I've become majorly concerned when reading this article that describes a bad actor that use Terminal access from his/her Mac to change the syslog and have stealth access to all data and passwords.

How can I get sure when I am connecting WLAN of workplace nobody can hack my computer and if they did by any chance(having password) how can I hinder them?

I don't even get how an OS could have two sys logs, so how can I get sure others have no access to my data? I am scared I might leave my Mac unattended sometimes.

  • Please ask a complete, self-contained question using the article as a reference. If the linked article should disappear, future readers won't know what problem is being solved and the question as it stands would be difficult to search for.
    – jaberg
    Sep 17 '13 at 2:56
  • @jaberg I will do that please be a bit positive and helpful not to down vote it.I will add more info now.
    – Alex
    Sep 17 '13 at 3:04
  • I understand that you are worried about other people accessing your Mac, I would be as well in your situation. But it's rather unclear from your question what you are actually asking here: "How is it possible to hack a Mac", "How can I get a hacked Mac back into a secure state without losing data", "How can I secure a Mac" or maybe even something else? We are not good at guessing your intent so can you please edit your question to make it more easy to understand what you are looking for.
    – nohillside
    Sep 17 '13 at 3:39
  • We have a policy to put unclear questions "on hold" to avoid getting wrong or misleading answers. You can just click on "reopen" after editing the question into shape to get somebody from the mod team or with high enough reputation to reopen it for you.
    – nohillside
    Sep 17 '13 at 3:40
  • The linked article reads like a paranoid rant about a BRFH situation and does little to clarify the question. I don't know what is real and what is confused-fantasy in the article. Bottom line, it is extremely difficult to "hack" a Mac over the network. There are exploits, but few give the type of total control the author claims. As we have no idea what the actual attack vector was—if there was an attack—it is impossible to recommend specific hardening steps.
    – jaberg
    Sep 17 '13 at 13:15

They key to your particular concern about the system is that an intruder would require local access to your Mac in the first instance in order to use the terminal to redirect syslog messages elsewhere (or perform any other nefarious activities that may allow genuine remote network access at a later date). The log redirection is a secondary "intrusion" that may allow someone to see the contents of your log files (which can contain some sensitive information, but I would never expect to see passwords in there). It isn't giving access to your system, but to your log files etc.

The link you provide is a litany of random sounding events, which all span in reality from 1 person gaining local access to your machine. This is the key here. Set a screensaver, and require a password to unlock it. Use Filevault to encrypt your boot drive to prevent booting from another disc or partition and gaining access to your data. Don't use auto-login for any user account. Set a strong password that is not used elsewhere. Do this, and almost everything you mention or that is mentioned in the link is not possible to achieve. To be clear, that machine was not "hacked", it sounds far more likely that social engineering or simply using the computer while the owner was not present due to lax security was at fault.

Rest easy, do the above and just concentrate on physical access for now.

If you are still concerned about remote intrusion then Apple's Mac OS X Security Configuration Guides provide additional suggestions for hardening your Macintosh against intrusion, however you should proceed with caution, as security often compromises usability, and some of the measures may be too extreme for your purposes and prone to causing you more problems than they solve, not to mention the fact that they can often be reverted through OS software updates without you being aware...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .