4 ms·
Ask HN: How to inspect a Macbook?
So a lady came to me wanting to know if I could look at her Macbook. Apparently her husband was an IT guy and they divorced, well that wasn't pretty. He supposedly put key loggers and spyware programs on her Macbook and now she's pulling her hair out because no one will look at Macs around here.
My question: There is so much junk on here, I just want to wipe it all and start over but she wants me to actually investigate and see if there are shady programs on here and document it. How would I go about doing such things? Also, does anyone know of a program that shows all outgoing internet connections and if there are fishy files?
- iamdave 15y agoAlso, does anyone know of a program that shows all outgoing internet connections and if there are fishy files? Wireshark, though it's got a bit of a curve to it, provided you know how to identify packets.
- benologist 15y agoWouldn't malware be smart enough by now not to send stuff while Wireshark's running, or even to not send while the machine's actively being used?
- iamdave 15y agoTypically yes, but if it's communicating, it's got to do it somehow, which is why I added the caveat that op knows how to read a packet output.
- ejenkinsiii 15y agoLilSnitch will show all outgoing request
- durin42 15y agoI've heard great things from paranoids about Little Snitch on OS X.
- joshmlewis 15y agoI'm downloading it now. I deleted all the apps except the basic Mac apps. I'm going through the activity monitor trying to find things that don't look right. There was a VPN client which I'm assuming he's used.
- cyber 15y agoWell, at this point, it's all idle curiosity on her and your part. The first thing you should have done is image off a couple of copies of that drive. One for archive, the other to examine. A ram snapshot would have been good as well.
- joshmlewis 15y agoAh yeah. Good idea. I don't think it's really that big of a deal, I think she was just curious. I would be too. Everything looks ok for now though. I don't think he would be that smart working for a company around here.
- joshmlewis 15y agoI found a thing called rpc.lockd. Looks like its some type of linux command. Anyone know anything? And syslogd.
- jason_slack 15y agorpc.lockd - http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man8/rpc.statd.8.html http://developer.apple.com/library/mac/#documentation/Darwin... syslogd - http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/syslog.1.html%23//apple_ref/doc/man/1/syslog http://developer.apple.com/library/mac/#documentation/Darwin...
- jason_slack 15y agoJosh - You can have the best of both worlds. Boot to a spare HD or Target boot, use Disk Utility and take a DMG of the hard drive as it sits now. You can move that to where ever you want to examine the contents. This frees up the drive for reloading the OS (and this is a must if you suspect foul play) and you can examine at your leisure knowing you have an exact image of the drive. If you are in the Bay Area, CA, I would be happy to help over coffee. Contact info in profile.