1

Little Snitch on my laptop just caught an unusual connection attempt - /usr/sbin/rpcbind tries to connect to 216.218.206.83 (scan-06d.shadowserver.org). This looks suspicious to me as it has never happened before. How can I check why this happened? Are there any logs or command line utilities that can point me to the origin of this request?

macOS Sierra 10.12.1 (16B2555)

Little Snitch window

Improve this question
1

1 Answer 1

Reset to default
1

So the answer is - no, my laptop wasn't compromised. Little Snitch blocked a scan attempt from Open Portmapper Scanning Project - it appeared that that rpcbind (a.k.a portmapper service) on my laptop is openly accessible from the Internet. I solved this issue by blocking all incoming connections for /usr/sbin/rpcbind (System Preferences > Security & Privacy > Firewall > Firewall Options, press +, find /usr/sbin/rpcbind, select "Block incoming connections").

Thanks @Tetsujin for pointing me into the right direction.

Improve this answer
1
  • That does mean it's getting through your router, though, which I'm not sure it should be.
    – Tetsujin
    Commented Nov 18, 2016 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .