Huawei hacked my settings?

[Christian Lembourn]

The other day I got a message on my iMac with something like: "Can't open Mac with Apple Watch because screen sharing is on".

I didn't have any screen sharing on...

So I opened up preferences and saw something strange."Other users can access your computer's screen at vnc://huawei_p20-[letters and numbers].localdomain/ or by looking for [my computer name] in the Finder sidebar."

I Googled Huawei P20 and apparently it is a phone. I newer owned any Huawei phones in my life. So where does those settings come from??

Same settings were also in "File Sharing" and "Remote Login".

Should I be paranoid? And how do I make it go away??? (Real settings should be: vnc://[ip-adress]/)

Chris

 

[Honza1]

I would get at least somehow paranoid.
First steps are easy: disable file sharing, remote login, and remove this address. Change user and admin passwords. That should stop this sharing, if the mac is not compromised in any other way.

If I see this correctly, you have just one real account? That means you are running as admin? That is bad idea, if you would run into some web page with ugly scripts, running as admin may allow this web page to make changes to your computer. IT is always better to have separate admin account. Create new admin account with some non-obvious name (not root or admin, may be ChrisAdminAcct or whatever else non obvious), make sure it works well and you can log in and aadminister the computer. Then change your standard account into standard, non-admin account. In tahat case, if you run into some ugly virus-liek scripts, you will be prompted for admin privileges. And I assume you will NOT provide them unless you agree with Huawei logging into your computer

I would look using etrecheck if there is anything which looks weird. It may be detective work to figure this out. Did anyone have access to the computer, did anyone connected Huawei phone to it for some reason, is there for some reason Huawei software installed? It could have come with some non-genuine software or some other less-than-original instal source... May be some web page was able to run installer... Too many options.

 

[JonaM]

It specifies a specific folder is shared - is that a folder you created/used for sharing previously? Might be worth checking the contents to see if there's anything untoward in it and maybe use time machine if you have to check back in time to see if there's any surprising changes.

I'd also advise checking your router settings as the sharing is set up for your local network, so if it was being accessed remotely from the internet then your router would also need to be set to pass through connections to your Mac, so that might help to reassure/confirm