Fools Day comment, and I am in agreement with your beliefs as well. And how did you know we were kinky? ;-) –  JimmySD Dec 27 '12 at 2:17
    
So, is that partition the one that was ther, prior to me reformation the HD, or is it from my boot disk, when I booted from it? If its the old, I assume I should wipe it too, if so, how? Also, I'm using my iPad to type my replies...and when I hit return for a new paragraph, it thinks I'm done commenting and ends my comment. Suggestion? –  JimmySD Dec 27 '12 at 2:37
    
@Tom- I also seem to be limited in character count, is there a way around this, or am I doing something wrong? –  JimmySD Dec 27 '12 at 3:40
    
@JimmySD where are you limited in character count? The comment field? I get ~550 characters. The comments are meant for a single, brief "paragraph" reply. I usually use my iPad for browsing and it acts the same way. For in-depth, multi-paragraph "answers", use the answer field or "Add Another Answer" button instead of a comment. –  TomUnderhill Dec 27 '12 at 15:54
    
@JimmySD The hidden partition gets created when installing Lion or MtnLion. It takes the place of booting from DVD to reinstall or run utilities and hosts the core boot files when running FileVault encryption. I usually don't recommend people get into Disk Utility to remove the partition because you would need to boot from a different drive before you could delete it. If your ex stuck files on the reserved partition, that would be really sneaky. –  TomUnderhill Dec 27 '12 at 16:01

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .