There is no easy and trustable way to get the IP address of your attackant unless he made very stupid operations (like `ftp`ing from his real attack computer another tool).

## Tripwire ##
The only serious way to detect such an attack or any future attack through another MacOS X vulnerability is to install and use [tripwire][1]. `tripwire` is a modification logging software coming from the Unix and security field. (You can install it with `Macports`).

If you previously installed `tripwire` you would be able to detect such a successful attack in either of 3 ways depending on the level of skillness of the attackant.

## High level attack ##
Your attackant know `tripwire` and know he can’t tamper with its database.
He removes all your accesses or fully erase your filesystem to avoid being tracked back.

## Medium level attack ##
Your `tripwire` installation was removed and your access maintained. You will detect this attack by the removal of `tripwire`.

## Low level attack ##
Your attackant doesn’t know `tripwire` and all his modifications, even the removed log tracks, will be registered.


  [1]: https://www.tripwire.com/%20%E2%80%9Ctripwire%E2%80%9D