The word virus gets thrown around a lot but...

[r.j.s]

At this point you may want to get the authorities involved along with the owners of Facebook and Hotmail to see if they can aid in this. I doubt the Mac is the weak link here since you've wiped it. The network is likely the weak link, but I'm not sure how to advise troubleshooting over a forum.

I agree with this, this is something serious that is targetting him directly.

 

[ViViDboarder]

So to continue the story, I went round Saturday, wiped his computer and reinstalled everything from scratch. We created brand new accounts for everything with brand new and much stronger passwords. I cranked up the firewall to max, turned off his airport card.

Everything seemed ok then on Sunday I got a call saying he received an email (to his new address he had not even told anyone about yet), from his old email account saying 'Ha!'.

What the hell is going on? 😕

I think because of the new passwords and stuff they can no longer mess with his accounts, but to get his new email address without him telling anyone about it is freaky!

Oh and his Facebook page has completely vanished! 😡

I would go to the police and claim that it's Cyber stalking.

If they had access to your friends facebook and they are continually making contact with them over the internet it's definitely malicous. Also, the email comanpies as well as facebook keep records of the people that access and their IP addresses. These can be used by authorities to find the person who is harrassing you.

I have had to log an IP of someone harassing me online before, but I wasn't hacked and I never decided to press any charges. I just wanted to scare the person away to get them to stop bothering me.

Definitely contact the websites though. They can help you find out who it is. Mention that your friend is being harassed and you want to take this case to the police and you would like to know if they would co-operate. I'd do it by phone and not email though 😀

 

[TumbleDryer]

Thanks guys. If it continues I will put it to him about reporting it. I now have a feeling he's not telling me everything about his girlfriend and I think she may know a few more things than she says with regards to computers. It is really the only logical reason for all this.

 

[Airforcekid]

Facebook and gmail are not kept on the mac it is possible for someone to hack there servers or possibly your internet providers if everything on your mac is ok and you do not torrent programs its not on your end. Also run permissions and disk repair.

 

[Airforcekid]

Thanks guys. If it continues I will put it to him about reporting it. I now have a feeling he's not telling me everything about his girlfriend and I think she may know a few more things than she says with regards to computers. It is really the only logical reason for all this.

Inside hack would make the most sense.

 

[H&B]

Similar Thing Happened To My Gurlfriend

We think a similar thing happened to my girlfriend about 6 months ago - she

thinks she opened up an online greeting card or video with a keylogger in it

... but i was thinking, from what i know about Mac OS, any invite greeting

card or video requires administration password permission to activate a

keylogger or the such?

...unfortunately she cannot remember if her OS asked her permission/password.


Is that possible for a hacker to deploy a keylogger through such means ?

From what some of my more Mac user-friendly acquaintances tell me is that

it's not likely possible for someone to send a binded keylogger parcel

through gmail targeting a Mac user computer OS. similar to Windows hack

methods.

May anyone clarify this ?

 

[mac2x]

Thanks guys. If it continues I will put it to him about reporting it. I now have a feeling he's not telling me everything about his girlfriend and I think she may know a few more things than she says with regards to computers. It is really the only logical reason for all this.

That's probably a highly astute guess. Women can be really nasty... 😱

I'd still get the website people and possibly the authorities involved, though. This is serious.

 

[fireshot91]

So, OP, it's been a few days. Any news? I'm kinda intrigued as to how this is happening.

 

[Infrared]

We think a similar thing happened to my girlfriend about 6 months ago - she
thinks she opened up an online greeting card or video with a keylogger in it
... but i was thinking, from what i know about Mac OS, any invite greeting
card or video requires administration password permission to activate a
keylogger or the such?

No, keyloggers can work without admin privileges. It's a
common misconception that all malware needs elevated
privileges, but that's not the case.

 

[H&B]

Really like which ones ? How can she protect her Mac from now on ?

 

[mac2x]

No, keyloggers can work without admin privileges. It's a
common misconception that all malware needs elevated
privileges, but that's not the case.

I agree; the malware would be able to write to any folder the user owns and therefore doesn't use a password to access.

 

[mac2x]

Really like which ones ? How can she protect her Mac from now on ?

Get new accounts, new strong passwords. Don't open unfamiliar stuff, or give an application she's never heard of an admin password. Maybe even a clean install of the system; I mean really start over from scratch if you think there's a keylogger somewhere in her files.

 

[bobr1952]

I would have to put my weight to those who have offered the suggestion that he used an easily cracked password on multiple sites--usually the easiest way to totally mess multiple online activities. I use unique, random generated passwords everywhere--a little harder to manage but it is really to only way to prevent cracked accounts.

 

[H&B]

I agree; the malware would be able to write to any folder the user owns and therefore doesn't use a password to access.

I hear you but it still doesn't make sense ? even if like you say malware is accepted without admin permission ... isn't there a built-in system protection against that in mac os x .. specifically regarding passwords behind asterisks * * * * * * ?

good friend of mine did research for us and says he's never heard of anything that can capture log passwords behind asterisks * * * * * so were puzzled?

he refered to such software out there like' Perfect Keylogger for Apple Mac'

'Aobo Mac Keylogger' 'Spector Pro' etc. claim they cannot capture the passwords either ... kinda confuzzling if you ask me.

 

[hugodrax]

He should download and run Malwarebytes.

 

[cjmillsnun]

Silly thought. I know he uses a wired internet connection, but is the router a wireless router?

It may be that he has an unsecured wireless connection right into his LAN.

 

[sushi]

Silly thought. I know he uses a wired internet connection, but is the router a wireless router?

It may be that he has an unsecured wireless connection right into his LAN.

After reading this thread, you took the words out of my mouth.

OP, definitely check the router for two things:

- One having open WiFi access.

- Two having a stray LAN cable.

Another thing that pops into my mind. Ask your friend to move his computer. It is possible someone is observing his computer remotely.

When you created new accounts, did you use similar e-mail names and/or account First/Last names or other identifying information?

Please update us on what you find out.

 

[mac2x]

I hear you but it still doesn't make sense ? even if like you say malware is accepted without admin permission ... isn't there a built-in system protection against that in mac os x .. specifically regarding passwords behind asterisks * * * * * * ?

good friend of mine did research for us and says he's never heard of anything that can capture log passwords behind asterisks * * * * * so were puzzled?

he refered to such software out there like' Perfect Keylogger for Apple Mac'

'Aobo Mac Keylogger' 'Spector Pro' etc. claim they cannot capture the passwords either ... kinda confuzzling if you ask me.

May be, I don't know. I'm just guessing that it might be possible for malware to write to folders the user owns. It definitely won't be able to write in system folders w/o a password.

I am clueless as to the finer points of keyloggers, so I defer to others on that front. 😉

 

[sushi]

good friend of mine did research for us and says he's never heard of anything that can capture log passwords behind asterisks * * * * * so were puzzled?

First rule of computers, is be careful who you listen to. If possible ask an expert or other knowledgeable person.

'Aobo Mac Keylogger' 'Spector Pro' etc. claim they cannot capture the passwords either ... kinda confuzzling if you ask me.

Huh???

Go to Aobo Mac Keylogger for Mac OS X

It says:

Aobo Mac OS X Keylogger for Mac – Powerful invisible Apple Mac keylogger with Password Recording, email and FTP support! The only Keylogger for Mac OS X which can Record Passwords.

Stealth and undetectable monitoring and recording
Record Passwords (Professional Edition only)
Keystroke logging in any application, Website recording
Screenshot & capturing in the interval you set
Email logging, receive logs by Email
Ftp support, option to upload logs to FTP
No need admin password to install(Standard Edition only)

Looks like the pro version can record passwords. YMMV.

 

[TumbleDryer]

So, OP, it's been a few days. Any news? I'm kinda intrigued as to how this is happening.

Today I have news! We know what the problem was/is and I have posted a subsequent post regarding how to solve a hacked AppleIDs purchased apps not syncing to a new AppleID.

Basically as I thought was the case, but I had to be careful what I said to my cousin because it was a delicate situation, it was his girlfriend that had messed everything up. Obviously he was unaware it was her because she did it all on the sly.

Its all quite a messy situation at the moment but at least we know what it was.

I was confused as everything was secure, firewall, network everything but somehow she was managing to change stuff. She was seen outside the house for quite a while at one point so I'm guessing she was getting onto his wireless modem and accessing stuff from there.

Anyhoo... I now have a new problem regarding all this, see here.

 

[sushi]

Today I have news! We know what the problem was ... it was his girlfriend that had messed everything up. Obviously he was unaware it was her because she did it all on the sly.

Would you explain in generic form what she was doing.

Note, I don't expect specifics on an open forum. Just a general idea if you feel that you can. TIA.

 

[TumbleDryer]

Would you explain in generic form what she was doing.

Note, I don't expect specifics on an open forum. Just a general idea if you feel that you can. TIA.

Well there are two possibilities that I can think of. She either made a note of all his accounts and passwords and signed in elsewhere and changed all the details. As she had his email passwords etc any attempt to get passwords etc back would also be emailed to her as well as us so our attempts were futile until we set up a new email account. The weird part of this is we did set up a brand new email account (without telling anyone) and she sent an email from the old account to this new one, and for the life of me I cannot figure out how.

The other possibility is she was actually on the wireless network at some point and then accessed his mac which was wired to the modem. I dont want to say too much but from what I've been told it has all turned quite serious and the latter would not surprise me in the least. Just not entirely sure how apart from VNC and screen sharing.

 

[Consultant]

1. Possibilities:
- weak password
- weak password questions
- same password for all accounts
- falls for a fake site
- gave account admin to culprit

2. Unlikely. You think a hacker would waste their time on a kid instead of making some money or some news worthy story?

3. No virus. Yes there are trojans.


Solutions:
Change wifi password, change wifi encryption to WPA2.
Change mac admin password, he probably gave it to his ex-girlfriend.
I would go to the police if you know who did it.

 

[sOwL]

1) Keyloggers: Are you sure that none had any physical access to his computer?

2) Phisers: Is your friend sure that he never got into any phising web page and entered his password there? Also, please check the hosts file, because someone could have edited it to re-direct let's say facebook.com to some phising page that looks just the same.

3) Network (most likely): If your friend's network is wireless and not protected, you can't imagine how easy it is for someone to get such information (granted he knows what he's doing). Having an unprotected wireless network means that someone can connect to it, then sniff the data that are transmitted in it, and because its not protected, those data are not encrypted.

 

[mac2x]

Today I have news! We know what the problem was/is and I have posted a subsequent post regarding how to solve a hacked AppleIDs purchased apps not syncing to a new AppleID.

Basically as I thought was the case, but I had to be careful what I said to my cousin because it was a delicate situation, it was his girlfriend that had messed everything up. Obviously he was unaware it was her because she did it all on the sly.

Its all quite a messy situation at the moment but at least we know what it was.

I was confused as everything was secure, firewall, network everything but somehow she was managing to change stuff. She was seen outside the house for quite a while at one point so I'm guessing she was getting onto his wireless modem and accessing stuff from there.

Anyhoo... I now have a new problem regarding all this, see here.

I had that suspicion myself. 🙄 Case in point of why you shouldn't let people have your passwords, and why you should secure that wireless to the hilt.