Be Excellent To Each Other

I know nothing about MACs (some might say I know nothing about PCs).

Mrs Kovs sister, has just split up with her fella (few months ago). He set the mac up and he is admin and she is not. She does not have the disks or admin passwords.

She thinks he has remote control of the Mac as starnge things happens, files moving/deleted/added.

How do I remove his access and make her admin.

It is Mac OS x, and the unit is one that looks like the apple TV.

Help me beex you are my only hope.

Go to system preferences, sharing and then see if screen sharing or remote login is turned on. If it is, turn it off.

Also in System Preferences go to users and groups to see what logins are setup.

If you can't access any of these or change them because he's passworded it it, I'm afraid its reinstall time.

Also check the router as he may have access via VPN or an open port.

I will do that next time I am round.. thanks

The rest of it, a rebuild?

I'm not familiar with Macs, but certainly with a PC in such a situation I would recommend completely wiping it and rebuilding it from the OS up.

Did the guy get good warning of the split? Was it acrimonious? Does Mrs Kov's sister have good reason to believe such shenanigans are in the guy's character/capability?

Anyone half-capable as a techy could easily plant all sorts of shit on a computer (keyloggers, remote control capability, remote monitoring, remote file access etc) and then explicitly tell any AV software on the machine to ignore it. (Also I'd recommend a factory reset on the router in case he's added in VPN/rules there too.)

TBH she needs to be an admin anyway, or she will need to be at some point.

Get her to backup whatever she needs from the machine, and then take off and nuke the site from orbit, it's the only way to be sure.

That's a good first place to check Chinny, but certainly on a PC anyone with half a brain wouldn't leave it as obvious as that.

Plus, if she isn't an admin she won't be able to modify/delete anything on the admin account anyway.

It's reinstall time full stop, IMO.

(And don't forget the router, as we've both flagged up!)

In fact, thinking about it, if she really does think the guy is up to something like this, she should consider anything she's logged into on that machine compromised as well - as a keylogger is an obvious thing for a spurned partner with a grudge to want to leave behind.

If it's not got two-step authentication on it (i.e a session password generating token such as you get for online banking), consider it compromised, (email, Amazon, etc), and start changing passwords. (On a different machine, obviously!)

I assume you already have good cause to think something is afoot Kovacs, so you need to cover all the bases.

How do I get a set of discs?

Is the licence number on the mac?

Just fuck me! Is this guy retarded or is he just trolling now?

There is no key to worry about.

If you don't have media (new Macs won't) easiest way is just to go to the app store and just spend the 20 quid or so that the latest OSX costs. That way she gets an upgrade at the same time.

Just follow these instructions to download it to a DVD or memory stick:

http://lifehacker.com/5928780/how-to-bu ... lash-drive

Do not do an upgrade install. You need to start again. Just found this on the Apple discussion site:

Oh give it a rest, the same advice would hold true for any computer in such a situation, irrespective of the operating system.

1) The Mac has keyloggers. (And I know it does 'cause there are several available to purchase from a quick Google search.)

2) Kovacs clearly has reason to believe something is afoot, the level of disruption that is being seen with the file system (and that's just what's visible to the untrained eye), suggests some kind of remote fuckery.

We can agree on those two points, yes?

We've already given two of the same pieces of advice, reinstall OS and check the router, yes?

Get off my fucking back.

Heh!

So was she cheating on him or what?

Well, gather close and I will tell all...

Thanks Chinny you are a star...

I'm not the one butting in when I admit I know jack all, just to be the centre of attention. You know perfectly well what you are doing, so behave.

OK then Chinny answer me this.

100% objectively, do you agree or disagree with my advice that Mrs Kov's sister should consider anything that she's given a username and password to on that computer, that doesn't have two-step authentication on it, to be compromised or potentially compromised?

I am genuinely trying to help Kovacs here, it's after going home time on a Friday night and BEEX is quieter at the weekend, not so many folks are around and posting. I'm not a Mac expert but I understand basic security principles, and that's the place I'm offering Kovacs advice from.

But call me 'retarded' if that helps.

THE SAME ADVICE WOULD HOLD TRUE WHATEVER THE FUCKING OPERATING SYSTEM.

I realise you get off on people responding so I'm going to keep this brief. I'll outline it in a way that even the hard of understanding can follow.

Chances are the Mac just has one of the default remote admin options I listed turned on. This should be the first port of call. If said boyfriend was maintaining the Mac already, in all probability he enabled this for ease of maintenance and is now using it maliciously. No need for a keylogger, he already has a way in to delete files and mess around.

However, chances are he installed himself as admin in which case changing the preferences won't be possible so all bets are off anyway.

So blathering on about keyloggers isn't that relevant. Why would you install one when the OS gives you easy access to begin with? An OS you admit you know FUCK ALL about.

Pull the network connection to start with

Edit: wow, things moved on!

We still don't have the whole story from Kovacs, but we are forced to conclude that there is strong suspicion that something is afoot simply by virtue of him starting this thread and what information we have thusfar.

If I were a spurned boyfriend with bad intentions, I wouldn't just leave behind the default remote control options, I'd install a keylogger, I'd fuck with the AV software (exceptions rather than disabling it completely), I'd install remote screenshot and recording software, I would gather as many usernames and passwords as I could, I would basically own that computer in every possible way I could before my physical access to it was revoked, and carry on doing so remotely.

That's why I recommended a reinstall of the OS, and also checking the router - which is exactly the same advice that you gave, and I wrote my post whilst you were writing yours, so it's not like I copied you.

'Blathering on' about keyloggers is entirely relevant, especially since you readily concede that if he is still using the default remote control option, he's using it 'maliciously'. (By default he is, since it's not his computer to use any more, so he is a de facto hacker if he's still accessing it in any way at all.) If he's got malicious intent, you can't say with any degree of certainty whatsoever that he won't have lobbed a keylogger on there or all kinds of other shite.

My question stands, do you think that any usernames and passwords that Mrs Kov's sister has used on that computer are compromised, or at least potentially compromised, by her ex-boyfriend?

Come on Chinny, yes or no, have a guess at least.

Maybe I should start a poll.

If it is password protected it might be worth having someone look at it before it is wiped. Do you live near an apple store? It might be worth just giving them a ring, booking an appointment for today/tomorrow, and getting them to look at the settings.

They are very good in the apple stores, I've found. That 'genius bar' thing. I think they'll be able to change access without wiping it, and it would help with her peace of mind to have it checked. I'd probably change email account passwords (etc) as well, to be on the safe side.

I think it is worth changing email account passwords and the like too.

It's easy to install a keylog daemon on OSX and then do a ssh login remotely to access the log. Switching off remote access will prevent that but it might be too late.

Good point Meems. If you are lucky enough to have an Apple store nearby, its the easiest option (I always assume people aren't near one but of course they are far more common these days).

Even as an Apple owner I feel uncomfortable in those places but book a Genius Bar appointment and they'll sort it. Just grit your teeth when you are in there!

The nearest one is Birmingham. I think

Even when I looked into this many years ago, the PC software at the time not only took the keylog itself, it could be set to take screenshots and/or videos at specified intervals, or when particular applications were fired up, and so on - and then email the results out on a schedule to an address or addresses specified. It also hid itself from installed programs and task manager and everything else.

Like I say, this was the best part of ten years ago, and I can only assume the technology has got better since then.

I did a test install and it was pretty scary how it hid itself and evaded the AV software, and could only be invoked by a really complex key combination that could be user defined.

The relevance here is that the potential for the Mac to be owned in the same way definitely exists, and as such it needs to be nuked and rebuilt. On top of that I would definitely consider all logons and passwords accessed from that machine to be compromised, (along with any documents, photos, videos etc), and I'd be wanting a thorough check or preferably a factory reset on the router as well.

So I got a Snow Leopard disc for my Leopard MB.

I was going to get a new hard drive, to move all my files to. Clean slate, start anew etc.

But I read this, which suggests I can install over my existing OS. Is this right? And is it advisable?

I have Time Machine, if that helps.

Yeah, it'll be fine. Double check that backup though. You never know!

For the mac and MacBook we downloaded Snow Leopard and installed straight over the top of leopard. Then Montain Lion was a quick purchase from the newly available App Store; again installed straight over the top.

Sweet. Time Machine backup just completed. I'm gonna give it a go!

Boom! Updated. Last.fm finally updated, Chrome auto-updated (flash is back!). Now for iTunes.

And he was never seen from again...

Now pay £14 and upgrade to mountain lion!

What a gyp! Still on iTunes 10. OK, might as well do Mountain Lion.

It all looks a bit nicer.

Is that the actual upgrade price? That a really good price for a major OS upgrade; are Mac OS upgrades generally so bargainatious?

Yes.

Aye.

Fair enough.

This is crazy. iMessage on my laptop!

But scrolling has been reversed, confusingly.

Fuck this!

Look for Natural scrolling in the mouse settings and turn it off if you want to go back to your heathen ways.

What's the problem? That's sorted in a few seconds.

I don't know shit about Macs but, taking that message at face value, don't you just have to change an option somewhere to allow non-approved apps to run? It's a bit shit if that's a previously installed app that's now suddenly throwing an error of course, but if it's easily sorted...?

Correct. System preferences -> Security and Privacy. Options are App store only, approved developers + app store, or please rape my computer Mr Malware Person.*


* Last option may be an exaggeration.

Ooh, bonza! Cheers.

[edit] Turns out ctrl+click > open does it without changing settings.