Jump to content

Macbook Air got hacked....

SwervinPersian
By SwervinPersian
in Troubleshooting
 Share
Posted

So i used to own a macbook air which i ended up giving to my mother, she's been using it for a while but now she ran into some issues. First she installed Macbook Keeper (this AV software which I googled years ago when I first got the Air, but never installed it after reading these AV software's cause more problems) which started something weird. Not only did it cause her more problems, but she ended up getting a phone call (home phone) from this Indian dude claiming he's some tech support. She did not fall for it and pretty much told the guy to F off. Keep in mind this is somebody who never shares their info around on sites, and has been enforcing me to do the same. Now alongside the disturbing fact that somebody could have hacked her phone number from her laptop and tried to sell her some bs software, she cannot use her laptop properly now. According to her, it keeps 'hanging', and that something keeps popping on the side (flowers?) and she just cannot do her work. I have not seen this myself, but I have uninstalled Macbook Keeper from her laptop but this 'hanging' issue is still due. 

I wanted to do a fresh Mac start (so backup her files and install Yosemite again), but I wanted to ask this forum if they got any better ideas? Also any of you can make an educated guess what is going on here, hack...no hack?

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/
Share on other sites
Link to post
Share on other sites
Posted

fresh install. 

Good luck, Have fun, Build PC, and have a Wii and PS2 as your only consoles.

NightHawk 3.0: R7 5700x @, B550A vision D, H105, 2x32gb Oloy 3600, Asrock RX9070xt Steel Legends, Corsair RM750X, 500gb 850 evo, 2tb rocket and 5tb Toshiba x300, 3x 6TB WD Black W10 all in a Obsidian 750D airflow.
GF PC: (NightHawk 2.0): R7 2700x, B450m vision D, 4x8gb Geli 2933, Sapphire RX 6700XT  Nitro+, CX650M RGB, Obsidian 350D

Skunkworks: R5 3500U, 16gb, 500gb 860 evo, Vega 8. HP probook G455R G6 Ubuntu 20. LTS

Condor (MC server): 6600K, z170m plus, 16gb corsair vengeance LPX, samsung 750 evo, EVGA BR 450.

Spirt  (NAS) ASUS Z9PR-D12, 2x E5 2620V2, 8x4gb, 24 3tb HDD. F80 800gb cache, trueNAS, 2x12disk raid Z3 stripped

HP probook 445R G6 review

 

"Stupidity is like trying to find a limit of a constant. You are never truly smart in something, just less stupid."

Camera Gear: X-S10, 16-80 F4, 35mm F1.4, Helios 44

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396421
Share on other sites
Link to post
Share on other sites
Posted

A tech support scam could easily just be phishing, not necessarily linked to the MacBook's issues.

 

It's hard to tell what is wrong with the device itself from what you've said. If you could share screenshots of the "flowers" and maybe give a bit more information as to what she was doing when it "hangs", whether it is random or program related, those things would help a diagnosis.

 

I know MacBook's can get hot, no clue if that's related in any way, plus your Mom sounds smart enough to know if it's overheating or not.

 

Maybe check for open ports, if it's hacked then it's almost definitely got an open port for the attacker to connect back on. The port could easily be 80 or 443 and therefore unidentifiable, but it's good to check.

Join the Appleitionist cause! See spoiler below for answers to common questions that shouldn't be common!

Spoiler

Q: Do I have a virus?!
A: If you didn't click a sketchy email, haven't left your computer physically open to attack, haven't downloaded anything sketchy/free, know that your software hasn't been exploited in a new hack, then the answer is: probably not.

 

Q: What email/VPN should I use?
A: Proton mail and VPN are the best for email and VPNs respectively. (They're free in a good way)

 

Q: How can I stay anonymous on the (deep/dark) webzz???....

A: By learning how to de-anonymize everyone else; if you can do that, then you know what to do for yourself.

 

Q: What Linux distro is best for x y z?

A: Lubuntu for things with little processing power, Ubuntu for normal PCs, and if you need to do anything else then it's best if you do the research yourself.

 

Q: Why is my Linux giving me x y z error?

A: Have you not googled it? Are you sure StackOverflow doesn't have an answer? Does the error tell you what's wrong? If the answer is no to all of those, message me.

 

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396441
Share on other sites
Link to post
Share on other sites
Posted
  • Author
2 minutes ago, LtStaffel said:

Maybe check for open ports, if it's hacked then it's almost definitely got an open port for the attacker to connect back on. The port could easily be 80 or 443 and therefore unidentifiable, but it's good to check

What do you mean with this? Where can one check this? :)

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396448
Share on other sites
Link to post
Share on other sites
Posted
6 minutes ago, SwervinPersian said:

What do you mean with this? Where can one check this? :)

Try the two commands suggested here. Look for ports besides 80 and 443. Look where it says "localhost:NUMBER", the number is a port. You can see what ports are doing what. Look for suspiscious ones. Before looking up how to close a port though, just Google the specific port and make sure it's not something legitimate, there are a lot of legitimate ports to have open.

 

Ports are...

They're like the gates for the internet on your machine and servers.

80 is HTTP and 443 is HTTPS, so when you request a web page on a server over HTTP, your computer sends a request out of port 80 and expects a reply to port 80. It's for organization of the traffic. If an attacker hacked the machine and wanted to connect back to it for remote control, then the program is going to listen on a port for incoming commands. There are a bunch of ports that could be open on the laptop legitimately, and IF it's hacked and IF the hacker is smart, he'd use a port that's already open and allowed. But if he's a "script kiddie" and used something off the internet, then it's probably using port 31337 or 1337 (ELITE and LEET respectively).

 

Your firewall manages ports.

 

(NOTE ::: I seriously doubt the device is hacked, but this is the only real way to check besides an AV that I know of.)

Join the Appleitionist cause! See spoiler below for answers to common questions that shouldn't be common!

Spoiler

Q: Do I have a virus?!
A: If you didn't click a sketchy email, haven't left your computer physically open to attack, haven't downloaded anything sketchy/free, know that your software hasn't been exploited in a new hack, then the answer is: probably not.

 

Q: What email/VPN should I use?
A: Proton mail and VPN are the best for email and VPNs respectively. (They're free in a good way)

 

Q: How can I stay anonymous on the (deep/dark) webzz???....

A: By learning how to de-anonymize everyone else; if you can do that, then you know what to do for yourself.

 

Q: What Linux distro is best for x y z?

A: Lubuntu for things with little processing power, Ubuntu for normal PCs, and if you need to do anything else then it's best if you do the research yourself.

 

Q: Why is my Linux giving me x y z error?

A: Have you not googled it? Are you sure StackOverflow doesn't have an answer? Does the error tell you what's wrong? If the answer is no to all of those, message me.

 

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396474
Share on other sites
Link to post
Share on other sites
Posted
25 minutes ago, LtStaffel said:

A tech support scam could easily just be phishing, not necessarily linked to the MacBook's issues.

still, there aren't many viruses for OSX due to how it's opereating system handles permissions for applications and partitions

there are some that can do what he's describing and more, recently a security hole was found in the operating system that allows applications to access it's internal workings without being detected

i don't think the air runs the latest version of OSX so it might be unprotected

anyways the wipe the opereating system, any accounts connected or accessed via it should have the password changed

****SORRY FOR MY ENGLISH IT'S REALLY TERRIBLE*****

Been married to my wife for 3 years now! Yay!

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396572
Share on other sites
Link to post
Share on other sites
Posted
24 minutes ago, samiscool51 said:

still, there aren't many viruses for OSX due to how it's opereating system handles permissions for applications and partitions

There aren't "many" only by comparison to Windows and other applications. There are plenty of vulnerabilities in anything.

Join the Appleitionist cause! See spoiler below for answers to common questions that shouldn't be common!

Spoiler

Q: Do I have a virus?!
A: If you didn't click a sketchy email, haven't left your computer physically open to attack, haven't downloaded anything sketchy/free, know that your software hasn't been exploited in a new hack, then the answer is: probably not.

 

Q: What email/VPN should I use?
A: Proton mail and VPN are the best for email and VPNs respectively. (They're free in a good way)

 

Q: How can I stay anonymous on the (deep/dark) webzz???....

A: By learning how to de-anonymize everyone else; if you can do that, then you know what to do for yourself.

 

Q: What Linux distro is best for x y z?

A: Lubuntu for things with little processing power, Ubuntu for normal PCs, and if you need to do anything else then it's best if you do the research yourself.

 

Q: Why is my Linux giving me x y z error?

A: Have you not googled it? Are you sure StackOverflow doesn't have an answer? Does the error tell you what's wrong? If the answer is no to all of those, message me.

 

Link to comment
https://linustechtips.com/topic/741237-macbook-air-got-hacked/#findComment-9396707
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Troubleshooting

×