Origin of notification: "Simulated Input Ignored..."

General discussions about Little Snitch
Post Reply
jhfrontz
Posts: 1
Joined: Fri Jan 08, 2016 1:37 pm

Origin of notification: "Simulated Input Ignored..."

Post by jhfrontz » Fri Feb 03, 2017 3:57 pm

I received this notification while my MBA was screen-locked (screensaver engaged with login password required to dismiss it):

https://drive.google.com/file/d/0B76PkJ2HIoeQcVE0MmlESTlXUUU (text reads Simulated Input Ignored from: WindowServer. To accept them, "GUI Scripting access to Little Snitch" must be allowed in the Security preferences).

I'm assuming this is related to the "Allow GUI Scripting access to Little Snitch" item on the Little Snitch Security & Privacy Configuration pane. But how can I tell where the event originated? Could it be as simple as a cat walking across the keyboard (of the screen-locked MBA) at just the right time (e.g., after/as Little Snitch is prompting to allow access to some background application)?

Thanks,
Jeff

Sunny137
Posts: 1
Joined: Sat May 27, 2017 4:20 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by Sunny137 » Sat May 27, 2017 4:37 pm

Hi I got this exact same message,
I'm using the latest version of little snitch, downloaded this week

I suspect my mac might have been hacked, on the weekend, hence why I put little snitch on it..

I clicked on the bubble pop up and it showed that the source was WindowServer
In the SkyLight.framework

I can't find the notification (is there a log somewhere where I can retrieve more information about it?)
but I think the message said it tried to change rules..

Is it possible this pop up is evidence that a hacker is trying to open holes in the firewall..?

Many thanks!

objectiveuser
Posts: 1
Joined: Tue Jun 06, 2017 11:38 am

Re: Origin of notification: "Simulated Input Ignored..."

Post by objectiveuser » Tue Jun 06, 2017 11:41 am

I also got this message this morning (using MacBook Air, 10.11.6). It does sound worrisome, as if some malware was trying to generate input to control the computer.

whatever
Posts: 1
Joined: Fri Jun 16, 2017 4:08 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by whatever » Fri Jun 16, 2017 4:12 pm

Out of blue...

Image

(https://imgur.com/a/WJ71u)


Any suggestions where (why) it comes from?

asnitchintime
Posts: 1
Joined: Tue Jun 27, 2017 6:15 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by asnitchintime » Tue Jun 27, 2017 6:25 pm

All I can contribute is a description of WindowServer:
WindowServer draws everything you see on the screen. It acts as a mediator between applications that want to draw on the screen and the graphics hardware. When an application wants to draw something, it establishes a connection with WindowServer, tells WindowServer what to draw, and WindowServer handles the drawing / compositing / Quartz Extreme hardware acceleration to finally produce what's seen on the entire screen.
https://forums.macrumors.com/threads/what-is-windowserver.59082/

littleratlover
Posts: 5
Joined: Mon Apr 25, 2016 8:35 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by littleratlover » Tue Jan 02, 2018 10:28 pm

Old thread, obviously, but the only one I could find that was relevant. I have also started seeing these "simulated input ignored" notifications from LS (most recent version) recently. I am running 10.11.6 (El Cap) and it did start after the last round of security patches but I am not convinced it is related. In my case, the notification appears when I am trying to use autofill to log in to a website and are from the OS X System Events process (not Window Server). Simultaneously, LS throws up an alert about an iCloud.com connection attempt, which I deny. The websites are not the same and they are benign (I am pretty sure) so I don't think it is a hack.
Anybody else see these notifications?

mbmnbmnb
Posts: 1
Joined: Sat Sep 08, 2018 11:08 am

Re: Origin of notification: "Simulated Input Ignored..."

Post by mbmnbmnb » Sat Sep 08, 2018 11:10 am

Got the message just then and same question as everyone else here.
macOS 10.11.6

Simulated Input Ignored

WindowServer has simulated mouse or keyboard input that Little Snitch has ignored for security reasons. You can allow simulated input in Security preferences by enabling “Allow GUI Scripting access to Little Snitch”.

PID: 192
Path: /System/Library/Frameworks/CoreGraphics.framework/Versions/A/Resources/WindowServer

paul
Posts: 1
Joined: Thu Sep 27, 2018 3:21 am

Re: Origin of notification: "Simulated Input Ignored..."

Post by paul » Thu Sep 27, 2018 3:25 am

I'm also getting this Simulated Input Ignored message on macOS High Sierra 10.13.6. Should this be allowed or ignored?

mustbjones
Rank 2
Rank 2
Posts: 40
Joined: Tue Nov 06, 2007 7:42 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by mustbjones » Fri Dec 07, 2018 9:48 pm

I got hit with the message. Latest version of LS, MacOS 10.14.2. My message says "Default Folder X has simulated muse or keyboard input that Little Snitch has ignored for security reasons." I have no idea why.

seanm
Posts: 2
Joined: Mon Dec 17, 2018 7:05 pm

Re: Origin of notification: "Simulated Input Ignored..."

Post by seanm » Mon Dec 17, 2018 7:21 pm

Anyone know if it's possible to know the path or name of the process that sends these 'simulated inputs'? In my case, it shows only the PID and by the time I lookup the PID, the process is no longer running.

rwii
Posts: 1
Joined: Tue Mar 05, 2019 9:37 am

Re: Origin of notification: "Simulated Input Ignored..."

Post by rwii » Tue Mar 05, 2019 9:43 am

Anyone figure this out yet? I received the same message "Simulated Input Ignored" (WindowServer). Coincidentally I updated to the latest release today, probably unrelated.

Also, does anyone know if this notification means that a process tried to simulate any kind of random input or that it was blocking an attempt of simulated interaction with the Little Snitch app (specifically)?

Thanks

Post Reply