Re: [tlug] How to detect unwelcome visitors on my macbook?

[Ulrike Schmidt <ulrike.schmidt@example.com>]

Am 06.09.11 17:02, schrieb Bkay:
> What services are running/accessible to the outside world?
The current status, after I switched on the firewall this morning (it 
was off before, :() is:

$ netstat -an | grep LISTEN
tcp4       0      0  127.0.0.1.8600         *.*                    LISTEN
tcp4       0      0  127.0.0.1.8500         *.*                    LISTEN
tcp46      0      0  *.9980                 *.*                    LISTEN
tcp4       0      0  127.0.0.1.26164        *.*                    LISTEN
tcp4       0      0  *.17500                *.*                    LISTEN
tcp46      0      0  *.80                   *.*                    LISTEN
tcp6       0      0  fe80::1%lo0.49218      *.*                    LISTEN
tcp4       0      0  *.1715                 *.*                    LISTEN
tcp4       0      0  127.0.0.1.6969         *.*                    LISTEN
tcp4       0      0  127.0.0.1.64022        *.*                    LISTEN
tcp4       0      0  127.0.0.1.6970         *.*                    LISTEN
tcp4       0      0  127.0.0.1.12311        *.*                    LISTEN
tcp4       0      0  127.0.0.1.6968         *.*                    LISTEN
tcp4       0      0  *.12346                *.*                    LISTEN
tcp4       0      0  *.12345                *.*                    LISTEN
tcp4       0      0  *.10022                *.*                    LISTEN
tcp4       0      0  127.0.0.1.631          *.*                    LISTEN
tcp6       0      0  ::1.631                *.*                    LISTEN

Is that ok?
I am currently using something vnc like to troubleshoot a vserver as I 
posted a few minutes ago.

> Make sure your firewall is up and running....here is a good guide to 
> secure your Macbook and how to check for this
> http://www.nsa.gov/ia/guidance/security_configuration_guides/operating_systems.shtml#AppleMac
>
> If no services are accessible from the outside (you can always check 
> by running NMAP from another system on the LAN), it will be hard for 
> anyone to take over control of your Macbook....
>
> There are always "dial-home" baddies or reverse connections.... for 
> the paranoid I can recommend Little Snitch.
> http://www.obdev.at/products/littlesnitch/index.html
>
> Hope this can give some piece of mind. I'm curious to see if you 
> 'discover' anything. I'm familiar with forensics on Linux and Windows 
> but not so much MacOS although some principles/tools also apply I guess.
>
> Feel free to ping me if you need more help.

Thanks a lot, I will work through this and report!

Uli