RED ERROR MESSAGE IN LOG MacBook Pro

Our company got hacked last week via Microsoft Azur cloud and I am the only one in the company that uses Microsoft products. We are sure that it's via Microsoft Azure because we have the IP address that connected on our AWS server 104.42.44.150.

After doing some research on the web it looks like it's not that complicated to hack via Microsoft Azur. Please see: https://www.securitynewspaper.com/2019/08/08/simple-reasons-why-the-microsoft-azure-cloud-isnt-secure/

Hi there,

Thanks you so much for your help !!! this is really appreciated.

So I did run the diagnostic above and the result is that there is not hardware issue.

Question: Would my question be software related ?

FYI, Today I have already reinstalled Catalina vers 10.15.4. I did this because yesterday when I installed the latest update, the screen became red around the apple for a few seconds so I decided to reinstall the couple Catalina version this morning.

Also when I connected to my back account 4 days ago I received an alert that I should active the firewall.

Again thanks a lot for your help.

Thanks so much for all of your recommendation.

So I did what you recommended. After rebooting the Mac, I had to ajuste the light of the screen and the "Key chain" (trousseau in French) interface opened. This might be due to the fact that I changed the session setting earlier and it came back to it's original setting.

However while glancing over the passwords I noticed that there is something weird.

One of the key name is: hpfc3fdbdc8c4e. It doesn't look normal to me. Can I delete it? Please see pix below. THANK YOU for your help.

Additional facts:

• It's the second time that this happened to us. Each time the hacker managed to steel keys even though we are very cautious.

First time he did a set-up via CloudFlare and this time via Microsoft Azure. Each time he attacks AWS SES service and sends SPAM out using our domaine name.

• The key has a logo in front. This logo looks like the Microsoft logo if I compare it to Microsoft Office credential and we go hacked via Microsoft Azure.
• I have suspicious about who is doing it because our problems started a few weeks after we started working with them which is November last year.
• In our organisation we don't use a network, so there is no need for this access key I think.
• It's a good idea to copy it. I can see how to copy it however I don't know how to store it and where. Would you know?
• Thank you. thank you ...

Thanks, thanks for all these details.

Indeed I have opened two infringement cases. One against CloudFlare that stoped the server of the hacker right away and one against Microsoft Azure. Microsoft Azure hasn't come back yet. In the infringement request we shared with them 1) the evidence that we got hacked via the Azure cloud, 2) requested that they share any additional information that they might have about this customer 3) that this caused damages to our company, 4) that they need to stop the activity of this customer ASAP to ensure that this hacker doesn't start again via M.Azure. A quick action on their behalf is vital and essential to limit any future damages that this hacker might cause to our organisation.

This request was official sent to Microsoft infringement legal department April 24 14:23 CET. As of now I have not received any response, confirmation or any communication from them.

CloudFlare was much more reactive. They came back right away and acted accordingly within a day by stopping the server of the Hacker.

Regarding the unnamed key that sits in my keychain, I noticed that there is a fonction go (aller) when you click on the key. When I click on it, It opened the MacintoshHD/private/etc/wfs/directory and the message was that the server is not available and I have deleted the key.

Unfortunately I didn't see your response before deleting the key because I didn't get an email notifying me that a new message arrived. :-(

The WFS directory is an other ticket that I did open earlier to better understand what it does. I understand that you can develop a background App, push it on any PC and connect to it via an unsecured connection http via the WFS directory. Do you have the same understanding ?

Thanks !

Thank you very much !

I am tempted to stop using any microsoft products so that I can delete this wfs directory and close this security door.

Your support was fantastic !!!

I have closed this ticket and wish you all the best.

Our roads my cross one day :-) Who knows. Take care