{"id":37631,"date":"2022-09-22T12:06:39","date_gmt":"2022-09-22T11:06:39","guid":{"rendered":"https:\/\/www.n-able.com\/?p=37631"},"modified":"2022-09-22T12:06:39","modified_gmt":"2022-09-22T11:06:39","slug":"is-your-mac-spying-on-you-maybe-it-should-be","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be","title":{"rendered":"Is Your Mac Spying On You? Maybe It Should be"},"content":{"rendered":"

What would you call software installed on your Mac, that\u2019s hidden from sight, difficult to remove, and that silently monitors everything that happens on the system? You might call it spyware, or a RAT (Remote Access Trojan), and start thinking about how best to get rid of it.<\/span><\/p>\n

However, that same description can also be applied to the software that\u2019s used to keep your machine safe from such threats. Security solutions<\/span><\/a> like EDR (Endpoint Detection and Response)<\/span><\/a> and DLP (Data Loss Prevention) are also designed to quietly keep tabs on the data coming and going on your devices, and report back if they find anything that looks suspicious.<\/span><\/p>\n

The main, obvious difference between the forces of Good and the forces of Evil are who<\/i> they report back to. That, and the fact that the baddies usually don\u2019t display their logo as an icon in your menu bar.<\/span><\/p>\n

Persistence and Perseverance<\/span><\/h2>\n

Something else that both legitimate and malicious software have in common is persistence. When your job is to secure and protect a customer\u2019s computer, the last thing you want is that same customer removing the tools you\u2019ve installed. Sometimes, it will be an innocent mistake\u2014they didn\u2019t know what that application was doing there, so it didn\u2019t seem like a problem if they uninstalled it. Other times, the user will know exactly what they\u2019re doing, and just want to circumvent some inconvenience imposed by annoying little things like company security policies.\u00a0<\/span><\/span><\/p>\n

Then there are (mostly) older applications whose impact on system performance is arguably worse for productivity than an actual malware infection. Thankfully, there are options these days that offer both improved detection rate and lower impact on system performance. They are also better at resisting the efforts of the frustrated editor who just wants his videos to render a few percent faster, and will happily risk inviting ransomware and\/or the wrath of IT to do it.<\/span><\/p>\n

In order to prevent either accidental or intentional removal, both sides of the security conflict employ a variety of methods to cement their foothold on the Mac. Apple actively enables many of these schemes, either as a result of their own efforts to prevent tampering, or through features built with convenience in mind\u2014either for the user or for software developers.<\/span>\u00a0<\/span><\/p>\n

In macOS versions prior to 11 (Big Sur), it was relatively easy to install kernel extensions, or kexts, that would run with the same privilege level as the operating system itself. Once installed, not only would these extensions have the run of the place, but they required more than casual effort for a user to remove. Even if you quit an app that leveraged a kext, the extension would remain, along with all of its vulnerabilities or instabilities. Since then, kexts have mostly been sidelined for the more secure system extensions<\/i>. [ https:\/\/support.apple.com\/en-us\/HT210999<\/span><\/a> ]<\/span><\/p>\n

In more recent releases of macOS, it takes special effort to install a kext, or \u201clegacy system extension,\u201d including some daunting warning messages to click through and explicitly setting the system to boot in a reduced security mode.<\/span><\/p>\n

Daemons in the Details<\/span><\/h2>\n

In the Windows world, there are Startup Services\u2014background tasks that automatically run when the computer boots, or once a user logs in. On the Mac, we have Launch Agents and Launch Daemons. Never mind the archaic spelling and diabolical connotations, as with many strange things underpinning macOS, it comes from UNIX: [ https:\/\/en.wikipedia.org\/wiki\/Daemon_(computing)<\/span><\/a> ]. Daemons are services that run in the background without user interaction, and launch before the user logs into the system. Launch Agents run once the user has logged in, typically at log-in, but can fire up periodically on a set schedule or as a reaction to various state changes.<\/span><\/p>\n

As part of a persistent installation, software might install a daemon configured to launch at system startup, that can check online for updates, detect modification or removal of its components, and automatically reinstall itself. Plenty of legitimate applications do this to ensure that they are always up-to-date, but it shouldn\u2019t be much of a leap to see how the same mechanisms could make for particularly nasty malware.<\/span><\/p>\n

There are several other places in macOS where applications can be triggered to launch automatically, and silently, but they are generally under the user\u2019s control. For example, adding something to your Login Items will mean it persists each time you log in, but you don\u2019t need any special authorization to remove it.<\/span><\/p>\n

It takes time and the knowledge of where to look to search all the various places where programs can hide themselves away. Luckily, there are also tools which can make that process much simpler. The weapon of choice in this regard is Knock Knock<\/a>, by Patrick Wardle.<\/b><\/span>\u00a0<\/span><\/p>\n

Are You a Good Witch? Or a Bad Witch?<\/span><\/h2>\n

We\u2019ve written before about the Transparency, Consent, and Control (TCC) system<\/a> that controls which processes can access sensitive data and perform actions on your Mac. Once an application\u2014whether Good or Evil\u2014is able to run consistently and unobserved by the user, what does it have access to? Less than it would with explicitly granted permissions, but still a great deal.\u00a0<\/span><\/span><\/p>\n

To be of much use, an EDR or DLP app will need access to users\u2019 files and other data in the filesystem via TCC. It would need Full Disk Access to keep tabs on what\u2019s being read and written, if files are suddenly disappearing or being encrypted by ransomware, for instance.<\/span><\/p>\n

But consider how much information a cleverly written piece of spyware could gather, even without the ability to break the TCC rules (or trick you into granting it permissions). Who logged in, and when? What applications is the system running? What\u2019s the SSID of your wireless network, and do you use a VPN? And that\u2019s not even accounting for temporary files and other data on the drive that may be poorly secured by other processes.<\/span><\/p>\n

Even without malicious intent, some software asks for access to data it really doesn\u2019t need. Most of the time, it\u2019s easier to just agree and grant access when the window pops up asking for permissions. But once those permissions are given, rarely, if ever, are they revoked. You may be interested to see just what\u2019s still installed on your Mac that has access to information, such as your location, or your contacts, or photos. It just so happens, the Automation Cookbook contains a script written to read the TCC database, and prints a report of what it finds there. The script and instructions are posted in the Automation Cookbook here: https:\/\/me.n-able.com\/s\/article\/Mac-TCC-Permissions-Report<\/span><\/a><\/span><\/p>\n

Between this script and Knock Knock, you may find that, yes, your Mac is<\/b> watching your every move. Hopefully, it\u2019s working for our side.<\/span><\/p>\n

For more tips on managing Macs, check out the <\/b>Mac Support<\/b><\/span><\/a> section on our blog<\/b><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

It takes time, patience, and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-37631","post","type-post","status-publish","format-standard","hentry","topic-apple"],"acf":[],"yoast_head":"\nIs Your Mac Spying On You? Maybe It Should be - N-able<\/title>\n<meta name=\"description\" content=\"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is Your Mac Spying On You? Maybe It Should be - N-able\" \/>\n<meta property=\"og:description\" content=\"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-22T11:06:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2022\/09\/220916_blogbanner_IsYouMacSpyingOnYou_ss-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1340\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"N-able\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2022\/09\/220916_blogbanner_IsYouMacSpyingOnYou_ss-scaled.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"N-able\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\"},\"author\":{\"name\":\"N-able\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\"},\"headline\":\"Is Your Mac Spying On You? Maybe It Should be\",\"datePublished\":\"2022-09-22T12:06:39+01:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\"},\"wordCount\":1172,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"articleSection\":[\"Mac Support\"],\"inLanguage\":\"pt-BR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\",\"url\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\",\"name\":\"Is Your Mac Spying On You? Maybe It Should be - N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\"},\"datePublished\":\"2022-09-22T12:06:39+01:00\",\"description\":\"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Mac Support\",\"item\":\"https:\/\/www.n-able.com\/pt-br\/blog\/category\/mac-support\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Is Your Mac Spying On You? Maybe It Should be\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/pt-br?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b\",\"name\":\"N-able\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g\",\"caption\":\"N-able\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Is Your Mac Spying On You? Maybe It Should be - N-able","description":"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be","og_locale":"pt_BR","og_type":"article","og_title":"Is Your Mac Spying On You? Maybe It Should be - N-able","og_description":"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.","og_url":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2022-09-22T11:06:39+00:00","og_image":[{"width":2560,"height":1340,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2022\/09\/220916_blogbanner_IsYouMacSpyingOnYou_ss-scaled.jpg","type":"image\/jpeg"}],"author":"N-able","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.n-able.com\/wp-content\/uploads\/2022\/09\/220916_blogbanner_IsYouMacSpyingOnYou_ss-scaled.jpg","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Escrito por":"N-able","Est. tempo de leitura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be"},"author":{"name":"N-able","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b"},"headline":"Is Your Mac Spying On You? Maybe It Should be","datePublished":"2022-09-22T12:06:39+01:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be"},"wordCount":1172,"publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"articleSection":["Mac Support"],"inLanguage":"pt-BR"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be","url":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be","name":"Is Your Mac Spying On You? Maybe It Should be - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br#website"},"datePublished":"2022-09-22T12:06:39+01:00","description":"It takes time and experience to search for where programs can hide themselves away on macOS. This blog will help you break the code.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/is-your-mac-spying-on-you-maybe-it-should-be#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Mac Support","item":"https:\/\/www.n-able.com\/pt-br\/blog\/category\/mac-support"},{"@type":"ListItem","position":2,"name":"Is Your Mac Spying On You? Maybe It Should be"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/pt-br#website","url":"https:\/\/www.n-able.com\/pt-br","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/pt-br?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/pt-br#organization","name":"N-able","url":"https:\/\/www.n-able.com\/pt-br","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/f46a000e389b6d02bd4b3866e7828a7b","name":"N-able","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e9c468b7c98137ecdd5508befa660c205a7978133257080a37fb0b1362d53411?s=96&d=mm&r=g","caption":"N-able"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/37631","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/comments?post=37631"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/37631\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/media?parent=37631"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}