macOS Need Help with Terminal, NVRAM, and Mac Address

How do you know your Mac was hacked? What were the symptoms?

Someone knowing your Mac address should not be much of a problem. There is little (if anything) you can do with it. Why did you repartition your drive? Your drives partition map also has little, if anything to do with the security of your system.

The MAC address is hardcoded to your NIC. You cannot change it on your Mac and have it stick.

If you are talking about the MAC address of your wireless card and your wireless router and you're using MAC address filtering, then you need to stop using that and start using WPA(2) to secure the network. MAC address filtering and SSID hiding are worthless forms of wifi "security".

macsrules said:

The Mac Address Identifies your computer on the network and I want it changed since this guy has it.

Click to expand...

Well, you can't. As already mentioned the MAC address is hard coded into the hardware.

Edit : Taking into account your above post, that little software trick of hiding the MAC address is not really going to help. MAC addresses are not needed to hack a machine. All you need to know is the IP address. Most applications use sockets which only use MAC addresses at the operating system level and as such are hidden from the program itself.

From what I remember, it doesn't actually work. When someone externally looks at the MAC address of the machine (e.g., on the router), it still replies with the correct (hardcoded) MAC address.

macsrules said:

Now, I want either a Shell Script or Have this Terminal Command install in NVRAM so that when I do reboot, this Terminal Command is one of the first things to launch. sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff

Click to expand...

The NVRAM doesn't work like that. It will have to be a startup script in /Library/StartupItems/.

Terminal Basics:
http://osxfaq.com/Tutorials/LearningCenter/index.ws

Shell scripting basics:
http://developer.apple.com/document...ripting/Introduction/chapter_1_section_1.html

And as noted, having the MAC address of your Mac doesn't really help someone to hack your computer.

Sounds to me like someone is just using your wireless network. The sharing section of the Finder sidebar shows any available network "server," not what is connected to you.

Overreaction?

macsrules said:

No knock on you but people are amazing too me.

Click to expand...

Right...we have no idea what we are talking about.

Hope your hacker won't find your new MAC address - http://www.macosxhints.com/article.php?story=20080119114003330

Looks like I am being hacked by 3 machines!

macsrules,

Before you ignore what people are telling you and think we don't understand, you may first want to look at what they're saying. Like kingjr3 said, it just sounds like someone is just on the same wireless network as you. If this is so, lock them out with WPA or WPA2. If you did get hacked, then securing your system is not too hard. You seem to have severely overreacted (basing on all the acts you took) to this and from what it sounds like, you may not quite know what you are doing (no offense).

For one, your permissions can be changed by many things. Secondly, as many others have said, changing your MAC address is not going to help your security at a level as you'd like...if at all.

Also, just leave the entire topic of NVRAM alone, it's not going to help you with anything you're aiming for.

And this is not meant as offensive, but if you can't even write a BASH script to automatically execute your command to spoof your MAC, you probably shouldn't be performing said action.


If you're still going to ignore everyone's advice, read up on BASH programming to change your MAC automatically.

macsrules said:

As far as that guy kingjr3 I am convenced he knows how to turn on the computer but that the extent of his help. The original post that I made works all he did was repost what I had up there. And your screen shot was funny, yours comes from a closed network I am guessing, anyway no more advice please.

Click to expand...

If you are not willing to accept the help being given to you then what is the point in asking? He made a very good point in saying it was probably just someone using your wireless network to get on the web. It really is very common.

Honestly, I believe it's just someone accessing your wireless network. They probably aren't going after your Mac at all. The chances they even got into your computer are pretty slim if you have a decent password and had your firewall enabled. However, I'll give you some basic security tips and something for BASH anyway as you asked.

For a Mac, there really isn't a whole lot you need to do. You may think this list is amateur, but trust me, it's all you should really need.

1. (and most important at this point for you) Secure your wireless network! Go into your router settings (while you're in there, make sure you've set your own password and it's not factory default), then change your wireless security to either WPA or WPA2. Make sure to give yourself a good password with letters, numbers, and preferably some capital letters as well. This will make the password harder to crack.

2. Enable your firewall. Keep it on and close whatever open ports when you're not using them if you're really concerned.

3. Have a good user password on your Mac account.

4. Make sure to keep your file sharing turned off or limited to Read/Write to only your accounts.

5. Don't click on or download things that could be malware.


If you're still inclined to spoof your MAC, which I advise against:
For BASH scripting, here is a link to a Google search I did with the term "BASH programming" which provides many options.
http://www.google.com/search?hl=en&q=BASH+programming&btnG=Google+Search

Kingjr3's post was NOT a repost of what you linked. What you linked was from 2003 and was pertinent only to Panther (and subsequently Tiger). What Kingjr3 posted was how to make this work in Leopard.

Beyond that, there's no need for all the snide comments. Despite what people have been trying to tell you in this thread, you don't seem to want to read and understand. You have been impossibly hacked and that's the story you're sticking with. Fine.

In order to do what you want (write a shell script that gets invoked at startup), you will have to understand the basics of how the Terminal works and then the basics of how to turn that understanding into a shell script. ONCE you have a working shell script, THEN worry about where to put it.

I already gave you all the information that you need last night, but I guess I have to quote myself:

yellow said:

Terminal Basics:
http://osxfaq.com/Tutorials/LearningCenter/index.ws

Shell scripting basics:
http://developer.apple.com/document...ripting/Introduction/chapter_1_section_1.html

Click to expand...

Caveats:

1. Please be aware that if you purchase music from iTunes, doing what you want to do might interfere with your ability to play said music.
2. What you are doing works ONLY with en0, your WIRED network interface.
3. I still think what you are describing is an issue with your wireless security. If you are behind a router, then it's highly unlikely that someone 'broke in' and did these things to your computers as the router has NAT built-in. It's far more likely that the attack is local. Deaf ears, I know.

Yellow actually answered your questions in the post he just quoted - check it out.

Read the tutorials on how to change your command into a shell script and you'll be fine. We've given you all the tools you need, but you have to figure out how to use them. It's unlikely any of us are going to write it for you, just read what we've all said and read the tutorials myself and Yellow have linked you to.

Just to echo a previous comment, changing MAC addresses can affect programs adversely, especially commercial/professional programs that use the MAC as the basis of a copy protect. Its generally a very bad idea, so unless absolutely necessary avoid it.

Also, be aware that you can "potentially", although its not likely run into routing issues if you have 2 computers with the same MAC on the same network. This is the reason manufacturers hard code a MAC in to guarantee uniqueness. Again, before I get flamed, i know its unlikely, but you have been warned!!!!

Finally, just to add my two cents, in addition to using WPA or whatever as your security protocol, why not turn on MAC address filtering and disable your SSID broadcast. That way no one will see your network, without some serious hacking tools, and no one will be able to connect unless they are spoofing one of your known MAC addresses (v. unlikely unless your machine has been physically compromised, in which case may i suggest new locks for your home ;-). This would be much more effective, less prone to adverse effects and easier to setup than changing your MAC. Of course, you could have also bought yourself a new USB network card to achieve the same result....

Anyway, my point is with WPA(2), MAC filtering and SSID broadcast off, you are not going to be hacked unless you have some pro hacker who really needs to get something off you machines. So unless you have the complete documented account of the Roswell incident or access codes for area 51 on there you should be fine...

macsrules said:

I ran OS X Rootkit on my computer

Click to expand...

You ran what?

This thing?

"OS X Rootkit Hunter"?

I wouldn't put too much stock in what it tells you.

For future reference, simply reinstalling the OS would have sufficed. A complete reinstall would have wiped all traces of possibly compromised files. Or, if you have a good backup system, simply moving back to the last known good backup.