How can I detect if my computer has been remotely accessed and monitored by an employer?

Question

I work remotely as a freelancer, on a new imac I purchased specifically for this gig. Until recently, I had a seat on the client's Adobe Enterprise, and I frequently exchange files with the client. I became aware of suspicious activities, such as the cursor moving by itself, and clients making references to my work or computer activity, that they could not have known without access to my desktop, or mysterious system crashes. I have since tightened up my security, but: How can I detect the presence of a monitoring system, or perhaps, an undisclosed user, and prevent access to my computer, and a potential invasion of privacy?

Answer 1

Assuming they're monitoring or remotely logging in to your machine, the computer itself would have to be configured to accept these connections. Open System Preferences>Sharing and go to the Screen Sharing tab, check whether it is on, if so whether it is set to allow access for all users or only specified ones. Do the same for the Remote Login tab, Remote Management tab, and Remote Apple Events tab.

If all of these are disabled, or access to these functions is restricted to users you know for a fact they do not have access to, try going to the Users & Groups preference pane, and check to see whether there are any Network-Sharing enabled users besides the administrator account, and if the Guest user is enabled, whether or not it has Remote Login access.

If none of the above are the case you may try checking the machine's SSH logs, assuming SSH has been enabled, to see if there have been any recent remote logins via the Terminal. Finally, of course, if there are any Remote Desktop applications installed, check their logs as well. I am not familiar with Adobe Enterprise, perhaps check the application settings to see if anything regarding remote monitoring or connections is mentioned.

If none of the above are relevant, or do not yield any results, you can always try going to the System Preferences>Security & Privacy pane, then the Firewall tab, turning on the Firewall, opening the Firewall Options... window, checking Automatically allow built in software to receive incoming connections, unchecking Automatically allow downloaded signed software to receive incoming connections, and checking Enable stealth mode. This will effectively block all incoming connections from whatever software is used for monitoring/remote login, and may even reveal what software is being used when it prompts for Firewall access during the next remote login attempt.