High Sierra root vulnerability: how to check if someone logged in remotely?

Question

In macOS High Sierra, where can I find the IP addresses that logged in to my Mac through Screen Sharing or ssh?

That would be useful in light of the recently discovered root login vulnerability.

Answer 1

As @Melvin points out, a patch was just released. But to the question at hand, the easy is answer is no, they were root on your machine. It is compromised, period, by definition you cannot trust anything on it if you suspect it was compromised.

To further elaborate, if someone got root access remotely to your machine, you would never ever be able to se the traces of that if they know what they are doing and clean their tracks.

This was not "somebody got the key to the boss's office and messed around a bit in there", this is "somebody got the master key, unlimited funds and an unlimited contruction crew with unlimited time at hand". If you suspect you where compromised, format and reinstall.

To answer the question in layman terms (i.e. how would someone without the prereq skills of cleaning tracks probably leave tracks).

Lets start with ssh, for a full discussion see this question. In short search for ssh or sshd (the "server" part of ssh) in "Console.app" or by terminal:

cat /var/log/system.log | grep sshd

The problem with sshd is that normally nothing is really logged (security concerns AFAIK).

The same problem exists with VNC / Screen Sharing and Apple Remote Desktop / Remote Management, see for example this, this and this, that normal accepted connections are not logged. Only refused ones. Refused ones would probably come from "screensharingd", so search for that in the "Console.app" or terminal

cat /var/log/system.log | grep screensharingd

Except this what other tracks could easily be found? I would look through users and make sure they are only valid users and that no permission levels have changed etc.

I would also check if any remote services are enabled. See picture below. Of interest are "Screen Sharing", "Remote Login" and "Remote Management". cmd + space -> "sharing" is the easiest way to get there.

Answer 2

I have not been able to exploit this vulnerability remotely, however I was able to while logged on and trying to escalate my privileges in System Preferences using "root" with no password.

To detect this, scan the logs of the desired machine with the following command in Terminal.

sudo log show --style syslog | fgrep "authenticated as user root (UID 0) for right"

The output of this command will show you the UID of the user that was logged on when this vulnerability was exploited, and the time. Take the time and look for ssh or remote connections around that time frame.

Update, to search for logins via the root account, use the following command in Terminal.

sudo log show --style syslog | fgrep 'loginwindow' | fgrep 'root'

Answer 3

There is no easy and trustable way to get the IP address of your attackant unless he made very stupid operations (like ftping from his real attack computer another tool).

Tripwire

The only serious way to detect such an attack or any future attack through another MacOS X vulnerability is to install and use tripwire. tripwire is a modification logging software coming from the Unix and security field. (You can install it with Macports).

If you previously installed tripwire you would be able to detect such a successful attack in either of 3 ways depending on the level of skillness of the attackant.

High level attack

Your attackant know tripwire and know he can’t tamper with its database. He removes all your accesses or fully erase your filesystem to avoid being tracked back.

Medium level attack

Your tripwire installation was removed and your access maintained. You will detect this attack by the removal of tripwire.

Low level attack

Your attackant doesn’t know tripwire and all his modifications, even the removed log tracks, will be registered.