8

The logo on the back of my MacBook was glowing when it was in sleep mode. This happened a couple of times when I was out of my room for about 15 mins, the apple logo which wasn’t glowing initially started to glow.It stopped glowing by the door sound.Is there a possibility that my Laptop is hacked? The laptop is MacBook Air 2015 model currently on Mac OS Mojave 10.14.6. It was this thing which made me more suspicious: When I did ssh to a specific IP in our network It showed a warning stating remote host identification has changed and that it could be man in middle attack

17

Yes, there's always a possibility that a laptop has been hacked. Are the observations you have cause for concern - not really.

macOS contains a feature named "Power Nap" which allows the Mac to wake itself up from sleep to perform routine activities for a short while, and then go back to sleep. This is stuff like receiving new emails, syncing calendars and iCloud documents - or when connected to a charger - downloading software updates, taking backups, etc.

You can read about the feature here:

https://support.apple.com/en-bn/HT204032

Regarding SSH remote host identification changed: You'll need to contact the owner/administrator of that host to confirm whether or not the remote host identification change is a problem or not. It can happen for completely benign reasons such as reinstalling the computer, changing SSH configurations, etc.

In addition, it doesn't mean that your computer has been hacked. Rather it means that someone could be tampering with the remote computer or the network in between.

  • 1
    It could also be someone tampering with ~/.ssh/known_hosts on the OP's computer. In my personal case, it's actually because the devices we manufacture all are delivered with identical default IP addresses, but generate their own unique secrets upon first boot. So, whenever you log in for the very first time to set the IP address, you get greeted with that error message. – Jörg W Mittag Sep 19 at 18:20
  • 4
    Yes, that is ofcourse also possible - however it would be a bit odd to specifically tamper and create a non-match. If you wanted to tamper with known_hosts, you would replace the real data with the data for the fake host you've setup, so that the user would connect without knowing that anything is happening. – jksoegaard Sep 19 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .