The 1Password 7 app changed to the number 94 without my noticing it, have I been hacked?
I'm on an M1 MacBook Pro and using the latest version of Ventura. I rarely look at the app itself since it is running in the background but, today I noticed the name changed in back April the numerals 94. I uninstalled the app only using AppCleaner and reinstalled it from the 1Password site. Should I do a completed uninstall and use a backup prior to 1 April. My data is stored in iCloud.
1Password Version: 7.9.10
Extension Version: 7.9.10
OS Version: macOS Ventura 13.4
Browser:_ Safari
Referrer: forum-search:The 1Password 7 app changed to the number 94 without my noticing it, have I been hacked?
Comments
-
Hello @penners1! 👋
I don't have any access to your Mac so I can't tell you if you're been compromised or not. Before continuing I recommend that you reach out to Apple Support so that they can help you secure your Mac and any other devices that you may have. You can reach them here: Official Apple Support
Once Apple has helped you verify that your devices are safe for you to use I'm happy to help you with 1Password itself.
I rarely look at the app itself since it is running in the background but, today I noticed the name changed in back April the numerals 94.
Do you have a screenshot that you could post of what you saw? Was the filename of the app changed? Or was something inside of an item changed?
-Dave
0 -
Here is the app in the trash along with the get info for the file... the latest 1Password installer is also in the trash from when I installed it today.
0 -
Is there a way for someone there to see if the app was changed other than the name?
0 -
I can't say that I've ever heard of the app's name being changed to "94.app" and I'm not seeing any other reports of this behaviour. You mentioned using an app cleaner and I wonder if that was possibly involved, there are some issues that can arise when using an app cleaner with 1Password and we generally recommend that you exclude 1Password from your app cleaner.
Are you seeing any other apps renamed? Are you the only person who uses the Mac? Was 1Password 7 installed to the /Applications folder or another location?
-Dave
0 -
I have backups of my system on a couple of external disks and the app would be in those drives. I discovered it when looking at apps that I'm not using and could delete so I don't think it was involved. I am the only one that uses this Mac. The data in the app looks like nothing has changed except one location that happened and data looks to be ok. I'll look at the backup locations to see if they changed their name for the app
0 -
I just checked my TimeMachine files and the name was OK on 9 May and file name changed on 10 May. Just because I can & be safe I will "Nuke" my computer and use the TimeMachine backup version to restore from!
0 -
I suppose it's better to be safe than sorry.
I'm guessing what happened is that you had the Applications folder open in Finder, had 1Password selected, and hit Enter and typed 94 and Enter again, not realizing you had Finder in focus, and thought you were typing elsewhere. That would change the name of the app. I've done this inadvertently before, typing quickly before I realized what I'd done.
0 -
Thanks for all the help! The Mac has been totally redone and the TimeMachine used to bring it back to a few days before it happened.
0
