How to Tell If Your Mac Computer Has Been Hacked
- 1). Log in to your Mac OS computer using your regular user account.
- 2). Click "Applications" and then "Utilities."
- 3). Double-click on "Terminal." A new window will open, with a prompt for text-mode commands.
- 4). Type the following command into the Terminal window:
sudo -l
Press "Enter," type your password and press "Enter" again. - 5). List all accounts existing on your Mac by typing the following command into the Terminal:
dscl . list /users
Press "Enter." Mac OS X will list all existing accounts on the computer. - 6). Check whether any account has been created without your permission by verifying that all accounts in the output of "dscl" have been created legitimately. If there are additional accounts, they probably have been created by a hacker.
- 7). Check whether an account has been misused by typing the following command into the Terminal:
last
Press "Enter." For each account, Mac OS X will list the time and date of the last login to all existing accounts. If the most recent login to any of the accounts happened at an abnormal time, it probably was done by a hacker masquerading as a legitimate user.
