Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

451–460 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#451

Post by zepto »

munificent wrote: post #443
zepto wrote: post #232

Earlier quoted context omitted.

Except that it’s not an oligopoly - it can’t be by definition. There is a free alternative which is better in many ways and has an unlimited supply. The only reason Apple has a lead in software is that they have made their closed source model deliver end-user benefits at a faster rate than the open source alternatives. There is no reason this needs to remain true, and there are a lot of signs that it will not continu…

> free alternative Only "free" in terms of literal monetary payments to acquire the operating system. But the choice between Apple's stack and other Linux stacks has many trade-offs in terms of time, support, documentation, complexity, transition cost, etc.

Agreed, but that’s not because of an ‘oligopoly’ constraining supply.

The only thing stopping those trade-offs being changed is people’s willingness to make the changes.

Based on a lot of criticism of MacOS I see here, some of that is because people don’t actually want to change the trade offs.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#452

Post by lioeters »

Siira wrote: post #374
derrick_jensen wrote: post #359

Earlier quoted context omitted.

One of the value props was the inability to reset and resell if it were lost or stolen. Now that it’s cracked there is more of an incentive to not try and find the owner. As for actual data security you are probably right

Is the crack in hardware or software? Any links on it? I thought the iPhones at least could not be reset by thieves?

> The mini operating system on the T2 (SepOS) suffers from a security vulnerable also found in the iPhone 7 since it contains a processor based on the iOS A10.

> ..Using the checkm8 exploit originally made for iPhones, the checkra1n exploit was developed to build a semi-tethered exploit for the T2 security chip, exploiting a flaw. This could be used to e.g. circumvent activation lock, allowing stolen iPhones or macOS devices to be reset and sold on the black market.

> Since sepOS/BootROM is Read-Only Memory for security reasons, interestingly, Apple cannot patch this core vulnerability without a new hardware revision.

Crouching T2, Hidden Danger (2020-10-05) https://ironpeak.be/blog/crouching-t2-hidden-danger/

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#453

Post by Sporktacular »

bittercynic wrote: post #398
api wrote: post #312

Earlier quoted context omitted.

I crap on FOSS a bit because I like it and wish it got more traction in the mainstream. I intend it as constructive criticism. I've been a FOSS user and sometimes contributor since 1994 when I installed Linux with floppy disks, and have consistently watched FOSS lose the mainstream because they don't grasp the critical importance of UI/UX. I want to write "it has to just work" on a sledgehammer and bash people about…

Is it really a goal of most FOSS projects to attract the mainstream? IME some of the highest-quality and longest lived projects know who their users are and provide an extremely high quality product. I don't want to see Arch Linux, for example, to start prioritizing for attracting non-technical users who want it to "just work."

Well you should be thankful our predecessors took making things "just work" seriously enough to remove your need to boot using toggle switch sequences.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#454

Post by [deleted] »

Sporktacular wrote: post #434
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

5 years ago I found LS was unable detect any traffic out of a VMWare virtual machine running on the same Mac. Sure the VM is running through some installed virtual network adapter, but if that's all it takes an attacker can set up one of her own. Cool Hollywood interface but I gave up on LS as a serious security tool right there.

[deleted]

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#456

Post by heavyset_go »

jjoonathan wrote: post #288
indymike wrote: post #70

Earlier quoted context omitted.

I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).

How is desktop search? Spotlight (mac desktop search) is a killer feature for me -- fast, reliable, smooth, all straight out of the box. Meanwhile, I've wasted many hours trying to get desktop search up to the same standard on Windows and Linux. That was years ago (for linux, at least), hopefully things have improved. How is linux desktop search doing today?

Works pretty well on Plasma Desktop. I use it all the time to find files via KRunner.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#457

Post by jscipione »

dylan604 wrote: post #100
eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

Apple touted the T2 chip as the bee's knees in security. Now, we have a vulnerability that cannot be defended against. However, Apple went all in on the security of this T2 chip so that you cannot replace the SSD (besides the method to manufacture). I appreciate the desire at making a device difficult for a bad actor to get to your data, but they epicly failed and ultimately only made an user-hostile device. Oh, and…

It's ok, the T3-based MacBook Air is due out next month.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#458

Post by AnthonyMouse »

Spivak wrote: post #278
LocalH wrote: post #233

Earlier quoted context omitted.

I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users

I mean the irony is when it comes to browsers you see the general tone of HN shift to the opposite opinion when it comes to features like, RTC, USB, Bluetooth, Filesystem Access. These are all features that give users more power but it's (apparently) easier to see the downsides and how these features can and are used maliciously. Now put yourself in the Apple's position where "an iOS app" or a "mac App" is about as t…

> Now put yourself in the Apple's position where "an iOS app" or a "mac App" is about as trusted as a random website.

The mistake is in creating a category called "iOS app" or "mac app" and trying to fit every piece of third party code in the universe into that category.

What there should be is different categories of apps with different levels of trust. Then 95% of apps can go in the totally untrusted category because they don't actually need any special privileges. Which then makes asking for a trusted privilege a red flag rather than something the user clicks through because they see it for every app they install.

> Can you imagine if websites could control your firewall?

Realize that this has already happened. You wanted to block DNS to untrusted servers so everything would have to use your Pi-hole? Say hello to DoH. You could block AOL Instant Messenger by blocking port 5190, good luck doing that with Facebook.

The web made every protocol run over HTTPS to bypass your firewall, even if it has nothing to do with transferring hypertext.

Because that's what happens when you do security wrong. It has to be usable or it gets routed around. People started blocking unknown ports by default, or blocking/mangling protocols both of the endpoints didn't want blocked or mangled, so firewalls got displaced.

You don't actually want that to happen (again). You don't want the only options to be living in a cage or rooting your device with some unaudited 0-day code you got from some Russian hackers. There is value in the existence of the middle ground.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#459

Post by heavyset_go »

paranorman wrote: post #2

That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ as an option until DNS encryption becomes widespread :/

I've been using network-level ad blocking with software like Pi Hole for a while now.

According to the stats, about a year ago, I used to block around ~40% of traffic via DNS. Recently, it's only about ~10% of traffic that gets blocked.

Despite disabling application-level DoH in favor of network-level DoH on every device and app I could, I suspect streaming devices and various Android apps are using DoH at the application-level and are bypassing my DNS entirely.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#460

Post by Sporktacular »

_qulr wrote: post #438
Sporktacular wrote: post #434

Earlier quoted context omitted.

5 years ago I found LS was unable detect any traffic out of a VMWare virtual machine running on the same Mac. Sure the VM is running through some installed virtual network adapter, but if that's all it takes an attacker can set up one of her own. Cool Hollywood interface but I gave up on LS as a serious security tool right there.

I can't speak about 5 years ago, but I was using Little Snitch with VMWare last year, and it worked. I had to specifically allow the VMWare process.

Guest traffic was visible when the VM was in NAT mode, but when switched to Bridged mode traffic went straight through with LS unaware. I suppose LS was only sniffing the standard adapters, though this could have been improved since.
Post reply on HN