We Value Your Privacy

We and our partners use technology such as cookies on our site to personalise content and ads, provide social media features, and analyse our traffic. Click below to consent to the use of this technology across the web. You can change your mind and change your consent choices at anytime by returning to this site.

Update Consent
Loading ...

How to determine if my mac computer has been hacked

Updated April 17, 2017

A hacker can gain unauthorised access to your computer's resources using a variety of tricks. For example, he might guess or use brute force techniques to discover a legitimate user's password. Hackers may also exploit bugs or other security vulnerabilities in some software applications. Regardless of the method used to gain entry, a hacker needs to use an account on the computer. You can determine if your Mac has been hacked by looking for computer accounts that you have not created and by checking to see if any of the legitimate accounts have been accessed in an improper manner.

Loading ...
  1. Log in to your Mac OS computer using your regular user account.

  2. Click "Applications" and then "Utilities."

  3. Double-click on "Terminal." A new window will open and a prompt for text-mode commands will be displayed.

  4. Type the following command into the Terminal window:

  5. sudo -l

  6. Press "Enter." Type your password and press "Enter" again.

  7. List all accounts that exist on your Mac by typing the following command into the Terminal window:

  8. dscl . list /users

  9. Press "Enter." Mac OS X will list all existing accounts on the computer.

  10. Discover whether an account has been created without your permission by inspecting and verifying that all accounts in the output from the above step are legitimate user accounts that you created. If you see any additional accounts, it's likely they were created by a hacker.

  11. Check if an account has been misused by typing the following command into the Terminal window:

  12. last

  13. Press "Enter." The time and date of the last login to all each existing account will be displayed. If a recent login to any of the accounts occurred at an abnormal time, it probably was done by a hacker masquerading as a legitimate user.

Loading ...

About the Author

Jonah Quant has been writing about computer science since 1990. He has contributed to international conferences and journals such as those of the Institute of Electrical and Electronics Engineers and the Association for Computing Machinery. Quant has a Ph.D. in computer science from the University of California.

Loading ...