Little Snitch on my laptop just caught an unusual connection attempt - /usr/sbin/rpcbind tries to connect to (scan-06d.shadowserver.org). This looks suspicious to me as it has never happened before. How can I check why this happened? Are there any logs or command line utilities that can point me to the origin of this request?

macOS Sierra 10.12.1 (16B2555)

Little Snitch window


So the answer is - no, my laptop wasn't compromised. Little Snitch blocked a scan attempt from Open Portmapper Scanning Project - it appeared that that rpcbind (a.k.a portmapper service) on my laptop is openly accessible from the Internet. I solved this issue by blocking all incoming connections for /usr/sbin/rpcbind (System Preferences > Security & Privacy > Firewall > Firewall Options, press +, find /usr/sbin/rpcbind, select "Block incoming connections").

Thanks @Tetsujin for pointing me into the right direction.

  • That does mean it's getting through your router, though, which I'm not sure it should be.
    – Tetsujin
    Nov 18 '16 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .