Is my computer being hacked?

Question

I have reason for suspicion that I'm being hacked. On top of that, my MacBook's screen will light up (several times a week) when it is asleep, showing the log in screen. It will fall back asleep within a minute or so. It happened this morning, and I wondered if this had anything to do with my hacking suspicions, so I looked at the system log. I don't know much about systems, but I notice the second line says something about the Sandbox being exited. It would be great help if any of you know how to decipher this and could let me know if anything is out of the ordinary.

Feb 25 08:33:00 Rachels-MacBook-Pro syslogd[40]: ASL Sender Statistics
Feb 25 08:33:01 Rachels-MacBook-Pro com.apple.xpc.launchd[1] (com.apple.sandboxd[7218]): Service exited due to SIGALRM | sent by kernel_task[0]
Feb 25 08:33:02 Rachels-MacBook-Pro com.apple.xpc.launchd[1] (com.apple.bsd.dirhelper[7246]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.bsd.dirhelper
Feb 25 08:33:03 Rachels-MacBook-Pro systemstats[52]: assertion failed: 18G103: systemstats + 668620 [D8A96B8F-0E65-3EA8-9EEE-982901402221]: 0x7fad6ce07390
Feb 25 08:33:48 Rachels-MacBook-Pro systemstats[52]: assertion failed: 18G103: systemstats + 668620 [D8A96B8F-0E65-3EA8-9EEE-982901402221]: 0x7fad6ce07390
Feb 25 08:34:05 Rachels-MacBook-Pro com.apple.xpc.launchd[1] (com.apple.airport.wps): Service only ran for 6 seconds. Pushing respawn out by 4 seconds.
Feb 25 08:34:33 Rachels-MacBook-Pro com.apple.xpc.launchd[1] (com.apple.airport.wps): Service only ran for 8 seconds. Pushing respawn out by 2 seconds.
Feb 25 08:34:44 Rachels-MacBook-Pro com.apple.xpc.launchd[1] (com.apple.airport.wps): Service only ran for 9 seconds. Pushing respawn out by 1 seconds.

Answer 1

There's nothing in that log that is "non-Apple".

If you think that either:

• you've installed some software that was not what it claimed to be
• someone has had physical access to your machine and/or knowledge of your admin password

then it is possible that you might have 'malware' on your Mac. You can check whether there is anything of that kind using MalwareBytes, which should also help to remove it.

However, old school "hacking", in the sense of someone remotely pushing something onto your computer (or reading from it, or controlling it) is exceedingly rare, and exactly what the security on your computer is designed to prevent.

If you do fear the worst, then the only course of action is to erase the disk and reinstall the OS. Then restore your data from your backup, but not any apps or Library folders.

Answer 2

Hacking is not what you think it is; it social engineering.

There's no hacker that's going to spend time on your computer making it do "things" to interfere with your workflow. They are after information that will allow them to get to the next "hop" or system that you're connected to. Then, they will look for more information that gets them more privileges on more systems.

my MacBook's screen will light up (several times a week) when it is asleep, showing the log in screen. It will fall back asleep within a minute or so.

This sounds like Power Nap. Basically, your system will wake periodically to do some maintenance tasks.

As far as your logs go, it looks fine, but there's simply not enough to paint a clear picture - your sample size is too small and does not indicate any nefarious activity.

Unless you were installing software from unsigned developers and just putting in your admin password willy-nilly, there's really no reason to believe you're hacked.

With all that said, one of the best defenses against being hacked from a common threat - ransomware - is to have a backup. In this case, where you are actually the target, having a backup of all your data renders their attack moot. Yes they encrypt your files and ruin your day, but you're not out any money and back up and running in the time it takes to wipe your disk, re-install macOS and restore your data.