3

In the attached picture you can see the name of an unknown computer (desktop-aqnpumc) in my network.

enter image description here

"Delat" means shared and SuperNova is my own TimeCapsule which is shown in Finder. I cannot eject this computer, or server or whatever it is.

Is this a security breach? What shall I do about this?

Appreciate all feedback. Thanks!

[Edit: New info - Most of the time this computer is not showing up. But it has a few times the last month. So it really feel like someone has gotten into my network. PLEASE HELP!]

Improve this question
3
  • 3
    Use the AirPort utility to check who's connected to the AirPort. Sometimes you can find the brand of the device from the MAC address or BSSID listed there which would make finding the device easier. It could simply be a TV or modem on your network, or a printer. Although, the name suggests a windows computer.
    – John Keates
    May 16, 2016 at 2:45
  • Didn't think of Airport utility! I'll try it next time it shows up. We only have one window computer on this network, and I don't think it is that name, and it is always connected so it shouldnt show up and go away like that. This comment might fit better as an answer. Thanks!
    – MacProGirl
    May 17, 2016 at 0:58
  • 1
    Next time, you could ping the computer name as it shows up in the sidebar (i.e. Using network utility), then you'd have it's current IP address which you can then correlate with the clients listed in the AirPort utility. Another place you might want to check is any modems you use (dsl/cable/fiber) for connected clients.
    – John Keates
    May 17, 2016 at 16:38

3 Answers 3

Reset to default
3

This answer is based on the comments as the user perhapsmaybeharry covered how Bonjour works and how to disable it.

Edit: New info - Most of the time this computer is not showing up. But it has a few times the last month. So it really feel like someone has gotten into my network. PLEASE HELP!]

This could be anything from a shared computer that has been cached on your system to a non-expired lease on your router.

  • To clear your mDNS (Yosemite and Later):

    sudo killall -HUP mDNSResponder

  • To clear out the unexpired entry on your router, just log into your router, go to the DCHP Client Leases area, and delete the unknown computer. Each router is different, but all have this functionality. You will have to look up the settings for your particular router.

I have a PC that is always connected to the network and Timecapsule. But I don't recognize that unit name. And this unknown unit is not always connected, just sometimes

I am assuming that you have a wireless network and you allows friends/family to join the network to surf. This may be a PC/Mac that belongs to someone you know, you just don't recognize their computer.

I haven't seen that computer for a while now. Isn't the most likely theory that it is someone that has broken in to my network?

Again, I am assuming that you have a wireless network - if it were wired (meaning no Wi-Fi) it would be really difficult to get into your network unless they had a physical connection.

If this is the case, you can immediately address the issue by changing your network passphrase (password) to join the network. Just log into your router and make the change (you will have to update your Wi-Fi settings on all your devices when you do that.)

The other option is to turn on MAC filtering (not Mac as in Apple Mac, but the media access control - mac - address) in you router. What it will do is prevent anyone with an address you didn't specifically authorize from joining the network. Keep in mind that this will become very labor intensive because every time you want to allow your friends/family who haven't joined the network yet, you will need to go into the router and add their MAC address, and that's after obtaining it (usually) manually from their device. It's much more secure, than just a simple passphrase, but the trade off is convenience.

If you have more "transient" guests than regular family and friends, this is where you start looking at a guest network. Most routers with guest network capability allow you to have another SSID (WiFI network name) a different passphrase (wireless password) and some rules like isolating the clients so they can't talk to your "private network" or each other; they also have the capability to limit your guest users by, time (only surfing at night), by site (no XXX) and even by bandwidth (limit streaming).

This is all dependent on the router.

Improve this answer
5
  • Very good comments and suggestions. I will look into this answer again when the unknown computer shows up. Really helpful and much appreciated! Didn't know about MAC filtering either. Does your last sentence mean that you can still have your router as a guest network when you have MAC filtering?
    – MacProGirl
    May 17, 2016 at 1:02
  • Yes. I made some edits for more detail, but the idea behind a guest network is you can give out the wifi password and have limits different than your private network. This way if one of your guests decides to abuse your privileges, you can change out credentials without affecting all of your personal stuff.
    – Allan
    May 17, 2016 at 1:33
  • Don't use MAC filtering. It's easy to bypass and if you use it and someone looking for targets to break in to notices it, they will pick you instead of a "normal" network.
    – John Keates
    May 17, 2016 at 17:16
  • @JohnKeates And your solution is to leave it open? When you spoof a MAC address it has to be an active client and the client will lose access to the network/web - the person affected will know right away. I also don't see how having a PSA passphrase and a MAC address is a bad thing.
    – Allan
    May 17, 2016 at 18:32
  • No, MAC-whitelisting doesn't do anything like that in it's common implementation. It's only for a simple ACL: either the MAC matches or it doesn't. Use WPA2-PSK with AES (and not TKIP), it's (at least for end-users) the only simple/reasonably secure access control. Two clients with the same MAC address (or BSSID) doesn't do anything like kicking people off, MAC addresses are transmitted periodically, and easy to spoof. At best it's may delay someone who already cracked the WPA2 password for 5 seconds. To keep 'normal' people out if they know the current password: just set a different password.
    – John Keates
    May 17, 2016 at 20:10
1

This is not a security breach (if you're on a public network).

The "shared" section under the sidebar is Apple's Bonjour protocol that allows for detection of other computers that support Bonjour. In the case of a computer being shown in the sidebar, the computer is not connected until you click it and authenticate.

I would assume you would be on a public network if you see computers you don't recognise showing up under "shared". As you can see in the image below, your computer will recognise other computers that support the Bonjour protocol that are on the network.

other Bonjour-compatible computers seen under "Sharing"

If you do not wish to see this sidebar section, open Finder preferences (⌘ Command+,) and uncheck "Bonjour computers" under "Shared".

Finder preferences, where you can disable seeing the shared section

Additionally, if you would like to avoid having your computer shown on others' Shared section(s), have a look at this question "How do I disable Bonjour visibility after Yosemite install?".

Improve this answer
6
  • No this is NOT a public network! It's my own private network setup from my Timecapsule. That's what's making this so frightening. Thanks for all the effort to help but this is troubling.
    – MacProGirl
    May 4, 2016 at 2:21
  • By any chance do you have any other computers on the network? Some PCs which support Bonjour can show up under "Shared" as well.
    – perhapsmaybeharry
    May 4, 2016 at 2:25
  • I have a PC that is always connected to the network and Timecapsule. But I don't recognize that unit name. And this unknown unit is not always connected, just sometimes. Strange right?
    – MacProGirl
    May 8, 2016 at 23:30
  • Do you have any theory for my home network? I haven't seen that computer for a while now. Isn't the most likely theory that it is someone that has broken in to my network?
    – MacProGirl
    May 15, 2016 at 22:21
  • If that's a public network, you need to turn off all your file and screen sharing and turn on the firewall. Public wifi hotspots should be isolating clients so they can't see each other for security purposes.
    – Allan
    May 17, 2016 at 15:15
-2

If you think your Wi-Fi network has been compromised and you don't change your WPS pin, you may as well not bother changing your password.

Improve this answer
1
  • Welcome to Ask Different. Please use the Answer box only for actual answers to the question.
    – Glorfindel ♦
    Jul 3, 2017 at 13:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .