Arresti anomali relativi all'accesso remoto?

1

Odio sembrare come tutti gli altri. Penso che il mio computer sia accessibile a qualcuno, probabilmente a qualcuno che mi ha regalato il computer. Non mi importa affatto di lui o di qualcun altro.

Qualsiasi trucco per trovare un utente nascosto tramite Terminale.

Giuro di essere appena arrivato sul computer e lo schermo ha fatto scattare alcune volte mostrando diverse impostazioni di condivisione attiva, ma poi quando ho avuto accesso alle impostazioni di sistema effettive è tornato il modo in cui l'ho configurato. Che spero impedisca a chiunque di accedere.

Come posso verificare tramite terminale se qualcuno è sul mio computer. È solo nella mia presenza fisica, tuttavia brucia con batteria completamente carica in meno di due ore.

Ho avuto questo incidente e ho pensato che potrebbe essere rilevante per lo scenario attuale possibile.

Process:               com.apple.WebKit.WebContent [2000]
Path:                  /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
Identifier:            com.apple.WebKit.WebContent
Version:               10603 (10603.3.8)
Build Info:            WebKit2-7603003008000000~3
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Safari [1959]
User ID:               501

Date/Time:             2017-12-05 06:12:06.596 -0800
OS Version:            Mac OS X 10.10.5 (14F2511)
Report Version:        11
Anonymous UUID:        02226814-09F9-0EEC-CF58-B3BDA3B12B6D

Sleep/Wake UUID:       A7F28CC0-C4E5-4F19-B2B9-E36DAC121165

Time Awake Since Boot: 18000 seconds
Time Since Wake:       14000 seconds

Crashed Thread:        1815  WTF::AutomaticThread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000008

External Modification Warnings:
Thread creation by external task.

VM Regions Near 0x8:
--> 
    __TEXT                 000000010d6d4000-000000010d6d6000 [    8K] r-x/rwx SM=COW  /System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

Application Specific Information:
Bundle controller class:
BrowserBundleController


Thread 0:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fff8e598136 __psynch_cvwait + 10
1   com.apple.JavaScriptCore        0x000000010e13637f WTF::ThreadCondition::timedWait(WTF::Mutex&, double) + 63
2   com.apple.JavaScriptCore        0x000000010ed656e2 WTF::ParkingLot::parkConditionallyImpl(void const*, WTF::ScopedLambda<bool ()> const&, WTF::ScopedLambda<void ()> const&, WTF::TimeWithDynamicClockType const&) + 2610
3   com.apple.JavaScriptCore        0x000000010e97269e JSC::Heap::stopIfNecessarySlow(unsigned int) + 254
4   com.apple.JavaScriptCore        0x000000010e97250f JSC::Heap::stopIfNecessarySlow() + 47
5   com.apple.JavaScriptCore        0x000000010e973064 JSC::Heap::decrementDeferralDepthAndGCIfNeededSlow() + 100
6   com.apple.JavaScriptCore        0x000000010ec9e748 JSC::Structure::materializePropertyTable(JSC::VM&, bool) + 1096
7   com.apple.JavaScriptCore        0x000000010e2a9b64 llint_slow_path_get_by_id + 948
8   com.apple.JavaScriptCore        0x000000010eb52f03 llint_entry + 11397
9   com.apple.JavaScriptCore        0x000000010eb56ae8 llint_entry + 26730
10  com.apple.JavaScriptCore        0x000000010eb56ee2 llint_entry + 27748
11  com.apple.JavaScriptCore        0x000000010eb5009b vmEntryToJavaScript + 299
12  com.apple.JavaScriptCore        0x000000010ea27eee JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158
13  com.apple.JavaScriptCore        0x000000010e15dbea JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 522
14  com.apple.JavaScriptCore        0x000000010e6572bd JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 173
15  com.apple.WebCore               0x000000010ffa1332 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) + 594
16  com.apple.WebCore               0x000000010ffa0f36 WebCore::ScheduledAction::execute(WebCore::Document&) + 134
17  com.apple.WebCore               0x000000010f1bc4dc WebCore::DOMTimer::fired() + 332
18  com.apple.WebCore               0x000000010f0e063f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175
19  com.apple.WebCore               0x000000010f0e057f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31
20  com.apple.CoreFoundation        0x00007fff994c4204 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
21  com.apple.CoreFoundation        0x00007fff994c3e93 __CFRunLoopDoTimer + 1059
22  com.apple.CoreFoundation        0x00007fff9953753d __CFRunLoopDoTimers + 301
23  com.apple.CoreFoundation        0x00007fff9947f428 __CFRunLoopRun + 2024
24  com.apple.CoreFoundation        0x00007fff9947e9f8 CFRunLoopRunSpecific + 296
25  com.apple.HIToolbox             0x00007fff8ddd356f RunCurrentEventLoopInMode + 235
26  com.apple.HIToolbox             0x00007fff8ddd32ea ReceiveNextEventCommon + 431
27  com.apple.HIToolbox             0x00007fff8ddd312b _BlockUntilNextEventMatchingListInModeWithFilter + 71
28  com.apple.AppKit                0x00007fff8f2958ab _DPSNextEvent + 978
29  com.apple.AppKit                0x00007fff8f294e58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
30  com.apple.AppKit                0x00007fff8f28aaf3 -[NSApplication run] + 594
31  com.apple.AppKit                0x00007fff8f207244 NSApplicationMain + 1832
32  libxpc.dylib                    0x00007fff99bcf928 _xpc_objc_main + 793
33  libxpc.dylib                    0x00007fff99bd1030 xpc_main + 490
34  com.apple.WebKit.WebContent     0x000000010d6d5792 0x10d6d4000 + 6034
35  libdyld.dylib                   0x00007fff998435c9 start + 1

Thread 1:: Dispatch queue: com.apple.libdispatch-manager
0   libsystem_kernel.dylib          0x00007fff8e599232 kevent64 + 10
1   libdispatch.dylib               0x00007fff945c326e _dispatch_mgr_thread + 52

Thread 2:
0   libsystem_kernel.dylib          0x00007fff8e5934de mach_msg_trap + 10
1   libsystem_kernel.dylib          0x00007fff8e59264f mach_msg + 55
2   com.apple.CoreFoundation        0x00007fff9947fcd4 __CFRunLoopServiceMachPort + 212
3   com.apple.CoreFoundation        0x00007fff9947f19b __CFRunLoopRun + 1371
4   com.apple.CoreFoundation        0x00007fff9947e9f8 CFRunLoopRunSpecific + 296
5   com.apple.AppKit                0x00007fff8f35d56b _NSEventThread + 137
6   libsystem_pthread.dylib         0x00007fff9338905a _pthread_body + 131
7   libsystem_pthread.dylib         0x00007fff93388fd7 _pthread_start + 176
8   libsystem_pthread.dylib         0x00007fff933863ed thread_start + 13

Thread 3:
0   libsystem_kernel.dylib          0x00007fff8e598136 __psynch_cvwait + 10
1   libc++.1.dylib                  0x00007fff96a9bc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47
2   com.apple.JavaScriptCore        0x000000010ed7d39c void std::__1::condition_variable_any::wait<std::__1::unique_lock<bmalloc::Mutex> >(std::__1::unique_lock<bmalloc::Mutex>&) + 108
3   com.apple.JavaScriptCore        0x000000010ed7d31b bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadRunLoop() + 155
4   com.apple.JavaScriptCore        0x000000010ed7d1ed bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>::threadEntryPoint(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*) + 29
5   com.apple.JavaScriptCore        0x000000010ed7d49d void* std::__1::__thread_proxy<std::__1::tuple<void (*)(bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*), bmalloc::AsyncTask<bmalloc::Heap, void (bmalloc::Heap::*)()>*> >(void*) + 93
6   libsystem_pthread.dylib         0x00007fff9338905a _pthread_body + 131
7   libsystem_pthread.dylib         0x00007fff93388fd7 _pthread_start + 176
8   libsystem_pthread.dylib         0x00007fff933863ed thread_start + 13


External Modification Summary:
  Calls made by other processes targeting this process:
    task_for_pid: 2077
    thread_create: 2042
    thread_set_state: 0
  Calls made by this process:
    task_for_pid: 0
    thread_create: 0
    thread_set_state: 0
  Calls made by all processes on this machine:
    task_for_pid: 19253
    thread_create: 10820
    thread_set_state: 0

VM Region Summary:
ReadOnly portion of Libraries: Total=316.3M resident=140.6M(44%) swapped_out_or_unallocated=175.7M(56%)
Writable regions: Total=1.2G written=37.2M(3%) resident=20.1M(2%) swapped_out=78.8M(6%) unallocated=1.2G(98%)

REGION TYPE                        VIRTUAL
===========                        =======
CG shared images                      144K
CoreAnimation                           8K
Dispatch continuations               8192K
Foundation                              4K
IOKit                                12.1M
Image IO                               84K
JS JIT generated code               128.0M
JS JIT generated code (reserved)    896.0M        reserved VM address space (unallocated)
Kernel Alloc Once                       8K
MALLOC                               73.1M
MALLOC (admin)                         32K
Memory Tag 242                         12K
OpenGL GLSL                           256K
STACK GUARD                          56.0M
Stack                                10.1M
VM_ALLOCATE                          81.1M
WebKit Malloc                        50.1M
__DATA                               29.3M
__GLSLBUILTINS                       2588K
__IMAGE                               528K
__LINKEDIT                           95.3M
__TEXT                              221.1M
__UNICODE                             552K
mapped file                          53.1M
shared memory                          68K
===========                        =======
TOTAL                                 1.7G
TOTA]

Qualsiasi assistenza apprezzata.

    
posta norcalang 06.12.2017 - 09:46
fonte

1 risposta

2

La prima cosa da fare con qualsiasi computer dotato di te è nuke & spianare.

Nulla di ciò ti appartiene comunque, nemmeno il sistema operativo stesso; qualsiasi aggiornamento richiederà le credenziali del proprietario originale ... quindi trash tutto e amp; ricominciare. Beneficio secondario è che puoi essere assolutamente certo che nulla può spiarti.

Vedi - Apple KB: cosa fare prima di vendere o regalare il tuo Mac

Poiché il proprietario originale non ha completato i passaggi da 1 a 5, puoi ignorare & inizia dal passaggio 6.

Avrai anche il vantaggio di avere un sistema operativo più moderno anche lì.

    
risposta data 06.12.2017 - 10:22
fonte

Leggi altre domande sui tag