Have I been hacked?

[appleseedeater]

So, i think of myself as averagely computer savvy. I know how to use the odd terminal command, set up file sharing, troubleshoot bits and bobs. The strangest thing has happened, however, and i'm looking for some advice.

I left my Mac Pro on all day in my apartment - where i live alone - and when i returned, my login picture had changed (from a lion, to lips). The computer was connected to the internet, but not DIRECTLY - it was connected to a public broadband network (the kind that's siphoned off a home user's broadband package and beamed out as a public access network, so basically my neighbour) that needed a login for it to become active (i don't know if this would stop anyone hacking in). It also has a login password on the account (uncrackable), but no filevault.

I'm highly perplexed. My main concern is that i've been hacked, and someone has left this as a sort of "calling card". But, no files seem to be altered. Nothing seems to have changed at all.

Is this a bug? Can this happen? spontaneous user icon changing?

I'm a bit frightened. I have sensitive info on my computer.

Any help would be warmly warmly appreciated. This was my first place to think of coming to ask!

 

[maflynn]

If so, reset your password and to be absolutely safe reinstall OSX as you want to guide against anything installed. Also for the time being take your computer off the internet.

 

[benwiggy]

it was connected to a public broadband network (the kind that's siphoned off a home user's broadband package and beamed out as a public access network, so basically my neighbour)

Hmm. Sounds dodgy to start with.
If you're using someone else's network, then they could be monitoring your network activity. Are you friends with this neighbour? Perhaps speak to them about this.

My first reaction to any "have I been hacked" question is usually "No" -- unless physical access to the Mac is involved. However, I can't explain how that image might otherwise have changed, unless you accidentally moused over the image in System Prefs and changed it.

Firstly, I would have a look at the Console utility, and see what log messages were left while you were away. Anyone using sudo or authorising anything with an admin password will be logged.

If you can't trust the integrity of your installation, then you should reinstall and change all your passwords.

If you're not using FileVault, then you might want to consider doing the following for sensitive information. Create an encrypted disk image which then contains all your personal info. Double-click on it and supply the password to mount the image when you need the data, "eject" it when done.

 

[appleseedeater]

Thanks so much, guys.

I'm not sure how to look up logs in the console - but google will likely be my friend on that one.

thanks again for replying.

 

[benwiggy]

I'm not sure how to look up logs in the console - but google will likely be my friend on that one.

Launch the Console app in the Utilities folder.

 

[Mr. Retrofire]

I'm a bit frightened. I have sensitive info on my computer.

Let us hope it is encrypted and not encrypted with your login password.