1

My MacBook Air was sent to a Technical Service from Apple in May 2022 because the login password didn’t work anymore and some strange things happened from that day to the present that concern me.

The 1st one is that a program I used recently said to me that the computer has a JailBreak and it is at my own risk use from this device the app.

From investigating a lot through Google about this I discovered using the Terminal of my MacBook the following output that makes me scared:

https://i.stack.imgur.com/K1496.png https://i.stack.imgur.com/QlM9b.png

As you can see in the images there are two users Leandritus console and Leandritus ttys000.

In the description you can see a lot of crashes, reboots and shutdown that I think I didn’t made.

Can anyone let me know what the information of each item in the terminal means? And if I was hacked what I can do for protect from these people? Buy a new device?

3
  • The user name is leandritus and the next field indicates where they logged in from. Based on your user name here, I assume that's your own user account. Can you please clarify whether this is correct, and the relationship to the account macbookpro? The information you have provided does not seem concerning at all, though the stuff about a jailbreak might deserve a new question of its own, with more details.
    – tripleee
    Jan 23, 2023 at 6:08
  • 5
    "A program said the computer has a Jailbreak". Which program, and what was the exact message? "Jailbreak" is a term used on iPhones, allowing third-party software from outside the App Store. On the Mac, that is already possible by default, so it makes no sense.
    – benwiggy
    Jan 23, 2023 at 7:35
  • 1
    @benwiggy - I have seen at least one iPad app that when run on a Apple Silicon Mac says "Your phone is jailbroken or rooted" The quality of the app which does run on the iPhone is as good as you would expect from that error message.
    – mmmmmm
    Jan 23, 2023 at 18:08

2 Answers 2

1

The information you have provided does not seem concerning at all, though the stuff about a jailbreak might deserve a new question of its own, with more details.

The user name is leandritus and the next field indicates where the user logged in from. Based on your user name here, I assume that's your original user account.

I guess what happened here is that you lost the password for leandritus and the service guys created a new account macbookpro with a new password for you. There's a third account mac which has logged in once.

If you have not enabled remote logins over the network recently, I think we can safely assume all of these were made by someone with physical access to the laptop. The ones on tty* are when you log in from a terminal window and the console ones are when you logged in from the login screen.

Again, all of this looks perfectly normal, at least in the absence of additional information to suggest that you have unauthorized activity on your computer.

Also, look at the dates - there were weeks between these crashes.

In some more detail, the last output indicates the user name, the location where the user logged in from (where known), the time of the login, and the duration of the session. See the manual page for details and additional options.

(The man page link is to an online version which might differ slightly from what you have installed. The command man last in a terminal window will display the manual page from your local system, which should be authoritative.)

If you really suspect that something is wrong, reinstalling the operating system using macOS Recovery (or if you have a really old machine, proper installer media such as an official Apple DVD) should always be sufficient to completely reset everything to factory state.

Obviously, you'll need to make sure you have backups of all your personal files before you do anything drastic, and restore them after the reinstall; but take care to separate out any untrusted executables you might have executed in the past and never run them again if you don't trust them.

0
0

No. You are not hacked.

It's very easy for people to see a screen on their computer or output from a Terminal that they're not familiar with and jump to the conclusion they've been hacked. This comes from the disconnect between what is seen in fictional programs on TV and movies that they are "going to open a port in the firewall and take control of the computer" followed by some furious typing and unrelated screen animations.

Hacking is 90% social engineering meaning if a hacker interacts with you, it's an attempt to gain your credentials through methods like phishing or infecting you with a trojan. If a hacker has access to your system it's usually for one of two tactics:

  • lateral or sideways attack - gain access to your system as a way to access another system close to you (i.e. a server you connect to on your network)
  • an attack proxy - attack other remote system while concealing the hackers identity and location (make it look like you are the hacker)

Console vs TTY

What you are seeing from the output of the last command is a history of where and when you logged in.

  • Console: A system console or root console is nothing more than the keyboard and screen attached to your computer.

  • TTY: This is a "terminal window." TTY is an acronym that comes from Teletype Terminal or Teleprinter which is the original way people connected to computers (via a serial connection). The TTYs on your computer are now considered pseudo-TTYs as there is no Teletype Terminal or serial connection but a connection over TCP/IP (the network).

What are you seeing?

You are seeing where your user account logged into either a console or a terminal window. Your last console login was Dec. 31st of which you haven't signed out. If you see the very top line where it says ttys000 -- still logged in, this is presumably the Terminal window you opened to issue the last command to produce the output you're viewing.

The third column (the dates and times) is when you logged in and whether it closed cleanly or if it crashed (you powered off your Mac without logging out, for example). The last column is the elapsed time of that session.

Additional Resources

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .