Isolate System from ANY External Access

Working with Snow Leopard 10.6. Purchased 1 year ago.

Basically, I wish to prevent any network interface from being active and accessing the system in any form.

I have not and will never connect to the internet or any form of any network with this machine. I have other computers for that. This Mac is to function purely as a kind of isolated writing device that should never be able to receive signals from any device—Apple or 3rd party.

Despite having the airport card removed last Sep at an Apple store (genius bar), I'm still experiencing unusual behaviour—the same as before it was removed.

For example, while writing on the lower part of the screen/page, a line of text is deleted higher up the screen. I can not stop this from happening with the trackpad or by using force quit. I have to wait for it to stop. The only way to retrieve deleted portion is to command z. This has happened in Text Edit and also writing software. I have installed only one new program--the writing software. Everything else is as is.

This happened three separate times. Another time, writing I kept in text editor was deleted from a number of files when I came back to use the data. Sometimes my files are moved around the screen.

Sometimes the cursor starts moving by itself and clicking on other parts of the page and I lose control of it during that time. I have Activity Monitor open but I can't see anything change during that time.

Most recently, I was trying to delete the Bluetooth and Airport applications when I lost control and could not get the files into the rubbish. When I tried to delete them (changing preferences in Finder to secure delete—which overrides the programs running), it would not let me, even though I've done this on earlier installs easily.

Things I change in system preferences:
Turned the Apple Firewall on. Refused all incoming connections.
Disabled the Infrared Receiver
Turned off all network connections.
Removed blued/airport programs and all their components from core services. Removed any ip6, vpn, ppoe etc files.

Removed a lot of other files relating to network activity. Despite that, I still get the same behaviour as before removing the network card and these files.

I've tried installing the OSX several times. I do nothing and work and see what happens and get the same as when removing components. Either way, still the same losing control of the system. I don't run itunes, no movies, no music, nothing. Just writing. Activity Monitor sometimes shows new processes starting and stopping while I'm writing--I leave it open to see. Sometimes I click on the process with Quck Look but it quits before I get to examine it. This has happened several times.

It really is bothering me now as, technically, it should not be accessible.

I did a fresh install of OSX yesterday and opened system preferences, network, immediately, and got the message that it was identifying a new Firewire interface, the system froze, then everything went back to normal and no device showed up.

Is it possible that a 3rd party device can be interacting with the system? If so, how would I identify it and prevent it from working. Where are the devices located? The only time I did not have the computer in my possession was a few days when lending it to a colleague last year.

What kind of interface might enable this? How would I know?

On the Activity Monitor, on a fresh install, after the removal of the cards, it shows the network as sending 1 kb packets every couple of minutes or so. When I blocked ntpd it showed error messages in the Console. I figured that was normal, but I don't know.

I've been through all /usr/sbin etc folders and all /private folders, but I'm not technical enough to know what to remove other than the obvious network related files.

I'm wondering if there is possibly a USB/phone chip inside or some other hardware addition?

I installed Little Snitch today. I saw the usual ntpd-wrapper trying to send to an address.

In the way you can completely block all incoming and outgoing interfaces? Or with something like Kaspersky's security software would do in Windows, and in the way it has an operating system firewall that shows application activity in a networked environment—is there a Mac equivalent?

I want to completely shutdown access. I used Kaspersky in Windows to do this. Is there some way of doing this beyond the installed Mac software as it's not very effective.

I observed that a lot of Mac users believe it's not necessary to worry about security beyond the pre-installed firewall, but I believe we're all entitled to privacy and I would like to ensure my work does not disappear, get deleted or get altered while I'm working on it—especially the parts I can't see. Because it's writing, it's important that it does not get changed. I don't have time to go back and check every word to see if it's been edited without my knowledge or, worse, deleted.

I'm not technical at all, but it looks like there are a lot of security holes if you know what you're doing. I'm hoping someone with that knowledge might share how to shut them down, beyond the standard already attempted.

Thank you very much.

GGJstudios said:

If you don't have an ethernet cable attached and you simply turn AirPort off, you cannot connect to any network. Period.

That wasn't necessary. Simply turning AirPort off prevents any access to wireless networks.

That's because the symptoms you describe have nothing to do with your Mac being accessed by any outside party.

Absolutely not.

First, you haven't said what model Mac you're using. That would help. Your issues as described have nothing to do with access by any 3rd party or device and your attempts to cripple network capabilities is pointless. Start by saying what year and model Mac you're using and your problems can be diagnosed.

Click to expand...

Thank you. Working with Snow Leopard 10.6.6 purchased last February 2011.

So there is absolutely no way any kind of device can be attached to the hardware inside the casing that would connect to a remote server?

I cannot fathom why parts of work start deleting themselves on other parts of a page where I'm typing down below, or files shift around or the other problems mentioned, when no programs are open and I don't overload the system with anything more than text edit and one writing program, usually one at a time, not together.

I've never connected to the net and the only files I put on the system are the one piece of software. That's it. I use an isolated USB to put those files on that has connected only once with another MAC that was new at the time of copying the files.

simsaladimbamba said:

Of course there is, but is highly unlikely, unless you are the target of some intelligent service or similarly well equipped band of con artists or some other shady organisation.
What exact Mac do you have?

Image

Identify your Mac and Mac OS X version, visualised in a more elaborate image
Identify your Mac and Mac OS X version using this 25 second video tutorial (3MB, .mp4, H.264)​

Click to expand...

Thanks again. It's a MacBook Pro. 10.6.6 (Australia)

I don't want to be alarmist, but is it possible to explain what you would have to look for to identify something that could make that happen?

I don't think it's really productive arguing about the hows and whys. I've been reluctant to post this issue anywhere as I noticed a lot of Mac forums dismiss the possibility of access once airport is turned off.

I work in developing countries (have done for many years) and am well aware of scams and hence the need for keeping a machine isolated which is the point of this one.

I really just want to understand how to search / dig into the files/components to identify anything that can transmit data, and put a stop to whatever seems to be making stuff move of its own accord/causing work to disappear or shift around so I can get on and work without worrying about losing control of the system in the middle or writing or editing.

I don't know if this is the right place to ask that question but I do appreciate the thoughtfulness and help in figuring it out.

----------

simsaladimbamba said:

Have a look at Activity Monitor (Applications / Utilities /) and select All Processes and sort by Process Name and use CMD+P to print the complete list.
Then compress the PDF to create a .zip (if the PDF is larger than 234 KB) and then use Image button to attach that ZIP or PDF to your next post.

image below uses sorting by CPU as an example
Image

Click to expand...

Thanks. Will do tomorrow. Appreciate the help.

Phil A. said:

ntpd is the process that sets the time from a network server - if you go into system preferences / date & time and uncheck "Set date and time automatically" that activity should stop.

If you've not got a cable plugged in and airport is turned off, you should have no external connections to the outside world. However, to double check go into System Preferences / network. If there are any services listed there with a green light next to them, then they are connected. If this is the case, please let us know what they are

Click to expand...

Thanks for the comments and time in response to the questions.

I think I found the info requested in previous posts.

Model Identifier: MacBookPro8,1

Phil A. said:

ntpd is the process that sets the time from a network server - if you go into system preferences / date & time and uncheck "Set date and time automatically" that activity should stop.

If you've not got a cable plugged in and airport is turned off, you should have no external connections to the outside world. However, to double check go into System Preferences / network. If there are any services listed there with a green light next to them, then they are connected. If this is the case, please let us know what they are

Click to expand...

Thanks for the comments and time in response to the questions.

Model Identifier: MacBookPro8,1

For ref, I reinstalled OSX last night. Only changes after install were a few System Preferences and installing Little Snitch. The console Log attachment shows this.

I noticed immediately after install, the processes the loaded the first few restarts were different to those a couple of hours later. I.e. No blued or airportd loaded the first hour or so, but they did begin loading 1-2 hours later.

I attached a part window jpg of Activity Monitor which is from immediately after install.

I've attached a gif of Activity Monitor from 1-2 hours after install. Could not get zip below 300 kbs for this in pdf, sorry.

It probably is nothing, but I am a bit concerned. I've been writing/typing on PCs mostly for over 20 years and never had work remove itself or delete itself while I'm typing.

This stuff didn't happen until about 2 months after buying the machine. I love the Mac and how it works—far superior to Windows—and I bought it as it has a reputation for being more secure.

First couple of months were ok. I borrowed and attached a keyboard (cable) and mouse (cable) at one point to test as I also thought the trackpad might be the issue since I was new to it, but I still had the same problem with stuff deleting up the screen or down the screen, depending on where I was typing at that point. When I went back to trackpad I was careful when typing to keep hands up in case it was that, for whatever reason, but still having issues. I type fast (95wpm) with high accuracy most of the time and think it would be odd if I accidentally pressed delete or similar and held it down for as long as it would take to delete paragraphs of text while typing at that kind of speed. It doesn't really make sense. Or I would have been doing that before now, but I haven't.

I really want to be able to say to clients that their work is secure etc while I'm working on it and that I've done my best to ensure that.

Anyway. It probably is nothing, but I do appreciate feedback you may have after looking at logs and monitors. I know it's a lot to ask and everyone has time pressures so thank you.

Hello, Am wondering if anyone has any thoughts on this after posting the log files and screen shots above.

I had another problem today with the console log shutting down by itself at one point, little snitch shutting down at another point, which was logged, and then text edit not responding and forcing me to shut it down--within about 5 minutes of each other. I don't know what caused that as I was reading the log at the time and copying a part of it to text edit when it happened.

Thanks for your help in advance.