I have a MAC OSX 10.6 box that I think was compromised via "Screen Sharing"(VNC). I have an IPFW script on the box that logs traffic but can't seem to find anything. Is here a place where VNC logs who accessed your box and the source IP? I've googled to no avail so any help is appreciated.
Open Console and in the All Message, do a filter on vnc.
Yep, it should be in there somewhere (in /var/log). I'll VNC from one Mac to another tonight when I get home for a definite answer (if someone doesn't get it before then.) My thoughts are it's in windowserver.log or system.log, likely. --
·
