Persistence & Privacy Hunting

List the SSH keys authorised to log into this Mac — anyone holding a matching private key can get a remote shell if Remote Login is on. Shows each key's type and comment only, never the key material. A key you don't recognise is a backdoor.

List the cron jobs scheduled on this Mac (your crontab plus the system ones). cron is an older scheduler that malware still uses for persistence — a job that runs a script from a temp folder or pipes a downloaded URL into a shell is worth a hard look.

Scan the launch-item files (your login agents and the system launch folders) for any a non-owner can modify, or a system one not owned by root — a persistence-hijack surface where an attacker could rewrite what auto-launches at login or as root.

Audit the readable sudo rules for passwordless-sudo (NOPASSWD) entries — malware plants these to run as root without a password. Reads the rule text only, never a password, and reports honestly if the files aren't readable.

List the Safari extensions installed and whether each is enabled — the Safari counterpart to the Chromium extension list. An enabled extension can read and modify the pages you browse, so one you don't recognise is worth turning off.

Check whether Spotlight and Safari search suggestions are sending what you type to Apple to fetch suggestions, and whether Siri is enabled. If you'd rather keep your typing local, these can be turned off.

Report the recent-items lists macOS and your apps keep — the 'Recent Items' menu and recent files and servers — a record of what you've opened that's visible to anyone using this Mac. Counts the lists without dumping their contents.

List the external Thunderbolt and USB4 devices attached to this Mac. Thunderbolt gives a device direct memory access, so a malicious dock or adapter is a real 'evil-maid' risk — this surfaces what's on that bus.

Report whether Activation Lock — the Find My anti-theft feature — is on. With it on, a lost or stolen Mac can't be erased and reused without your Apple ID password. If it's off, turning on Find My Mac enables it.

Check the login screen for exposure: automatic login (which boots straight to the desktop with no password), whether it advertises the list of user accounts, and whether a password hint is shown. Automatic login is the big one.

Read the low-level kernel boot flags set in firmware and flag any that weaken security — such as disabling code-signing enforcement or SIP protection. Security-weakening flags are sometimes left by malware and persist across reboots.

List the disk images (.dmg / .sparsebundle) currently mounted, and whether each is encrypted. An encrypted image left mounted is unlocked and readable right now — a vault you thought was closed stays exposed until it's ejected.

Remove an SSH key from this Mac's authorized_keys so its holder can no longer log in — the fix when the list shows a backdoor or a key you don't recognise. Match a distinctive piece of the key; a backup of the original is kept.

Remove a job from your crontab — the fix for a malicious or unwanted scheduled job. Only your own crontab is changed; system cron is left alone. Match a distinctive piece of the line.

Turn off Safari's search suggestions and universal search so Safari stops sending what you type in the address bar to Apple's suggestion service. Quit and reopen Safari for it to take effect.

Wipe the recent-items lists — the 'Recent Items' menu and the recent files and servers history — for example before handing the Mac to someone. Apps rebuild their own lists as you use them again.