Is someone in my house spying on my internet activity?

[jbuk]

I have that router, and whilst there is no direct function to monitor all sites visited, it is possible to add a list of blocked sites and then log when those are visited. There is also an option to give a certain IP unfiltered access to the internet, but that would probably disable the logging and so he's probably doing it some other way.

 

[shortbreadluver]

1) When you say you saw that you had sent spam, do you mean this was literally in your sent items? Or did you just hear about it? At the bottom of the page in gmail you can see if you are logged into any other IP addresses. Check that.

2) I don't know about that. Maybe do a repair permissions? (shot in the dark but it can't hurt)

3) Mice can be bastards, especially the mighty mouse. I hated that thing for that exact reason (and many more) and stopped using it. I wouldn't worry about the mouse problem unless you see it deliberately moving around and doing things.

1) I can't recall if I literally saw it in my sent items, but I had friends who emailed me back about it, with the spam email quoted, which was how I learnt about it.

2) I routinely repair my permissions. The problem happened only a few times, and I haven't experienced it in awhile

3) Well, that's a relief

It almost sounds like someone has an admin account on the computer and has turned on parental monitoring. This does basically what he has been saying, basically allows them to see just about everything you've been doing, I think even what you've typed into the computer. Thus that time with no password, they logged in and created the account. It is now hidden from you and you can't see it (guessing you don't have admin rights).

Now it could be something else too; they could have logged in and turned on remote access. Now they can see everything that you are doing and even control your mouse. When you are there, or when you're away.

Go to System Preferences -> Accounts and see if there is a check mark in front of "Enable Parental Controls". If so, they have tons of control over you.

I just checked, and Parental Controls aren't enabled. I'm the only administrator and user of my computer, so that would be unlikely.

The mouse moving could simply be due to optical mouse issues; on some surfaces the cursor can jump around randomly.

OTOH, it could be that someone is logged onto your site via some Remote Desktop/VNC solution; and may have been moving the cursor at the same time. (Actually happened to me once on my Mac at home and freaked me out!)

Check the Sharing pane in System Preferences, and turn off everything you don't need. In particular, Remote Login and Remote Management should be off if you don't use them.

Probably worthwhile changing the passwords on your Mac (bear in mind there may be other several accounts on your Mac, so just changing one won't keep someone out if they have the password to another).

Likewise, change your email account password.

My first instinct was to check the Sharing pane too, in case someone had discreetly changed my settings, but all is normal there. Only File Sharing and Printer Sharing are enabled.

Is it possible to detect if someone is accessing my computer via Remote Login/VNC? On that note, what exactly is VNC and what is its use?

I have that router, and whilst there is no direct function to monitor all sites visited, it is possible to add a list of blocked sites and then log when those are visited. There is also an option to give a certain IP unfiltered access to the internet, but that would probably disable the logging and so he's probably doing it some other way.

That's what I feared. At least router logging would feel a little bit more legitimate...

 

[Consultant]

If it's your brother snooping, then tell your dad.

If it's your dad, then stop doing what you are doing.

3) Mice can be bastards, especially the mighty mouse. I hated that thing for that exact reason (and many more) and stopped using it. I wouldn't worry about the mouse problem unless you see it deliberately moving around and doing things.

Actually I would say someone has remote screen viewing enabled but didn't disable remote mouse / keyboard control.

 

[shortbreadluver]

If it's your brother snooping, then tell your dad.

If it's your dad, then stop doing what you are doing.



Actually I would say someone has remote screen viewing enabled but didn't disable remote mouse / keyboard control.

If it's my brother - I would first require concrete evidence that he is indeed snooping.

If it's my dad - I don't actually surf any seedy sites, so I'm not afraid of that. What I'm not okay with is the idea of someone surreptitiously infringing into my privacy. I don't think that's a feeling anyone likes.

Is there any way of detecting if someone has installed a keylogger on my computer/has remote access to my computer/remote screen viewing, etc.?

 

[DoFoT9]

Pure dumps of traffic would be a lot of trouble, but there are packages out there that make it pretty easy, e.g. MING Network Monitor.

i guess so.. but i was assuming that his brother/dad whatever was on a mac :\ im not aware of any software for macs taht can do that..

 

[rowsdower]

i guess so.. but i was assuming that his brother/dad whatever was on a mac :\ im not aware of any software for macs taht can do that..

I was originally assuming that the OP was confident that he had complete control over his machine but it seems that that is not so certain. I think the VNC/screen sharing ideas are more likely at this point.

 

[DoFoT9]

I was originally assuming that the OP was confident that he had complete control over his machine but it seems that that is not so certain. I think the VNC/screen sharing ideas are more likely at this point.

yes i thought that something of that sort may have been the case. thats kind of... creepy... though.

 

[leighonigar]

If I was really keen on finding out what someone was doing on their computer, without knowing their login password but having physical access to the computer is:

get another mac

a firewire cable

and boot the first mac in target disk mode.

Unless the computer you want to access has file vault enabled then you can just read or copy off any data that you fancy, and the computer's owner wouldn't notice.

Pretty far-fetched though, and I don't know how browsing history is stored these days.

 

[savar]

It's super easy to spy on somebody on the same network segment.

Google search for Packet Peeper. This is a Cocoa version of a well-known program called Wireshark.

I use this frequently in my job as it is invaluable for troubleshooting. Contrary to what others are saying, ITS VERY EASY TO USE. Download it and try it.

Now it takes a little bit of knowledge to set it up for spying, but most technically-inclined people can figure this out on Google.

The only ways around this:
- talk to your brother/father/whatever and ask them to stop spying on you [easiest!]
- encrypt all of your communications
- use a proxy

The 2nd and 3rd are technical and complicated. I wouldn't recommend them. Face your problems like a man and confront the person who is spying on you.

EDIT:

If you are concerned about spyware on your Mac -- unlikely b/c its a Mac -- go to the terminal application and type the following:

netstat -an

Copy and paste the results back to this thread. If you do have spyware, then the encryption and proxy techniques I mentioned above will not work.

 

[DoFoT9]

It's super easy to spy on somebody on the same network segment.

Google search for Packet Peeper. This is a Cocoa version of a well-known program called Wireshark.

I use this frequently in my job as it is invaluable for troubleshooting. Contrary to what others are saying, ITS VERY EASY TO USE. Download it and try it.

excellent! i have been using wireshark at uni (for work of course) for a while and am familiar with it, the mac version is..well.. CRAP! hopefully i will have more success with this version. thanks very much

 

[iBlue]

1) I can't recall if I literally saw it in my sent items, but I had friends who emailed me back about it, with the spam email quoted, which was how I learnt about it.

I asked because if you see these things in your sent items, someone actually used your email account to send them (meaning maybe your brother accessed your computer to send spam, perhaps to blame it and everything else on a hacker or whatever). <locates tinfoil hat>
Email addresses can be spoofed, i.e., someone is sending things to appear as though it originated from your email account even though it wasn't. Those would not show in your sent items. (pointing out a big difference) I thought it may give a better idea if someone physically sent it from your email address or if your email address was spoofed. Of course if your brother is a tricky bastard and he did all this with that in mind, he may have deleted them himself. I don't know, just some random thoughts.
I think it may be time to tell your parents about your brother, unless you have some reason you're not comfortable with that.

Actually I would say someone has remote screen viewing enabled but didn't disable remote mouse / keyboard control.

Hmmm, maybe. My original thought was that sporadic mouse movements doesn't automatically mean remote access. The mighty mouse is a POS, it randomly jerked about on me all the time and I had no remote access issues.

 

[shortbreadluver]

Everyone, thanks for the responses.

My two main questions now are:

1) Can I detect if someone has installed a keystroke logger on my Mac/has remote screen viewing/remote access to my computer?

2) How can I prevent something like that from happening?

 

[5DollaFootlong]

you could always use hotspot shield but i would personally just follow your dad's directions because its his house

 

[whooleytoo]

Everyone, thanks for the responses.

My two main questions now are:

1) Can I detect if someone has installed a keystroke logger on my Mac/has remote screen viewing/remote access to my computer?

2) How can I prevent something like that from happening?

1) Not easily. You can scan through the running processes (in Activity Monitor) to see if there's anything strange running; but it might not be easy to spot, and might not be running all the time. Your best bet is to install something like Little Snitch, which will at least reveal/prevent anything being sent over the network. As long as the (hypothetical) person who installed the keylogger doesn't have physical access to your machine, that should do.

(p.s. if any app should ever be bought up, and rolled into the OS, it's something like Little Snitch!)

2) For screen sharing/remote login apps, use the tips mentioned previously to ensure you don't have anything turned on that you shouldn't. That includes checking for any VNC servers (other than the OSX built-in option). For keyloggers, it's more complex. You can't do much more than:

- Password protect your account, with a long, complex password. Don't give it to anyone. Set your Mac to prompt for the password on boot, and on wake from sleep.
- Do likewise for any other accounts on the machine.
- Don't let anyone have physical access to your machine.
- Be very careful downloading any executables online.

If I was that concerned about my privacy (or more aptly, if I had that much reason to be concerned!), I'd set up two new accounts, one non-admin for everyday usage, and one admin for administering the machine. I'd transfer all files (but not apps) from my old account, then delete the old accounts.

 

[Nimiety]

I'm pretty sure that installing the mac version of realvnc is not manipulatable from the sharing pane, but from within the app itself (normally installed under utilities and it's a round green icon of some kind). Opening the app let's you go to its preferences and then to advanced to stop the service. I don't recall the name of the process you'd see in activity monitor.

Of course logging onto the router and seeing if it's port forwarding 5900 would be just as sure a clue (assuming you're being watched while he's outside the home).

Another solution, change your ip address to another valid one inside your segment - if he is in fact remotely connecting to your computer, he'd need to know it's ip.

Good luck!

 

[maccooter]

Router Log

I have learned about router event logs and how to check them on my system. I am wondering how far back the event log goes. I only saw a singular page for the modem. I didn't know how to check websites visited, (wondering if you simply copy and paste the code or url in a browser?) I did, however see a "clear log" option. I am assuming that clears what you can see, but am not sure about previous logs, from say, a month or even a year ago.

Also, I asked a question in another forum, about the product maccleanse. Is it a reliable solution to wiping out all evidences of internet browsing? It is important to know since there is a team at work who rotate machines, and monitoring software will shortly be added to all of them. It is important that no person is falsely accused for distasteful internet traffic for which they are not responsible. If maccleanse is used on all machines, will it give a clean slate for all computers involved regarding internet usage?

Please help with thoughts on that

One more thing... could you guys tell me if it is possible to check the traffic history of laptops by ip address of the laptop?, so that whether they are used at home or office, they can be monitored? If this is the case, it would make quite a lot more sense to monitor by ip address rather than the office purchasing monitoring software. Thoughts anyone? I understand that a modem has an ip address. Do laptops have a different, additional ip address?

 

[DoFoT9]

Please teach me how to check router logs. Is this done on my computer?
Or is it done on the internet account for our dsl service? I would like to check traffic in my house, and see if our wireless network is protected. 2 people in our house are doing online education, and we sometimes lose a signal, thinking the neighbors may be picking up our signal. Please teach me more about router logs and checking them.

checking traffic logs must be suppoerted via your router. you check it by going to a web browser on your computer and typing the IP of your router. it will generally be 192.168.0.1. to check it you can go into System Preference ->networks and your DHCP server is the IP of the router (generally).

Also, I asked a question in another forum, about the product maccleanse. Is it a reliable solution to wiping out all evidences of internet browsing? It is important to know since there is a team at work who rotate machines, and monitoring software will shortly be added to all of them. It is important that no person is falsely accused for distasteful internet traffic for which they are not responsible. If maccleanse is used on all machines, will it give a clean slate for all computer regarding internet usage?

Please help.

im not familiar with this program, so i cant help. sorry. im assuming that its perfectly fine to use and will get the job done.

One more thing... could you guys tell me if it is possible to check the traffic history of laptops by ip address, so that whether they are used at home or office, they can be monitored? If this is the case, it would make quite a lot more sense to monitor by ip address rather than the office purchasing monitoring software. Thoughts anyone?

the router logs will be able to sort by IP address, as that is generally the main method. it may also be able to sort by MAC address - which is less confusing then IP address as IP addresses are dynamic and MAC addresses are not.

 

[macnfab]

I don't have to check history on my teens because they are only allowed access when I am in the room.. call me what you like, but the net can be an ugly place and my babies wont become victim to it.. just my 10 cents.

 

[maccooter]

Teens and Web

I have found a great solution for that issue, since I can't always be monitoring online activities. Naomi is a free download. If a questionable website is encountered, the browser simple shuts down. Naomi shuts down the browser if occult, cult, pornography or other questionable material is encountered. I am the only person who has the password, and while annoying to those browsing, I have the peace of mind that their minds won't be scarred.

The thing I really need help with is monitoring work related machines. These machines rotate among a team, and different people use different work stations. I have found how to check event logs, but don't know how to backtrack them. Monitoring software is soon to be added to machines, and I need to be sure that all past event logs are deleted to start with a clean slate. I also do not know what to do with the event log information. Please teach me if you can, someone, anyone. I have used the product MacCleanse, but am not certain if it wipes event logs from the router.

To you who disagree that I would need to check event logs and call it spying ... it is to defend the reputation of our team. We have removed access for the person who was using the internet for inappropriate type of personal use while at work, but need to show unequivocal proof of integrity regarding internet usage for the rest of the team. This could be hired done, but I would rather learn how to monitor it personally. I do not want a keylogger. Our software cannot be held down by keylogging in working with graphics and production work type of platforms.