Re: [tlug] How to detect unwelcome visitors on my macbook?

[Raymond Wan <rwan.kyoto@example.com>]

On Tue, Sep 6, 2011 at 6:34 PM, Ulrike Schmidt <ulrike@example.com> wrote:
> My local Mac Guru (who is unfortunately specialised on Windows otherwise
> and knows extremely little about Unix) thought maybe someone near me was
> using a wireless mouse. But this person would have to sit in another
> room. And anyway I am using a usb mouse, don't think a wireless mouse
> could interfere with that.


Oh...I forgot about that possibility.  Those wireless devices can
reach fairly far -- I haven't tried through walls, but easily from the
other side of the room (which isn't very far by Japanese apartment
standards :-) ).  Not sure what the odds of having the same frequency
are, but if you don't have a wireless mouse, then that's not it.


> BTW, yesterday before this happened out of some other reasons I tried
> `last` and `w` for the first time in life. But I still don't understand
> enough to interpret the results. I was suprised by `w` showing three
> users, but that might be ok. Currently after a reboot and with wlan
> switched off it is 2 users with my account on console and s000.


'w' will do that -- it includes any terminal you have open, remote
logins, desktop environment, etc.


> `last` shows my account loggend in on console, ttys000, ttys001 at times
> yesterday, but short before my panic shutdown only console and ttys001.
> Having these ttys* at the same time is probably no cause to worry, I
> guess from this thread:
> https://discussions.apple.com/thread/3183051?start=0&tstart=0


Yes, that's true.

If someone was trying to do harm to your computer, s/he would do
something undetectable through normal usage.  If someone was moving
your mouse and it wasn't a hardware glitch, it would probably be meant
as a practical joke...you should probably think back to April Fool's
Day and see who in your office you did something mean to.  :-)

As for your Subject (and not your actual problem) there are various
tools for detecting intruders.  I don't know what's available for Mac
and I'm only just learning them myself for Linux.  I installed
rkhunter [1] recently and have since been getting daily reports of
"nothing wrong" -- that's good, I guess.  :-)  Seems there are other
programs available; but I don't know what is good or what is overkill
for a personal machine (i.e., not normally connected to the Net).

Ray

[1]  http://en.wikipedia.org/wiki/Rkhunter for a one-paragraph summary