Guest User account logged in by itself and switched the camera on

Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
Hi
I'm a bit nervous about what happened this morning with my MBP. First of all I have noticed a noise of the spinning cooler, which was pretty unusual and when I opened a lid I saw to my great surprise the Guest User session open. I have never used the Guest account myself and I'm absolutely sure that no one had physical access to my computer last night. I noticed that the built-in camera green light was on! When I started the resources monitor to find out why the cooler is on - I saw no process actively using CPU apart from the monitor itself. However the cooler was still spinning at a very high speed which I can recognize by the noise it was producing. I have downloaded and run a number of anti-malware and anti-virus apps including Avast, Malwarebytes, KnockKnock; but they didn't find anything. Could someone please shed a light on what could have caused this weird behavior of the MBP or what I could check to get more information about the incident.
Cheers,
 

Raz0rEdge

Well-known member
Staff member
Moderator
Joined
Jul 17, 2009
Messages
15,734
Reaction score
2,059
Points
113
Location
MA
Your Mac's Specs
2022 Mac Studio M1 Max, 2023 M2 MBA
There is no reason to have the Guest account enabled. So go into System Preferences->User Accounts and disable the Guest Account. Ensure that you have a password set for your account and that it is required to login after boot up or wake up.

Once you've made that change, reboot the machine.

If you haven't installed anything recently from any suspicious places, it is unlikely that your machine is affected by any malware and since there are no virus that affect the Mac, you should really remove things like Avast or anything else. Malwarebytes is fine.
 
OP
S
Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
Thanks for the reply. I have already disabled the Guest Account, which by the way might not work under High Sierra as explained in this article:
https://www.techradar.com/how-to/macos-1013-high-sierra-problems-how-to-fix-them

I did not install any suspicious programs recently apart from the latest High Sierra update which I have applied 2 days ago :)
But still the circumstances look troubling to me:
  • spontaneous Guest login
  • camera light is on
  • high spinning speed of the CPU cooler with no apparent reason

I'm just trying to find an innocent reason for all that to make myself confident that my computer was not compromised.

There is no reason to have the Guest account enabled. So go into System Preferences->User Accounts and disable the Guest Account. Ensure that you have a password set for your account and that it is required to login after boot up or wake up.

Once you've made that change, reboot the machine.

If you haven't installed anything recently from any suspicious places, it is unlikely that your machine is affected by any malware and since there are no virus that affect the Mac, you should really remove things like Avast or anything else. Malwarebytes is fine.
 

Raz0rEdge

Well-known member
Staff member
Moderator
Joined
Jul 17, 2009
Messages
15,734
Reaction score
2,059
Points
113
Location
MA
Your Mac's Specs
2022 Mac Studio M1 Max, 2023 M2 MBA
That article suggests that an icon would appear even when the Guest account was disabled. I presume that if one were to click on that icon, it likely wouldn't login since the guest account is disabled, so the "fix" is more of a clean up of the icon to avoid confusion.

The other thing you should ensure you've disabled is any of sharing, especially screen sharing. You will find this in the Sharing section of System Preferences.

The CPU fan is designed to maintain good temps of the CPU and it would be at the higher speeds if the CPU was getting hot. In Activity Monitor that usually equates to one or more processes taking up a close to 100% of the CPU percentage for a sustained duration. The machine should also feel like warm, especially on the bottom toward the hinge.
 
OP
S
Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
The other thing you should ensure you've disabled is any of sharing, especially screen sharing. You will find this in the Sharing section of System Preferences.

I had checked that already - everything was disabled there.

The CPU fan is designed to maintain good temps of the CPU and it would be at the higher speeds if the CPU was getting hot. In Activity Monitor that usually equates to one or more processes taking up a close to 100% of the CPU percentage for a sustained duration. The machine should also feel like warm, especially on the bottom toward the hinge.

That was precisely my worry - the bottom of the computer was warm, the fun was spinning with a high noise but the Activity Monitor shows no processes with a CPU usage above few percents.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
Something woke your computer up and since the lid was closed, that caused it to get warm and that's why the fan increased in RPM. Whatever woke your computer up somehow activated the guest account and turned on your camera. Those things do not happen by themselves.

Make sure you have all sharing turned off and also the option to wake the computer for Network activity is off. And of course, disable the guest account and set passwords like you've been told.
 
OP
S
Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
Thanks, I have done already what you suggested. Hopefully that should make my computer secure.

Something woke your computer up and since the lid was closed, that caused it to get warm and that's why the fan increased in RPM. Whatever woke your computer up somehow activated the guest account and turned on your camera. Those things do not happen by themselves.

Make sure you have all sharing turned off and also the option to wake the computer for Network activity is off. And of course, disable the guest account and set passwords like you've been told.
 
Joined
Jan 1, 2009
Messages
15,446
Reaction score
3,800
Points
113
Location
Winchester, VA
Your Mac's Specs
MBP 16" 2023 (M3 Pro), iPhone 15 Pro, plus ATVs, AWatch, MacMinis (multiple)
You might also check the password on your WiFi network and change it to be a strong password and not the default or easy. That could be the vector for the wakeup and maybe even the guest account login.
 
OP
S
Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
Thanks for the suggestion, in fact I did that already a while ago - my router password has always been long and strong.
By the way are there any logs which could be checked to find out if there was an intrusion to my computer?

You might also check the password on your WiFi network and change it to be a strong password and not the default or easy. That could be the vector for the wakeup and maybe even the guest account login.
 

chscag

Well-known member
Staff member
Admin
Joined
Jan 23, 2008
Messages
65,248
Reaction score
1,833
Points
113
Location
Keller, Texas
Your Mac's Specs
2017 27" iMac, 10.5" iPad Pro, iPhone 8, iPhone 11, iPhone 12 Mini, Numerous iPods, Monterey
I don't think the logs will show that. However, there's a real good program that will tell you that and also much much more. It's called "Little Snitch" but it's no longer a free app. A bit pricey at $45 per single license but well worth it if someone or something is attacking your computer.
 
OP
S
Joined
Nov 14, 2018
Messages
6
Reaction score
0
Points
1
Thanks, I'll give it a try.

I don't think the logs will show that. However, there's a real good program that will tell you that and also much much more. It's called "Little Snitch" but it's no longer a free app. A bit pricey at $45 per single license but well worth it if someone or something is attacking your computer.
 

Shop Amazon


Shop for your Apple, Mac, iPhone and other computer products on Amazon.
We are a participant in the Amazon Services LLC Associates Program, an affiliate program designed to provide a means for us to earn fees by linking to Amazon and affiliated sites.
Top