If you previously installed tripwire you would be able to detect such a successful attack in either of 3 ways depending on the level of skillness of the attackant.

High level attack

Your attackant know tripwire and know he can’t tamper with its database. He removes all your accesses or fully erase your filesystem to avoid being tracked back.

Medium level attack

Your tripwire installation was removed and your access maintained. You will detect this attack by the removal of tripwire.

Low level attack

Your attackant doesn’t know tripwire and all his modifications, even the removed log tracks, will be registered.

There is no easy and trustable way to get the IP address of your attackant unless he made very stupid operations (like ftping from his real attack computer another tool).

Tripwire

The only serious way to detect such an attack or any future attack through another MacOS X vulnerability is to install and use tripwire. tripwire is a modification logging software coming from the Unix and security field. (You can install it with Macports).

If you previously installed tripwire you would be able to detect such a successful attack in either of 3 ways depending on the level of skillness of the attackant.

High level attack

Your attackant know tripwire and know he can’t tamper with its database. He removes all your accesses or fully erase your filesystem to avoid being tracked back.

Medium level attack

Your tripwire installation was removed and your access maintained. You will detect this attack by the removal of tripwire.

Low level attack

Your attackant doesn’t know tripwire and all his modifications, even the removed log tracks, will be registered.