Apple remote desktop control attempt...

...was made by...

[Syzygy]

Literally, whilst posting a message in Foo just two minutes ago, the above alert - "An Apple remote desktop control attempt was made by xx #*$! xxx [a set of numbers] " came up on screen - but just for a few seconds.

I've never seen this before - what does it mean exactly?

Unfortunately, I tried to grab pen and paper but it disappeared before I could log it...

What does it mean?

Syzygy

[EliteWeb]

Sounds like either you were targetted or that someone was just portscanning your network block for known open ports of services and ARD showed up so they tried to connect. Make sure all passwords on your computer couldn't be gotten past by a 2 year old kid :D

[Syzygy]

Thanks for the (very fast) reassurance - it's actually quite scary to see for the first time!

Net Barrier did not even squeak; however, since going to broadband and in trying to reset it to the Speedtouch 330 usb broadband modem, all I get is:

It was not possible to communicate with the modem port you selected. This modem port has not been securitized.

How can I change this, or is the fact that I'm still (temporarily) connected via usb - instead of ethernet - make any difference to my firewall protection?

Simple explanations wanted...

Syzygy

[EliteWeb]

Never played with USB modems so not sure how it interacts with the port. I would contact Intego and ask them about how it protects USB modems that dont use the Ethernet port or modem port. I believe they are located in Florida.... :P

sidenote: is 'securiti(z/s)ed' a word? Wouldn't it be 'secured' :P

[whoisgregg]

If you ever have something pop up on your screen that you wish to preserve, don't reach for the pen and paper, type this keyboard command to take a screenshot:

Command - Shift - 3

[EliteWeb]

There should also be logs of the connections made so you can refer back to it to see who tried to connect. This will either be in NetBarrier, System Log, or Apple Remote Desktop Logs.

[Syzygy]

sidenote: is 'securiti(z/s)ed' a word? Wouldn't it be 'secured' :P

Yup, that's the word - it's always scared me; especially in my line of work...

Syzygy

[whoisgregg]

If you aren't using Apple remote desktop, it is disabled here:

Apple Menu > System Preferences... > Sharing Preference Pane \
     Uncheck "Apple Remote Desktop"

<snipped>Overstretched my knowledge, nevermind. :(</snipped>

sidenote: I think the correct term is "securitimication" :)

[Syzygy]

type this keyboard command to take a screenshot: Command - Shift - 3

Thanks for that, I've always been using the long way around on the screen grabs!

This will either be in NetBarrier, System Log, or Apple Remote Desktop Logs.

I have the Net barrier log but the data means nothing to me; can I post the resolved data here?

Apple Remote Desktop Logs

Where is that - as I say, this is the first time this situation has occurred and I've never had to even think about looking.

Syzygy

[EliteWeb]

[images.apple.com...] there should also be a client guide. :P But if you have ARD active you should really check it out to ensure its configured properly.

[timster]

Have you tried checking your logs in Console to see if there's a record of the event you can see there?

You mentioned your firewall — that is on, correct?

[Syzygy]

You mentioned your firewall � that is on, correct?

It's straight out of the box... and has been for the last year, ie, unmodified by me. Does that make it on or off?

How do I check - silly question to most I'm sure, but that's my level...

Syzygy

[Goober]

Your firewall should have come with instructions for setting it up. Usually the instructions are preceeded by:

"DON'T DO A DAMN THING UNTIL YOU SET UP YOUR FIREWALL. Shut down your computer, attach the firewall, use the setup wizard, start your computer...etc, etc."

At least that's what mine said. Look for your instructions or go to the manufacturers website for all the details.

It has to be off if you didn't initialize it for your system. Wait, you are surfing, and you had someone trying to capture a port? Off?

Goober

[DerekH]

Syzygy, I'm at a PC now, not a Mac, but the Sharing Preferences enable you to turn on or off access from the outside world, and somewhere near that there's a firewall tab.
Button it down as tight as you can - the MacOsX firewall is pretty good at making your computer invisible to the outside world.
Google "shields up" and run the Port Test there - it's quite an eye opener...

I seem to remember it was you who was considering getting an Ethernet Router/Modem - once you do, this sort of attack is impossible from the outside of the router, because of the way addresses are translated inside the router.
That'll give you hardware protection to go with your software firewall.
DerekH

[timster]

Yes, like they said, best make sure your firewall is up. Although I'm not sure Macs come with the dire warnings that Goober is describing.

Here's the step-by-step:

1. Select "System Preferences" under to the Blue Apple (upper left)
2. Click "Sharing"
3. Click the "Firewall" tab
4. If it does not say "Firewall on" click start
5. Under "Allow" make sure anything you don't use is unchecked.

Simple like that.

[Syzygy]

Yes, thanks all; I mistakenly assumed (and you know what they say about that!) that the firewall was on by default - hadn't even considered it up until now!

Likewise, I thought that NetBarrier was offering protection, although it seems it isn't via the usb modem I recently went broadband with.

Will turn on the firewall when I get home this evening and convert over to the ethernet router/modem at the weekend (must admit I bought one at the weekend just gone and it's still looking pretty in its box at the moment!).

Again, thanks all for comments.

Syzygy