Forum Moderators: travelin cat

Message Too Old, No Replies

strange code in my mac terminal

what is this? I think I'm being hacked

         

lelales

7:49 pm on Jul 1, 2019 (gmt 0)

5+ Year Member



I started my Mac this morning and the terminal window opened, then I saw this code::
-bash: /Users/seanc/.bash_profile: Permission denied
ip72-211-104-***:~ seanc$ /System/Library/Automator/Get\ Image\ URLs\ from\ Webpage.action/Contents/MacOS/Get\ Image\ URLs\ from\ Webpage ; exit;
-bash: /System/Library/Automator/Get Image URLs from Webpage.action/Contents/MacOS/Get Image URLs from Webpage: cannot execute binary file
logout
Saving session...
...copying shared history...
...saving history...truncating history files...
...completed.

[Process completed]



I'm not sure what's up? It looks like someone is grabbing my images and history and writing to a file or something. Should I be concerned? Can someone explain this to me?

Thanks so much!

lelales

8:02 pm on Jul 1, 2019 (gmt 0)

5+ Year Member



I didn't write the above code & I don't know where it came from.

travelin cat

10:35 pm on Jul 1, 2019 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



Were you using Automator to try and pull down images from web pages?

FYI: [support.apple.com...]

lelales

10:44 pm on Jul 1, 2019 (gmt 0)

5+ Year Member



I think it was for my Timespace backup. I did some work researching and it's probably not a big deal. I was going to to delete the message, but maybe other's will see this as helpful, or have the same/similar issue.

I don't use Automator. I don't do much on the command line.

lelales

5:14 pm on Jul 3, 2019 (gmt 0)

5+ Year Member



well I removed my back up drive and turned time machine off, but the above code appeared again today July 3rd with today's date. Does anyone know if my terminal was hacked and someone is hijacking or spying on me?

not2easy

6:20 pm on Jul 3, 2019 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



If your computer's user account is Seanc, it appears to be some task that you initiated. If you use messaging or sharing apps they might show lines such as you have quoted. If seanc is not your user account then I would suspect an app has more permissions that it needs. I would take a look at any apps you might use and check the permissions settings on your Mac under 'Security and Privacy' or 'Notifications'.

lelales

6:32 pm on Jul 3, 2019 (gmt 0)

5+ Year Member



well I truncated the username, but why would an app be downloading or copying my website images? This just started happening and I only recently installed "instagram repost" on my Iphone.

This seems troublesome. How do I remove the Automater code from the terminal?

not2easy

6:54 pm on Jul 3, 2019 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



I would ask the developer(s) of the instagram repost app to address your question. Or uninstall it and look for a better app. But that's me.

lelales

9:44 pm on Jul 3, 2019 (gmt 0)

5+ Year Member



thanks. It's a phone app, but everytime I restart my computer I get the code above in my terminal. Maybe I "agreed" to something I shouldn't have?

thanks again

not2easy

11:31 pm on Jul 3, 2019 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



In that case I would look at the iPhone settings for 'sync'. It may be set to synchronize with your Mac.