Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

641–649 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#641

Earlier quoted context omitted.

'Windows doesn't bypass 3rd party firewalls.' Sorry WarOnPrivacy, Windows does bypass 3rd-party firewalls and has done so since at least XP onwards (however, I am uncertain if this was the case with Windows 2000). Microsoft has programmed into Windows dozens of addresses that 'dial home' to Microsoft's servers. As you will be aware, many of these addresses change with the various versions of Windows. Normal program s…

None of what you've posted has anything to do with firewalls, 3rd party or otherwise. Similarly, bypassing the Hosts file is strictly a DNS resolution issue and - again - has nothing to do with firewalls. Please feel free to post info about actual firewalls, info that isn't about DNS/Hosts.

1. Firewalls can monitor existing host settings and take them into account.

2. The 'dial-home' mentioned bypasses Windows's firewall.

3. External monitoring has shown that it does bypass firewalls (however, I cannot say whether that's all of them). So does security software such as LoJack (but that's somewhat unusual).

4. This includes ones with kernel drivers.

5. As the code is written to be invisible to other processes, firewall writers would either have to reverse engineer MS's code to stop it or know certain proprietary details about it. I doubt if any legit/reputable developer would risk using info gained from RE (certainty not to stop it functioning as MS intended). Nevertheless, some MS parteners know about it for obvious reasons.

6. From various news reports several weeks ago, it seems that XP's source code has leaked. That means if you are keen enough you can find the 'offending' code and verify the matter for yourself one way or the other (at least as far as XP goes). If you don't, then sooner or later l'm sure others will do so.

If I and others who share this understanding are way off beam, which I doubt having seen evidence, then please let us all know about it in a HN post.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#642

Earlier quoted context omitted.

It seems like this is a feature designed to shrink the "used" market for Apple products -- and not a user benefiting feature.

But one of the things about Apple products that makes people okay with the exorbitant pricing is the resale value. I thought Apple themselves realized this?

No, they want both you and the potential pre-owned Mac buyer to buy a new device each.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#643
post #577

Earlier quoted context omitted.

Both of those things work under Linux for me. I guess it depends on the apps?

Can you give examples of which apps you noticed it working for? and what desktop environment/distro? I will most certainly test.

VSCode and Sublime Text remember the files they had opened. And renaming files while they are played back works fine with mpv.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#644
post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!

omgggg it's not just me?! I thought it was bad hardware. this is both good and bad news; at least I can sort out a way to mitigate this now.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#645

Earlier quoted context omitted.

I also have 2019 MBP16 and i am using a dock/charging on the left side - i think the system froze once in a year so i don't seem to have this issue.

Did you buy the stock spec or custom?

Stock with i9, 16GB RAM, Radeon 5500m, 1TB SSD

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#646
post #18
post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

I'd argue this opens up a giant attack surface where malicious software will try to route its command and control communication through a protected service. Do we really want to trust that Apple will keep all 50+ of these privileged services fully protected? I think it makes the "world" slightly worse in that it will be harder to discover malware. Little snitch has a small user base, but it's been used to identify ma…

Same situation with a government:

Even if you believe all the MPs / representatives are trustworthy and intend to act in your best interests, their competence is going to be limited, so we need to checks and balances and a limit on their power.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#647

Earlier quoted context omitted.

Trust but verify. Now we must do the former without being able to do the latter.

You can very easily monitor all outgoing traffic through an external device.

How do you get around TLS with cert-pinning?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#648
post #45

Earlier quoted context omitted.

Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!

If you're using Cisco Anyconnect, blame that for that particular keyboard issue.

Oh my gosh this explains so much.

I blame Apple though for their terrible software.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#649

Earlier quoted context omitted.

Apple touted the T2 chip as the bee's knees in security. Now, we have a vulnerability that cannot be defended against. However, Apple went all in on the security of this T2 chip so that you cannot replace the SSD (besides the method to manufacture). I appreciate the desire at making a device difficult for a bad actor to get to your data, but they epicly failed and ultimately only made an user-hostile device. Oh, and…

> I appreciate the desire at making a device difficult for a bad actor to get to your data That's what FileVault is for. I don't understand what's the problem T2 is trying to solve by its existence. Being able to use something else to read the data from a drive you pulled out of your computer, after decrypting it with your password, is a feature, not a bug. T2 is a regression, not an improvement in security. You can'…

[deleted]
Post reply on HN