Mac Hacked? "a computer with IP address 128.130.244.179 tried to establish an incoming connection to kernel"

There's nothing there that indicates being "hacked."

Too often, folks see connections or random behavior and immediately assume this is a hacking attempt. It's not.

This could be any number of legitimate connection attempts especially given that the IP in question isn't flagged as coming from a known hacking IP, one of the many rogue countries (like China) or from a remote, anonymous proxy.

Now, you shouldn't be getting connections like this directly to the kernel especially if you are behind a firewall. However, if your Mac sends a request out and creates a "state" on your firewall, it can connect back - making this entirely legitimate.

  • Ensure you're behind a proper firewall
  • Turn on the firewall on the Mac
  • Log outgoing connections in Little Snitch to correlate traffic

Bottom line...a single connection is not enough to determine anything. You need to see this in context and you need to see the actual traffic that's incoming. If you're not using firewalls, your very first action is to get behind one and/or turn it on.