Privacy and security issues on my MacBook Pro

I would factory reset the device, or simply replace it with a new one (2015 Macs are obsolete and no longer supported). The computer should have been factory reset immediately after it was "gifted."

Given that you have been using the Mac for some time, it will be IMPOSSIBLE to unravel what you think the bad guy did versus what has happened while you have been using it, installing things, overwriting files, changing settings and configurations, etc. Just in a practical sense, this will be impossible to prove beyond a reasonable doubt, someone will always be able to convince a judge or jury that the problems were introduced by you, not the previous owner. He will have his expert witnesses, you will have yours. No one will be able to tell what caused what.

By the way under your item 1 above, my Macintosh HD (volume level) shows those same exact configurations as yours. I am running Ventura on a MacBook Pro 2019.

You iPhone adventure seems a separate problem that might be more clear cut.

The Mac appears to maybe have been customized by the previous owner, as many people do, which is why it should have been factory reset and still needs to be.

Even if you could prove that he gave you a Mac that was booby trapped somehow, what are your damages? What crime was committed? Can you prove it? Can a government prosecutor prove it? Can you convince one to try? In criminal court, it must be proved beyond a reasonable doubt, and the accused is presumed not guilty from the get go. In civil court it must be proved by preponderance of the evidence (a lesser standard), but what are you after from this person, compensation? How much? Does he have any money? Can you afford the cost of attorneys, filings, etc. for what might be very small and demising returns. This seems like a long march towards an uncertain ending. I would just factory reset and move on in your life, rather be imprisoned by this history with an obsolete Mac for how much longer?

If what you said is true, that the person who gave you the MBP is untrustworthy, possibly gave you a fraudulent device, stole a phone from you, may be harassing you, etc. ... then the only answer is to stop using this MBP and preserve it in its present state as potential evidence in the event you need to go to the police. Don't make any changes or attempt any fixes, as that may in and of itself destroy the very evidence you are trying to preserve.

Although it may be inconvenient and you may need to purchase another MBP to use in its place, continuing to use a potentially compromised device only puts you at continuing risk.

One other thing, a 2015 MBP is practically aged out at this point. While technically it could be upgraded to Monterey (macos 12.x) that's the final release of macOS that will run on a 2015 model.

Hey there!

I understand your concern for privacy and security, there is a lot going around nowadays.

Anyhow these devices are the most secure around, and if you are mentioning several of your devices being affected, I would probably troubleshoot and secure whatever network(s) you connect, or are connected to, not the devices, (As long as you’ve already secured your internet accounts and confirmed the privacy and security settings the OS provides you as well of course).

Anyhow, If you wish to keep any “evidence” on your Mac, yet wish to continue using it, I would suggest creating a new partition on the hard disk, this does not erase the data currently on your Mac, but does create a separate volume on it that you can keep encrypted and secure, while still having the option to boot from the original volume, note that it’s still a good idea to keep a backup before doing these steps:

Startup your Mac while pressing Command R on the keyboard, (You can release once you see the Apple logo), then follow the prompts to get to recovery mode, note that you might be asked for your admin and Apple ID password which is normal, and might be given the option to “Exit to recovery” which is also normal with the newer software.

Once in recovery mode, open Disk Utility. Once there, on the top menu, click View > Show All Devices.

Underneath the main hard disk, (SSD/HDD/Fusion Drive), you will see a Container Disk, click on this, then click the “+” next to “Volumes”, when asked, give the new volume a distinct name, then click the option to “Add”.Once done, Quit Disk Utility, make sure you are connected to a good network, choose the option to Reinstall Mac OS, and make sure to choose the name of the new volume you assigned it.

Once the process is done, you can set it up as if it’s a new Mac. And to boot to the previous partition/volume, you can just startup your Mac with the Option key and choose the name of the original volume, and can do the same to return to the newly created volume. Likewise, you can encrypt the new volume, (And the original as well if needed):

Encrypt Mac data with FileVault - Apple Support

Although if there is an issue with your network security, then any device you choose to connect it to may just have the same issue, (As far as information traveling through your network, macOS and iOS are certainly secure as long as you don’t allow malicious software to be installed, or connect to an untrusted network). In this case, testing on a new network may be a good idea, especially if you are having behavior not expected on your devices in relation to the security settings you contained, whether device or accounts.

Here are a few articles provided by Apple, hope they help!:

Personal Safety User Guide - Apple Support

Apple Platform Security - Apple Support

Change Privacy & Security settings on Mac - Apple Support

Change Privacy & Security Advanced settings on Mac - Apple Support

How Safety Check on iPhone works to keep you safe - Apple Support

See who has access to your iPhone or iPad - Apple Support

Use the built-in privacy and security protections of iPhone - Apple Support

If you think your Apple ID has been compromised - Apple Support

Otherwise, if you truly are concerned about these issues, and your privacy and security still, I’d recommend contacting law enforcement, or a security specialist to investigate and pursue any criminal behavior.

I hope something here does help!

Regarding your specific questions:

1 - Looks normal except I would have expected Owners Enabled to be YES. Although I cannot explain why it would be NO.

2 - library>group containers>UBF8T346G9.office is where MS Office Outlook stores your Outlook Identity and mail database. This is normal.

3 - These do not look like applications to me. Are you certain they were in System Report > Software > Applications? If they were, it would be helpful if you post a screenshot.

If you’re that concerned, factory reset the device. What specific items make you think there is something amiss?

The most secure computer, is one never turned on. Keep all your data in a Swiss bank vault where only you keep the keys. Then do all your work in the vault.

Seriously though, you have to think about both physical security and access. At what point is security impeding on your life? At what point are you going to let the fear of the unknown control you?

You can encrypt drives, but that can be a tremendous slow down on backing up and restoring operating systems. I've seen recovery take a week on a computer that is completely encrypted. And then if you forget your password of an encrypted drive, not even the FBI will be able to decrypt it. Or if the encryption key file itself gets corrupt, your access to the file may be ruined.

This is where you have assign priorities to what is secure, and what is not. You can choose to keep such things as social security number, drivers license number, passport number, bank account number, credit card numbers compeltely off your computer. And keep those in a safe place.

Passwords are best if they are at least 16 characters, mixed upper, lower case, and special characters, and not a word in any language. Split at least 8 characters with some cypher that you remember. And then something you write down that you always change when you need to. And never share your cypher with anyone.

Emails are not secure for any sensitive information.

RSA Token keys are unique and encrypted keys for secure transactions on current web browsers.

Browsers by Mac operating system - Apple Community

As someone who works for a Managed Service Provider, that's best advice I can offer you.