Skip to main content
Answered the question in more detail
Source Link
flindeberg
  • 569
  • 5
  • 14

As @Melvin points out, a patch was just released. But to the question at hand, the easy is answer is no, they were root on your machine. It is compromised, period, by definition you cannot trust anything on it if you suspect it was compromised.

To further elaborate, if Isomeone got root access remotely to your machine, you would never ever be able to se the traces of that if Ithey know what I'mthey are doing and clean mytheir tracks.

This was not "somebody got the key to the boss's office and messed around a bit in there", this is "somebody got the master key, unlimited funds and an unlimited contruction crew with unlimited time at hand". If you suspect you where compromised, format and reinstall.

To answer the question in layman terms (i.e. how would someone without the prereq skills of cleaning tracks probably leave tracks).

Lets start with ssh, for a full discussion see this question. In short search for ssh or sshd (the "server" part of ssh) in "Console.app" or by terminal:

cat /var/log/system.log | grep sshd

The problem with sshd is that normally nothing is really logged (security concerns AFAIK).

The same problem exists with VNC / Screen Sharing and Apple Remote Desktop / Remote Management, see for example this, this and this, that normal accepted connections are not logged. Only refused ones. Refused ones would probably come from "screensharingd", so search for that in the "Console.app" or terminal

cat /var/log/system.log | grep screensharingd

Except this what other tracks could easily be found? I would look through users and make sure they are only valid users and that no permission levels have changed etc.

sharing panel osx

I would also check if any remote services are enabled. See picture below. Of interest are "Screen Sharing", "Remote Login" and "Remote Management". cmd + space -> "sharing" is the easiest way to get there.

As @Melvin points out, a patch was just released. But to the question at hand, the easy is answer is no, they were root on your machine. It is compromised, period, by definition you cannot trust anything on it if you suspect it was compromised.

To further elaborate, if I got root access remotely to your machine, you would never ever be able to se the traces of that if I know what I'm doing and clean my tracks.

This was not "somebody got the key to the boss's office and messed around a bit in there", this is "somebody got the master key, unlimited funds and an unlimited contruction crew with unlimited time at hand". If you suspect you where compromised, format and reinstall.

As @Melvin points out, a patch was just released. But to the question at hand, the easy is answer is no, they were root on your machine. It is compromised, period, by definition you cannot trust anything on it if you suspect it was compromised.

To further elaborate, if someone got root access remotely to your machine, you would never ever be able to se the traces of that if they know what they are doing and clean their tracks.

This was not "somebody got the key to the boss's office and messed around a bit in there", this is "somebody got the master key, unlimited funds and an unlimited contruction crew with unlimited time at hand". If you suspect you where compromised, format and reinstall.

To answer the question in layman terms (i.e. how would someone without the prereq skills of cleaning tracks probably leave tracks).

Lets start with ssh, for a full discussion see this question. In short search for ssh or sshd (the "server" part of ssh) in "Console.app" or by terminal:

cat /var/log/system.log | grep sshd

The problem with sshd is that normally nothing is really logged (security concerns AFAIK).

The same problem exists with VNC / Screen Sharing and Apple Remote Desktop / Remote Management, see for example this, this and this, that normal accepted connections are not logged. Only refused ones. Refused ones would probably come from "screensharingd", so search for that in the "Console.app" or terminal

cat /var/log/system.log | grep screensharingd

Except this what other tracks could easily be found? I would look through users and make sure they are only valid users and that no permission levels have changed etc.

sharing panel osx

I would also check if any remote services are enabled. See picture below. Of interest are "Screen Sharing", "Remote Login" and "Remote Management". cmd + space -> "sharing" is the easiest way to get there.

Source Link
flindeberg
  • 569
  • 5
  • 14

As @Melvin points out, a patch was just released. But to the question at hand, the easy is answer is no, they were root on your machine. It is compromised, period, by definition you cannot trust anything on it if you suspect it was compromised.

To further elaborate, if I got root access remotely to your machine, you would never ever be able to se the traces of that if I know what I'm doing and clean my tracks.

This was not "somebody got the key to the boss's office and messed around a bit in there", this is "somebody got the master key, unlimited funds and an unlimited contruction crew with unlimited time at hand". If you suspect you where compromised, format and reinstall.