Mac Hacked? "a computer with IP address 128.130.244.179 tried to establish an incoming connection to kernel"

Question

I got a suspicious alert on litte snitch today which I captured in a screenshot. I am sending it to you. Could you please take a look and tell whether you think my mac got infected or not?

I installed Clear VPN through my Setapp subscription last week and it asked for my keychain password. I am not really informed on keychain access and security. I was even less informed last week. I reset the password for keychain and entered it in the Clear VPN App and then got this suspicious alert on MacOS Kernel. I then tried to restore from a time machine backup, which seemed to help (this was a couple of days earlier). But today I got this alert once again. I blocked it. However, I have a feeling that this is not good.

Maybe the installation of clear VPN and keychain password isn't related to this alert. I don't know. If anyone does, could you please help me with this and shed some light on the matter?

Big Sur 11.0.1 Little Snitch 5.0.3

Answer 1

There's nothing there that indicates being "hacked."

Too often, folks see connections or random behavior and immediately assume this is a hacking attempt. It's not.

This could be any number of legitimate connection attempts especially given that the IP in question isn't flagged as coming from a known hacking IP, one of the many rogue countries (like China) or from a remote, anonymous proxy.

Now, you shouldn't be getting connections like this directly to the kernel especially if you are behind a firewall. However, if your Mac sends a request out and creates a "state" on your firewall, it can connect back - making this entirely legitimate.

• Ensure you're behind a proper firewall
• Turn on the firewall on the Mac
• Log outgoing connections in Little Snitch to correlate traffic

Bottom line...a single connection is not enough to determine anything. You need to see this in context and you need to see the actual traffic that's incoming. If you're not using firewalls, your very first action is to get behind one and/or turn it on.

Answer 2

I believe this is a real hack attempt targeting a BitTorrent listener on port 6881. I witnessed such an attempt recently from a malicious source IP, identified as a VPN client located in Zurich. Most likely, your firewall has port forwarding enabled on port 6881 to the machine running Little Snitch, prompting the alert. Whether or not a torrent service is running on the Mac, you'd see the alert from Little Snitch when the connection is attempted.

To check if your Mac is actually listening on port 6881 and see the application and PID responsible for it, run a command in the terminal (netstat on Mac will not show the process name and PID, a limitation of netstat on the mac, so we use this instead):

lsof -i -P | grep -i listen

If Little Snitch hadn't stopped the attempt, it's reasonable to assume the connection would be dropped, since there is nothing listening on port 6881... unless there is something listening on port 6881 in your case, such as when running a torrent client.

You can disable port 6881 at the firewall when you don't need it, or better yet use a different port as a listener, so that you are less likely to be targeted. Hopefully modern Macs block connections to the kernel without the use of Little Snitch. It would be a major vulnerability if it were allowed by the operating system. I had a difficult time finding information online describing such an attack or what operating systems would be vulnerable.