MacBook Hacking: How to know if your Mac has been hacked

Can Macs be hacked?

It’s often said that Macs can’t be hacked but unfortunately, this isn’t true. While Macs may not be compromised as frequently as Windows PCs, there have been various examples of hackers successfully targeting Macs, from fake programs to vulnerability exploits. The truth is that Macs can be hacked, and they are not immune to malware threats.

One of the biggest reasons why Windows PCs are more frequently targeted than MacBooks is market share. As of 2022, Windows had a global market share of 76% in the operating systems for the desktop market, compared to about 15% for macOS. Cybercriminals are mainly motivated by money, which means they usually focus their efforts where there is greatest opportunity for financial gain. This makes Windows users a more lucrative target but does not mean that Mac users are immune from risk.

In recognition of the risk, Apple has made considerable efforts to make it difficult for hackers to gain access to Macs. Security features of the macOS include:

Gatekeeper, which makes sure only software from trusted sources is allowed to run on your Mac. When you try to run or install software from outside the App Store, Gatekeeper will verify it and ask whether you wish to proceed or not.
The Secure Enclave features of the M1and M2 series of chips, and the T1 and T2 chip, such as encryption and secure boot.
Apple’s integrated antivirus XProtect, which aims to detect and block malware from running.

Together, these security features present formidable obstacles for Mac hackers. However, despite these safeguards, sometimes hackers detect security vulnerabilities that can be used to exploit Macs. These vulnerabilities are known as back doors or zero day vulnerabilities. When these are identified by security researchers – or white hat hackers – they usually inform Apple to allow the company to patch the vulnerability before it is exploited.

While Apple is usually quick to respond to vulnerabilities, there have been instances where Apple has been criticized for being slow, allowing attackers to continue exploitation of these vulnerabilities and leaving users unprotected.

How common is it for Macs to be hacked?

Whilst MacBook hacking is relatively rare, there have been documented instances of successful attacks. High profile examples include:

In 2022, Apple users were advised to update their MacBooks (and iPhones and iPads) immediately to guard against two security vulnerabilities that allowed attackers to take complete control of their devices. Apple had received credible reports that hackers were abusing the vulnerabilities to attack users. One of the software weaknesses affected the kernel, which is the deepest layer of the operating system. The other affected WebKit, the underlying technology of the Safari web browser.

In 2021, a student called Ryan Pickren identified a dangerous vulnerability relating to MacBooks which he reported to Apple. The vulnerability enabled hackers to gain control of a Mac user’s camera. Apple fixed the issue in macOS Monterey 12.0.1 and paid the student $100,000 as a reward.

In 2019, a cybersecurity researcher called Filippo Cavallarin identified a Gatekeeper vulnerability to which he alerted Apple. Left unchecked, the vulnerability could have allowed malware to bypass Gatekeeper’s security feature. As the vulnerability was not addressed within 90 days, Cavallarin went public with the details.

2018 saw news reports about the Meltdown and Spectre flaws that exploited vulnerabilities in Intel and ARM processors. Apple confirmed that all Mac systems and iOS devices were affected, although no known exploits affected customers. Apple mitigated the risk by updating its operating system, closing off areas which were exposed.

Types of MacBook hacking

Examples of MacBook hacking include:

Cryptojacking:

This is where someone uses your Mac’s processor and RAM to mine cryptocurrency. This can cause your MacBook to run considerably slower than usual.

Ransomware:

Ransomware denies the user access to programs or files on their device in return for a payment. An example would be KeRanger, where hackers encrypted files on Macs and then demanded money to decipher them. Fortunately, cybersecurity researchers identified KeRanger before it started infecting Macs and became a serious threat.

Spyware:

This involves hackers attempting to gather sensitive data about you, such as your login details. They might use key loggers to record what you type, allowing them to obtain the information they need to login to your accounts. In one example, the OSX/OpinionSpy spyware stole data from infected Macs and sold it on the dark web.

Botnet:

This is when your computer becomes a remotely operated spam machine. For example, the Trojan horse botnet OSX.FlashBack infected over 600,000 Mac computers.

Proof-of-concept:

Sometimes the threat doesn’t manifest itself in the real world but is a proof-of-concept based on a loophole or vulnerability in Apple’s code. For example, Google’s Project Zero team designed a proof-of-concept known as Buggy Cow which was able to gain access to parts of macOS due to a bug in its memory manager. While proof-of-concept is less of a threat, the risk is that it could be exploited by criminals if Apple isn’t quick enough to close the vulnerability.

Port exploits:

Hacks are not always the result of malware which has been downloaded onto the Mac. Macs can be hacked via the USB and the Thunderbolt port – which is why you should always be careful about what you plug into your Mac and avoid leaving it unattended. For example, in the 2019 checkm8 exploit, it could have been possible for Mac hackers to gain access to the T2 chip by plugging in a modified USB-C cable. Similarly, in the case of Thunderspy, an attack method discovered in 2020, a serious vulnerability with the Thunderbolt port could have granted a hacker access to a Mac.

Rootkits:

Rootkits allow the hacker to gain access to a device without being revealed.

A close-up of a MacBook keyboard

How to know if your Mac is hacked

Indications of a hacked MacBook include:

Is your Mac running slowly? If so, it could be a sign of malware or someone using your machine for mining cryptocurrency or launching DDoS attacks.

Is the fan louder than usual? This could also be a sign of malware, which causes systems to run hot and places more strain on the mechanical system.

Have you noticed new toolbars or browser add-ons? If you see random add-ons which you didn’t install, it could indicate that your Mac has been hijacked and is redirecting you to malicious third-party sites.

Are you seeing a greater number of pop-ups than usual? More frequent ads could be a sign of adware. While not too dangerous, this type of malware generates profits from ad clicks.

Has your homepage changed? This could indicate a system hijacking, usually used to lure you to dangerous websites to cause further damage to your operating system.

Are you redirected to different search browsers? This could also be a sign of system hijacking, again used to direct you to dangerous websites where your information could be stolen and further damage caused.

Can you no longer access personal files? This could be the result of a Trojan horse or ransomware. If you receive a ransom or warning note, then you are the victim of ransomware – malicious software used for extortion.

Do your friends receive spam from your accounts? If your contacts report receiving spam messages from you via email or social media, it could mean that your Mac has been infected with malware that tries to spread itself or other malicious programs to users.

Have your passwords stopped working? If you notice that your passwords or security questions have changed, it’s an indication that your Mac could have been hacked.

Is your device freezing or crashing? Malware or viruses can place stress on a computer’s operating system which can cause issues such as freezing or crashing.

Do you receive security alerts without scanning your Mac? If so, this could indicate scareware – a type of malware which pressures you into installing more malware.

Is your webcam behaving oddly? If you notice video or audio files that you did not make on your computer, or if the webcam light is on when you didn’t turn it on, it could be a sign that your webcam has been hacked (see below for more detail).

Can a Mac camera be hacked?

If you are wondering if your Mac camera can be hacked, the answer is yes. A notable example took place in 2020, when a cybersecurity researcher identified a macOS vulnerability which allowed scammers to hack a victim’s webcam if they clicked on a single malicious link. Whilst the vulnerability has since been eliminated, it is possible that cybercriminals could discover equally threatening new ones. Signs that your Mac camera have been hacked include:

The webcam indicator light turns on unexpectedly

If your Mac’s webcam indicator light is on, the webcam is also on. If your camera lights up or flickers on its own, it could be a software or hardware malfunction, but it could also mean that your laptop camera is being hacked.

You notice suspicious videos and pictures in the webcam folder

If you discover videos you haven’t recorded or pictures you haven’t taken, it could indicate that your webcam has been hacked. The most likely location for suspicious media files is the Photo Booth Library. This is how to check it:

In the Finder menu, select “Go” and click “Go to Folder”
Enter the following path and click “Go”: ~/Pictures/Photo Booth Library/Pictures
Click the “Photos Library” folder
Click the “Photos Library” folder and look for any photos or videos you don’t recognize

However, cybercriminals can store pictures and videos in random folders on your Mac. Therefore, if you don’t find suspicious media materials in the Photos Library folder, it does not necessarily mean your device is safe from hackers.

Sudden spikes in network traffic

If your network traffic randomly increases, it could mean that somebody is transmitting your web camera’s feed over the internet. To check your network traffic:

In the Applications folder, click “Utilities”
Launch Activity Monitor and click the “Network” tab
Look for activities with suspiciously high network usage

You receive an extortion note

After hacking your Mac’s camera, cybercriminals might email you an extortion note or leave one on your device. Usually, they demand a payment in exchange for not exposing recorded photos and videos. Before paying the ransom, ask yourself: ‘Is my camera really hacked?’ Pause for a moment before responding or transferring any money. Cybercriminals often trick people into believing they have been spied on even without hacking their camera.

Can your iCloud be hacked?

As an Apple user, you probably use iCloud to back up your important files. Like most Apple products, iCloud is considered very secure but this does not mean that individual accounts are immune from hacking. Ultimately, all anyone has to do to gain access to your iCloud is figure out your password. Some of the ways hackers might do this include:

Phishing attacks – for example, creating phishing websites that resemble iCloud.com to trick users into disclosing their details so the hackers can use them.

Malicious apps – Apple takes malware very seriously and does a good job of safeguarding the App Store. But as with Google’s Play Store, malware-infected apps do occasionally get through and can be used to steal your password.

Compromised computers – If you use your iCloud account on non-Apple devices, you could expose yourself to risk. Whilst malware is relatively rare on Apple devices, it is more common on devices which run Windows.

Keyloggers and Remote Access Trojans – These can both be used to steal your iCloud password when you log on.

Unencrypted public Wi-Fi hotspots – Connecting to an unencrypted public Wi-Fi carries potential risks for your iCloud account. One risk is man-in-the-middle attacks, where hackers intercept your password after you enter it on your device but before it reaches your iCloud account. Another risk is session hijacking, where the cookie used to keep you logged into your iCloud account is stolen. Hackers can then use this cookie to log into your account on another device.

Using the same login details for multiple accounts - All it takes is for one of those sites to be involved in a data breach and the credentials you use for your iCloud account is out there permanently. Hackers can also use software programs to make repeated attempts at cracking both iCloud passwords and security questions.

How to tell if your iCloud has been hacked

Depending on the goal of the hack, somebody could gain access to your iCloud account without you knowing. However, there are signs to look out for including:

You receive an email from Apple telling you that somebody logged into your account using an unknown device, or that your password has been changed.
Your password no longer works.
Your account details have been changed.
You find that purchases have been made on iTunes or the App Store that you don’t recognize.
Your Apple device is locked, or it has been placed in Lost Mode.

If you are worried that your iCloud may have been hacked, you should:

Try to sign into your iCloud account. If this isn’t possible, try to reset your password or unlock your account using security questions.
If you manage to sign in, change your password immediately. It’s important to choose a strong password.
If you have a credit card linked to your iCloud account, block it as soon as possible to prevent cybercriminals from incurring additional charges.
Check the information associated with your account. Update anything that may have been changed. Review your security questions to make sure they aren’t easily guessed.
If your iCloud account has been hacked, the problem could have originated with the associated email address. Check that email account to see if it has been compromised and change the password if necessary.
If you don’t already use 2 Factor Authentication (2FA), set it up now.

Given the number of users that iCloud has, it’s not surprising that it’s a target for hackers. Wherever people store valuable information, hackers will want to steal that information for financial gain.

How to protect your Mac from hackers

To reduce the risk of a hacked MacBook, here are some tips to follow:

Connect your Mac to a router instead of a broadband modem

Connecting your Mac directly to a broadband modem means your computer receives a public IP address from the modem. This leaves it vulnerable to random scanning via the internet. Connecting it to a router is a safer option because a router uses network address translation to assign an IP address to your Mac that can only be reached from within your home network.

Use encryption to prevent hackers from breaking into your wireless network

Encryption disguises your wireless transmissions as junk data, and it can only be returned to its original form with the ASCII key you select. WPA2 encryption requires a significant amount of time, effort and computing power to find your encryption key.

Set your Mac to download system updates automatically

To do this:

Click the Apple logo in the upper-left corner of the screen and select "System Preferences".
In the "System Preferences" window, click the App Store panel.
Check the "Automatically Check for Updates" and “Download Newly Available Updates in the Background” boxes.
Check the “Install OS X Updates” to set updates to install automatically. This will ensure that your computer receives security updates as soon as they are released.

Enable your Mac's built-in software firewall

Open the "System Preferences" menu and click the "Security & Privacy" icon under the "Personal" heading. Select the "Firewall" tab at the top of the window and click the "Start" button to enable the firewall. Click the "Advanced" button to select the programs and services you want to allow through the firewall.

Use a limited user account, rather than an administrator account

This will stop software from installing itself on your computer automatically without your permission, because it requires you to use the administrator password manually when you want to install software.

Practice cyber hygiene when using your Mac

For example, avoid clicking links in email messages and read trusted reviews before downloading unfamiliar software. When visiting a website that requires sensitive account details, always type the URL directly into your browser or use a browser bookmark. Look for secure indicators like an SSL certificate, i.e. the URL should state HTTPS, not HTTP.

Use a good quality antivirus

A robust and up-to-date antivirus for Macs will protect your browsing, payments, chats and data with security that ensures optimal Mac performance. It will also check each website you visit to prevent you from falling victim to cyber threats such as phishing attacks.

Related products: