coldcore wrote:
No not running any of those things. Since I'm a relatively new apple user. I don't understand "key chains" but wondering why in logs "login_renamed_2.keychain-db"is present?
Jonathan Levin (Moxii)'s OS X Internals three-volume book will get you a foundation in internals and how the pieces can fit together in normal usage. And will help you collect info on what "normal" looks like in your particular environment.
Or you can use an approach others have attempted, and try to find needles in infinitely-growing streams of haystacks, when you don't know what the needles look like, or even whether any needles are even present. That's the usual for scanning logs and telemetry. Doable certainly, but works way better when automated tools can scan for known patterns.
Keychains are part of macOS, and accessed via Keychain Access: What is Keychain Access on Mac? - Apple Support
And this PegasusConfiguration, what is that? I read it's spyware.
Something to ponder: why would the some of the most expensive espionage tooling around post its own name somewhere obvious? And if the tooling was that overt about its traces, why wouldn't Apple have detected and flagged or detected and scrubbed it?
Oh, and in this particular case, it's not Pegasus the espionage tool. Pegasus is what Apple called their picture-in-picture support. Utterly mundane stuff, in other words. Or, well, could Pegasus be hiding behind something else also called Pegasus? Or some other exploit tooling that works like Pegasus pretending to be Pegasus hiding behind benign tooling known as Pegasus? We don't know. This tooling changes.
And remote connections are still present on my computer, how do I shut down remote connections in terminal?
Remote connections are ALWAYS present. That's simply the nature of computing in 2024.
Detecting command and control connections for malware or worse can itself be non-trivial, as the malware and the nasty stuff are all using the same connections and the same server hosting vendors and the same network protocols as everything else. You might spot something here, or you might not.
And I'd probably implement network monitoring on your gateway or other external hardware, as exploit tooling can itself target standard and added monitoring tooling. If you're worthwhile target, the tools you use can themselves be compromised.
Sure, you might get lucky and find a command and control connection. But you're probably going to want to start with an understanding of what is normal for your particular and unique combination of installed apps and tools and settings.
And "ZoomClient3rd", tried to delete it, it won't delete, says it's currently in use.
Follow the vendor's directions for deleting the Zoom app.
Thank you for your time and care in this matter.
macOS can be exploited, and can be breached.
If you believe you are a potential target for espionage tooling, you need to fundamentally shift your approach to tooling and use of tools, as well as what data you have around, and what connections and communications channels you use. There are steps specific to macOS, but the bulk of what is involved here is changing how you use and how you expect to use your devices.
Why change? Folks actually targeted by Pegasus can end up in prison. Or worse.
If you are senior in government or private, or with access to sensitive or classified data, participating in a war, a political dissident, an investigative journalist, or somebody that has deeply peeved a very rich entity, you may be headed for a Bad Day. Accordingly, you will want to seek advice with your security, and particularly advice well past investigating PegasusConnection, Keychains, or related. In some contexts, emissions and uploaded photos are more than enough trouble.
Some info from Apple directly: About Apple threat notifications and protecting against mercenary spyware - Apple Support
What one of the better resources suggests: https://citizenlab.ca/category/research/tools-resources/security-planner/
