1–10 of 45 posts
Immediately, I think the quick answer is to block outgoing requests to apple's server using an external firewall, but how does one identify which requests are carrying the spyware?
On the Mac system, how can we remove the spyware functionality?
Just switch to something else.
Make that “Starting with Catalina” (https://lapcatsoftware.com/articles/catalina-executables.htm...)
I honestly can't understand why on earth would a sane minded person spend all that money on apple hardware and then on top of that spend a a lot of time fighting a losing fight against the software. Just switch to something else.
You can also find some blogs and forums that discuss what applications are not critical and that you can "launchctl unload -wF" safely to minimize chatter and improve battery life. Ensure the sites specifically call out the version of MacOS you are on, as these things change with each release.
“With BigSur, Apple is getting a hash of every executable you run” Make that “Starting with Catalina ” ( https://lapcatsoftware.com/articles/catalina-executables.htm... )
LittleSnitch 4 can continue to work (with the kext) on Big Sur following this: [1]
LittleSnitch 5 can block all protected MacOS processes by following this: [2]
Murus can use PF and block IPs for Apple services: [3]. This isn't per process, and is really just a UI for the built-in PF process.
If you'd like to block the notarization check, you can block trustd (/usr/libexec/trustd) access to ocsp.apple.com (on both system and user process ownership in LittleSnitch).
Hope this helps. It's really not as bad as you think, there's a few solutions depending how thoroughly you want to block things.
[1] - https://www.obdev.at/support/littlesnitch/245913651253917
[2] - https://tinyapps.org/blog/202010210700_whose_computer_is_it....
I would start with LittleSnitch [1] Don't block things by default. Let it learn traffic and show you what is talking to what. Then sort out what things you want to block. I suggest this method because some of the flows won't be obvious if you start selectively blocking things from the start. Make notes of the IP's, CIDR blocks and domains that are problematic and block them on the edge of your network on a monthly ba…
I honestly can't understand why on earth would a sane minded person spend all that money on apple hardware and then on top of that spend a a lot of time fighting a losing fight against the software. Just switch to something else.
There are things which Apple Macs excel at, and no other laptop even comes close. This is not me speaking in thin air, you can yourself notice that majority of developers and creative professionals own Macs.
I would start with LittleSnitch [1] Don't block things by default. Let it learn traffic and show you what is talking to what. Then sort out what things you want to block. I suggest this method because some of the flows won't be obvious if you start selectively blocking things from the start. Make notes of the IP's, CIDR blocks and domains that are problematic and block them on the edge of your network on a monthly ba…
There was a thread the other day... about this. I believe mapping ocsp.apple.com to 127.0.0.1 on your hosts file will do the trick.
sudo route add -net 17.253.17.0 255.255.255.0 -blackhole