Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

491–500 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#491
post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

> your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Holy shit, this is why my macbook sometimes won't let me log in for like 15 seconds on my shitty cellular hotspot connection? Absurd. Apple software has fallen so far from just 10 years ago.

Great... Well, that explains the crappy response on some bad connections.

I really wish Apple executives were forced to use their computers on crap wifi. Who am I kidding, I would imagine Tim Cook hasn't used a Mac in years.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#492
post #18

Earlier quoted context omitted.

I'd argue this opens up a giant attack surface where malicious software will try to route its command and control communication through a protected service. Do we really want to trust that Apple will keep all 50+ of these privileged services fully protected? I think it makes the "world" slightly worse in that it will be harder to discover malware. Little snitch has a small user base, but it's been used to identify ma…

I think this is the case where you can have traffic monitoring set-up on your home router or any other network gateway available. It will be slightly more troublesome, but not impossible.

That doesn't work with HTTPS, obviously.

And with DNS-over-HTTPS, DNS-over-TLS and encrypted SNI, that makes it all the more harder.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#493
post #400
post #18

Earlier quoted context omitted.

I'd argue this opens up a giant attack surface where malicious software will try to route its command and control communication through a protected service. Do we really want to trust that Apple will keep all 50+ of these privileged services fully protected? I think it makes the "world" slightly worse in that it will be harder to discover malware. Little snitch has a small user base, but it's been used to identify ma…

The decision is questionable, but you can always inspect traffic from the machine outside it, I would even say that's preferable in context of malware.

TLS makes this difficult today and SNI encryption will make this next to impossible without installing a custom ca certificate and doing MITM. Even that isn't helpful when you are using a laptop that may not always be on the network where you have deployed a device for inspection. Better to be able to inspect or block on the device by application.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#494
post #412

Earlier quoted context omitted.

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

google.com.evilwebsite.example?=google.com Oh that has google in it (twice even) we can go there. There's also arguments that URLs are too complex for normal people to understand. I agree with you though, hiding or redirecting URLs is the opposite of protecting users from phishing.

> google.com.evilwebsite.example?=google.com

This was solved a decade ago by rendering the 2nd+1st level domains (and sometimes other parts of the URL) in a different style.

> There's also arguments that URLs are too complex for normal people to understand.

That argument is an insulting attempt to justify a form of illiteracy[1]. Most people don't need to know all of the technical features of a URL; they just need to be able to use it as an address and recognize basic features like the hostname.

Street addresses are a good analogy. Most people understand the basics easily even though physical addresses are far more complex[2] than URLs!

[1] https://news.ycombinator.com/item?id=7694919

[2] https://news.ycombinator.com/item?id=7695735

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#496

Earlier quoted context omitted.

Apple touted the T2 chip as the bee's knees in security. Now, we have a vulnerability that cannot be defended against. However, Apple went all in on the security of this T2 chip so that you cannot replace the SSD (besides the method to manufacture). I appreciate the desire at making a device difficult for a bad actor to get to your data, but they epicly failed and ultimately only made an user-hostile device. Oh, and…

> I appreciate the desire at making a device difficult for a bad actor to get to your data That's what FileVault is for. I don't understand what's the problem T2 is trying to solve by its existence. Being able to use something else to read the data from a drive you pulled out of your computer, after decrypting it with your password, is a feature, not a bug. T2 is a regression, not an improvement in security. You can'…

> I don't understand what's the problem T2 is trying to solve by its existence.

watch the 2 security briefings that Apple delivered at black hat. i think they are 3 years apart and each touched on different aspects. i might be misremembering and T2 is covered in just one of them.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#497

Earlier quoted context omitted.

Don't bother to look to Microsoft Windows for a solution! For don't forget MS Windows has a 'dial-home-to-Microsoft' link that's hard coded within Windows itself. It bypasses the hosts file altogether, and if I recall correctly, it's been in Windows since XP. The only solution stop the 'talk-home' connection would be to find the destination IPs numbers and then key them into your external router for blocking.

Windows doesn't bypass 3rd party firewalls.

'Windows doesn't bypass 3rd party firewalls.'

Sorry WarOnPrivacy, Windows does bypass 3rd-party firewalls and has done so since at least XP onwards (however, I am uncertain if this was the case with Windows 2000).

Microsoft has programmed into Windows dozens of addresses that 'dial home' to Microsoft's servers. As you will be aware, many of these addresses change with the various versions of Windows. Normal program switches can block some of these addresses whilst others are hidden from normal view, but with a little judicious snooping, we can find most of hidden ones and successfully block them with the hosts file.

However, we cannot block all of them, and this has been the case since Windows XP. From my understanding, which I learned from various security experts around 15 or more years ago at the time when the Microsoft 'exploit' was first discovered, Microsoft hard-coded certain dial-home links for the specific purpose of determining which and how many copies of Windows were pirated. (This seemed to have been the consequence of the widespread pirating of certain corporate copies of Windows 2000.)

Whilst the user many have thought he'd secured every talk-home to Microsoft loophole and was safe, nevertheless MS still knew that his O/S was a pirate version. Unlike other activation links that announced an 'illegal copy' status to the user, these links only advised Microsoft of the fact—if you like, there're part of Microsoft's secret surveillance system. Essentially, Microsoft has deliberately sabotaged the DNS client's hosts table lookup functionality by bypassing it with hard coding.

It seems that in recent years, Microsoft has developed this secret system to an even finer art, as these days it gathers much more information other than whether the O/S has been pirated or not.

With having the handle WarOnPrivacy, I gather you're more than just interested in securing your Windows in the usual ways. If I were you, I'd do what I'm doing here and that's to research the details further and then publicize the fact. As will now be obvious, this is not something that Microsoft wants broadcast to the world.

Below are a few links about the matter with a few comments from some of the sites:

https://slashdot.org/story/06/04/16/1351217/Microsoft-Bypass...

https://bugtraq.securityfocus.narkive.com/a2fZWlAb/microsoft...

" Hey, guess what I just found out: Microsoft have deliberately sabotaged their DNS client's hosts table lookup functionality. Normally you can override DNS lookup by specifying a hostname and IP directly in the hosts file, which is searched before any query is issued to your dns server; this technique is often used to block ads, spyware and phone-homes by aliasing the host to be blocked to 127.0.0.1 in your hosts file."

https://www.theregister.com/2015/09/01/microsoft_backports_d...

"All the updates can be removed post-installation – but all ensure the OS reports data to Microsoft even when asked not to, bypassing the hosts file and (hence) third-party privacy tools. This data can include how long you use apps, and which features you use the most, snapshots of memory to investigate crashes, and so on."

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#498

Earlier quoted context omitted.

Docks on the left side, or similar devices which provide both power and send data, seem to be particularly problematic. On advice of my employer's IT department I went from "spinning up new VMs in VirtualBox reliably leads to thermal excess, CPU throttling, and total system shutdown" to a system that actually works -- just by moving the dock connection to the right side. It's a little funny because the advice used to…

On one of the older MacBookPros, the left hand USB port was USB3 while the one on the right hand side was USB2

T3 vs USB3, not USB3 vs USB2.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#499
post #233

Earlier quoted context omitted.

I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users

As is usual, this is something Stallman had touched upon years ago[1]. [1] https://www.gnu.org/philosophy/can-you-trust.en.html

I've been respecting RMS' argument year by year

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#500

Earlier quoted context omitted.

> I appreciate the desire at making a device difficult for a bad actor to get to your data That's what FileVault is for. I don't understand what's the problem T2 is trying to solve by its existence. Being able to use something else to read the data from a drive you pulled out of your computer, after decrypting it with your password, is a feature, not a bug. T2 is a regression, not an improvement in security. You can'…

One of the value props was the inability to reset and resell if it were lost or stolen. Now that it’s cracked there is more of an incentive to not try and find the owner. As for actual data security you are probably right

> One of the value props was the inability to reset and resell if it were lost or stolen.

It's sure one of those nice to have features, but there's no good reason why it has to be mandatory like it is. All in all, having a device purposefully retain some information when you factory reset it is user-hostile.

The "lost or stolen" argument also hardly holds for desktop computers like Mac Pro or Mac Mini or iMac, yet they still have T2s in them.

Post reply on HN