Security breach or back door in File Sharing?

Hi guys,

My 1st time posting here. Just got my 1st mac Mac Mini Server 2012 last December. Mac OSX Lion seems OK when compared with Windows 7.

But today I noticed something fishy in File Sharing. If I go from 'Apple Icon'(top left menu item) --> System Preferences --> Sharing, then
choose 'File Sharing', click the Option button (available from attached image),

now this is when things got a bit fishy, I can see 2 other accounts that have no name beside my Sam account

And I have no way to remove those account since they don't exit and if I deselect the invisible account checkbox, it asked me for a password I have no idea of. See attached image.

Mac OSX Lion backdoor or virus to monitor user? Lucky me ahaha...

Seriously, has anyone see this before and know how I can remove it? It's making me kind of want to go back to win7.


Thanks

Sam

Do these accounts show up in System Preferences > Users & Groups? If yes, you'll be able to remove them there.

No, these accounts do not show up in System Preferences > Users & Groups. That's the scary part.

Just a guess: Either this is a genuine bug or a GENUINE backdoor apple left for law enforcement officers to catch whatever ;D. Too bad I don't have anything controversial on my HD ahahaha

Either way, THANKS Apple. I will use Boot Camp to run Windows 7 now.

I think you are cutting corners mate and jumping to conclusions without understanding the subject.
My suggestion is to search a bit more and read up on the " server " version of OS X.

Cheers ... McBie

Sam777 said:

No, these accounts do not show up in System Preferences > Users & Groups. That's the scary part.

Just a guess: Either this is a genuine bug or a GENUINE backdoor apple left for law enforcement officers to catch whatever ;D. Too bad I don't have anything controversial on my HD ahahaha

Either way, THANKS Apple. I will use Boot Camp to run Windows 7 now.

Click to expand...

Uh, yeah. Apple and they feds are out to get YOU. The rest of us, having never seen anything like that, must have been cleared without wiretapping measures.

*rollseyes*

We can probably help you figure this out. I haven't dealt with file sharing scenarios in a long time, so I'll muddle my way through this. First off… what's BEHIND that window in the master Sharing preference pane, in the list of shared folders? What happens if you disable SMB sharing? Reboot after doing so, then recheck that list. Are there other Windows computers on your network? If so, turn them off and see if, by chance, those are Windows user accounts logged into your Mac. Or just take the Mac off the network (unplug the network cable and turn the Wi-Fi off). I'm winging it here, so a couple ideas I have may be way off the mark. Only one computer in my home these days so I can't double check myself.

Thanks for the suggestions. There is nothing behind Preference Pane, just a desktop image and browser in lower right corner.

I tried disable SMB sharing, turn WIFI off, delete all shared folders, then reboot, PROBLEM solved... just kidding, same problem. Will try to uninstall some rubbish mac osx app I installed next ...

Also installed Onyx yesterday, did some maintenance and cleaning run, didn't seem to help. I wonder if this is sign of some Mac OSX virus ...

Sam777 said:

Thanks for the suggestions. There is nothing behind Preference Pane, just a desktop image and browser in lower right corner.

Click to expand...

Not behind the Preference Pane… behind the advanced options popup.

I tried disable SMB sharing, turn WIFI off, delete all shared folders, then reboot, PROBLEM solved... just kidding, same problem. Will try to uninstall some rubbish mac osx app I installed next ...

Click to expand...

What rubbish would that be?

Also installed Onyx yesterday, did some maintenance and cleaning run, didn't seem to help. I wonder if this is sign of some Mac OSX virus ...

Click to expand...

Highly unlikely. To be pedantic, there are no viruses for OS X and only a handful of trojans. And for a trojan to be installed, it would have explicitly required your authorization with an admin name/password, and surely you haven't blank authorized just any old pop-up, surely…

As a troubleshooting step, create a new user, log out of the current and into that one. Does the problem continue?

Run from OSX and install Windows 7? I have friends with Windows 7 who's systems are compromised weekly. Makes me $$$ fixing them but still, I sure don't want my computer doing that on me. Ditching OSX is not the answer.

Lifeisabeach has told you a few things to do and he is right, you do have a SERVER with a SERVER OS.

Also what RUBBISH apps did you install? Tell us as that might be the key to helping you. Did you install any Pirated versions of OSX applications or any Video codecs from Porn sites? Not trying to trap you, but trying to help.

Thanks for the suggestion. The rubbish app are those utilities like PlayOnMac, WineBottlerCombo, Tunnelblick, Viscosity, .... They may not be truely rubbish, so don't take my word for it, but to be safe, I will simply uninstall them. And no, I dont have pirated version of OSX app or codec

As a troubleshooting step, create a new user, log out of the current and into that one. Does the problem continue?

Click to expand...

Yes the problem continued.

I have tried to create a new user, assign admin right to it, and was able to deselect the On checkbox of that user by providing the right password in the screen shot page, then delete that test user account, everything works as expected except for the 2 outstanding mystery accounts. In my 'Users & Group' window, I only have 1 admin user account left, 2 mystery accounts still stayed.

I have decided to park this problem for now by: disable 'File Share' and 'Remote Connection to my PC', change password, also enable firewall and move on.

Thanks

Are you running BOINC on your OSX Server ?

Cheers ... McBie

Was running Boinc. But uninstalled it before the problem.

It only makes Mac Mini super hot and make u feel like achieving something but ... pointless

Are you using the server version of Lion? Are you even using it as a server? If the answer is yes, then no, then why not just install the regular desktop version of Lion and call it a day?