TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Bypassing Firewalls in macOS Big Sur

754 pointsby polyrandover 4 years ago

36 comments

rubatugaover 4 years ago
How to disable this feature:<p><a href="https:&#x2F;&#x2F;tinyapps.org&#x2F;blog&#x2F;202010210700_whose_computer_is_it.html" rel="nofollow">https:&#x2F;&#x2F;tinyapps.org&#x2F;blog&#x2F;202010210700_whose_computer_is_it....</a><p>And a humorous guide on disabling protections like code signing and notarization:<p><a href="https:&#x2F;&#x2F;www.naut.ca&#x2F;blog&#x2F;2020&#x2F;11&#x2F;13&#x2F;forbidden-commands-to-liberate-macos&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.naut.ca&#x2F;blog&#x2F;2020&#x2F;11&#x2F;13&#x2F;forbidden-commands-to-li...</a>
评论 #25097658 未加载
评论 #25099386 未加载
评论 #25099593 未加载
评论 #25097185 未加载
评论 #25097398 未加载
chefandyover 4 years ago
Ugh. I&#x27;d love to switch to Linux, but as a designer, I&#x27;m stuck. It&#x27;s not a lack of understanding of how it works— Before I was a designer I was a developer, worked in IT for a while, worked in upper-level support for a while, and Linux was my primary personal and professional OS from the late 90s to like 2010.<p>Why don&#x27;t I just run a closed-source OS in a VM? They are fussy. Having some weird graphics tablet driver problem or something can really kill the creative connection between me and my work, and if I&#x27;m coming down to the wire on a deadline, it can cost me a contract.<p>What about tools that work natively on Linux? They generally just don&#x27;t work for professional design use. Whenever I say that, a billion people always jump in and say &quot;Gimp and VivaDesigner and Natron and XYZ and PDQ&quot; work fine for me,&quot; and to my astonishment, they always seem surprised that the same just isn&#x27;t true in most (any?) professional workflows. Sure, with varying amounts (usually non-trivial) of extra effort I can cobble together a disparate set of tools that might sometimes yield similar results to professional design programs, but it&#x27;s going to take significantly more work to produce possibly lower-quality results, and that&#x27;s just not an option for a pro. If you were hiring someone to craft the image of your company in a crowded, competitive marketplace, would you pay them more to take longer and potentially end up with a suboptimal product just because they were only using OSS to do it?<p>A software developer could feasibly use something like windows notepad or pine to achieve the same results as an IDE, or even a more powerful text editor like SublimeText. For many non-professionals, people just editing a config file, or people making the occasional shell script, it does work fine. Better even, considering that the extra baggage of complex tools would actually slow them down rather than speed them up.
评论 #25099232 未加载
评论 #25099196 未加载
评论 #25098640 未加载
评论 #25098977 未加载
评论 #25101408 未加载
评论 #25102846 未加载
评论 #25099570 未加载
qz2over 4 years ago
This whole release cycle is just one gigantic facepalm after another.<p>I am feeling pretty heavily smug that I got rid of my Apple kit earlier this year because I wasn&#x27;t happy with the direction of the platform.
评论 #25098979 未加载
评论 #25096870 未加载
kyproover 4 years ago
This seems so negligent it&#x27;s difficult for me to believe this was a mistake. Perhaps it could be argued that Apple doesn&#x27;t want applications blocking the network traffic of trusted applications because there is limited upside to doing so and doing so may restrict core functionality such as system updates, etc. But surely the most reasonable explanation here is that Apple wants a back door to guarantee they can monitor your activity &#x2F; allow intelligence agencies a way to access to your system?
评论 #25097171 未加载
评论 #25098007 未加载
评论 #25097366 未加载
phreackover 4 years ago
I&#x27;m done with Apple. It&#x27;s incredibly restrictive for no real gain at this point. I have a really old MB Air I only ever use to compile apps for the App Store for clients, but otherwise there&#x27;s no clear path towards improvement from them, so I&#x27;m voting with my wallet for the foreseeable future.
userbinatorover 4 years ago
This reminds me of the old saying that it&#x27;s impossible to work within an infected system to clean it --- and now that corporations have been &quot;infecting&quot; systems with such telemetry&#x2F;spyware by default, that&#x27;s even more true.<p>I believe Win10 was the first to do something like this --- it ignores the hosts files and firewall for certain hardcoded domain names and IPs.
评论 #25097047 未加载
评论 #25098363 未加载
评论 #25097927 未加载
chimenover 4 years ago
<a href="https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;y0NPJ2o" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;a&#x2F;y0NPJ2o</a> - DNS activity of my Mac PRO + Big Sur during the last 30 mins. This is a filter on `<i></i><i>apple</i><i></i>` domain so I&#x27;m not sure if I&#x27;m seeing everything since they might use other domains but heh - for the curious.
评论 #25098907 未加载
mortenjorckover 4 years ago
I hope this proof-of-concept is the last straw that gets Apple to walk this design decision back. Because if it doesn’t, I&#x27;m not looking forward to whatever it is that does.
评论 #25097516 未加载
Zachpocalypseover 4 years ago
I commented on your Twitter post already, but I&#x27;ll reiterate here. This is not a vulnerability, it is as intended. By default, you can only install Applications via the App Store on Big Sur, and AppProxyProvider only affects Applications installed via this method.<p>This has the dual-benefit of protecting casual users, and allowing power-users flexibility with any binaries that aren&#x27;t sandboxed. From what I understand of your example, you used the bundled python installation to make the connection, the python binary is not sandboxed and is not affected by AppProxyProvider. This will be the case with any other binaries as well -- ping, ssh, etc...<p>The relevant documentation is at: <a href="https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;networkextension&#x2F;app_proxy_provider" rel="nofollow">https:&#x2F;&#x2F;developer.apple.com&#x2F;documentation&#x2F;networkextension&#x2F;a...</a><p>Specifically the section I&#x27;ve highlighted here: <a href="https:&#x2F;&#x2F;share.getcloudapp.com&#x2F;Z4uyONmJ" rel="nofollow">https:&#x2F;&#x2F;share.getcloudapp.com&#x2F;Z4uyONmJ</a>
评论 #25098944 未加载
haunterover 4 years ago
&quot;If Microsoft had done something like this circa 1999, it would have been used as evidence in the antitrust suit.&quot;
评论 #25097059 未加载
评论 #25098803 未加载
评论 #25097056 未加载
dexter0over 4 years ago
It&#x27;s not clear from the tweet and video: How is his exfiltrator piggybacking on an excluded Apple process? Is nsurlsessiond in the exclude list?
评论 #25096798 未加载
评论 #25096765 未加载
sschuellerover 4 years ago
You play with fire you will get burned.<p>Same thing will happen with an encryption backdoor like the EU is now thinking of forcing down our throats...
评论 #25097899 未加载
评论 #25103654 未加载
chrismarlow9over 4 years ago
I have no idea how they ever expected this to work. Seems it would be trivial to proxy a c&amp;c through apps with access. All you need is a signal, any signal, to the outside world. If air gaps can be beat, this concept was doomed from the start, unless I&#x27;m missing something.
systemvoltageover 4 years ago
This is a deal breaker for me. Little Snitch is absolutely 100% essential for privacy. I’m staying on MacOS Catalina until they pry it off my cold dead hands.
评论 #25099347 未加载
评论 #25098546 未加载
评论 #25100389 未加载
bangonkeyboardover 4 years ago
&quot;You can’t have a back door in the software because you can’t have a back door that’s only for the good guys.&quot; — Tim Cook
评论 #25097255 未加载
评论 #25101515 未加载
DoctorNickover 4 years ago
Well, this basically confirms my decision to not purchase a macbook for my next laptop.
评论 #25097161 未加载
评论 #25097090 未加载
xystover 4 years ago
For a company that boasts privacy, it sure leaves a lot of holes in it&#x27;s OS for malicious people to exploit.<p>Guess I won&#x27;t be upgrading from Catalina for a long time.
评论 #25104304 未加载
Aeolunover 4 years ago
Sweet. It is almost as if nobody could see this coming from a mile away.<p>I wonder why they still thought it was a great idea to go ahead.
评论 #25099219 未加载
评论 #25096832 未加载
woj-tekover 4 years ago
Apart from security implications I can see multiple privacy issues here. Apple&#x27;s services may attempt connections to non-Apple resources as well as Apple&#x27;s. My understanding is that trustd (Trust Daemon) will be allowed to report&#x2F;validate (OCSP? CT?) certificates anywhere issuer points it to, and that nsurlsessiond (NSURLSession Daemon) will be allowed to attempt any connections other Apple processes will tell it to. From what I observed, opening a single podcast in Podcasts.app sometimes results in nsurlsessiond connecting to resources under multiple different domains.<p>My pessimistic view of today&#x27;s techworld tells me to follow the money on this and that I might not be able to block in-system ads in some future.
stefan_over 4 years ago
Of course when this possibility was raised 25 days ago on HN [1] there was a swarm of apologists who figured the superior Apple services needed no firewall interception (and just 2 days ago we learned that hell yes, they do!) and that this was all by design and impervious to abuse by other apps.<p>Turns out, no, macOS is still written by the same old skeleton crew at Apple and they still introduce trivial problems in most things they do.<p>1: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24839086" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24839086</a>
评论 #25097396 未加载
评论 #25097926 未加载
评论 #25097726 未加载
mmastracover 4 years ago
I could really use a &quot;special edition&quot; of MacOS - sort of like what happened with XP in the later days. Strip out all the Apple stuff, privacy failures, and excessive gatekeeping [$] and just leave the raw OS.<p>[$] for me
评论 #25098526 未加载
评论 #25098609 未加载
josephcsibleover 4 years ago
Discussion about when this originally surfaced, but was thought to only affect Apple apps: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24838816" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=24838816</a>
评论 #25096522 未加载
评论 #25096686 未加载
pramover 4 years ago
Has anyone tested if disabling the &#x27;Automatically allow built-in software to receive incoming connections&#x27; setting in the Firewall config changes this behavior? Seems like it might be attached to that static list of whitelisted processes.
darthrupertover 4 years ago
Reading news about Apple on this board feels like a cult which I&#x27;ve gotten out of.
lostmsuover 4 years ago
Very interesting, but what is it with posting important information that begs for at least some details as a short thread on Twitter?<p>This is impossible to read on a phone.
raverbashingover 4 years ago
As opposed to the OCSP thing, bypassing firewalls and VPNs seem to be really out there, especially the VPN part<p>You have a VPN active - I&#x27;m actually saying go here not there. Because the default connection might be unsafe, limited, etc.<p>Now, since I have to spend money on multiple dongles, etc that might justify me to buy a pi-hole for a home connection. Get around that Apple
评论 #25110523 未加载
nmgover 4 years ago
<a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201114215739&#x2F;https:&#x2F;&#x2F;twitter.com&#x2F;patrickwardle&#x2F;status&#x2F;1327726496203476992" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20201114215739&#x2F;https:&#x2F;&#x2F;twitter.c...</a>
garyrobover 4 years ago
Trying to understand this as someone who is not sophisticated about security issues. It SOUNDS like, if you have a Big Sur machine that runs no software other than Apple&#x27;s and software downloaded from App Store, this isn&#x27;t an issue.<p>The problem is if you install non-App Store software. Most people don&#x27;t need to do that, but of course, the types of users who frequently Hacker News frequently will. So they run the risk of installing, and using, malicious software.<p>I myself do install non-App Store software sometimes. Prior to Big Sur, I could use Little Snitch and be sure I knew what servers it was communicating with. With Big Sur, I can&#x27;t.<p>Does that sum up the problem?
评论 #25103407 未加载
eeccover 4 years ago
Is this what happens when the Cold War spills out of internal tooling?<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22804607" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22804607</a>
bartvkover 4 years ago
Unpopular opinion follows.<p>Apparently Patrick Wardle describes a security hole, which uses the NetworkExtension framework to make it as if his code is Apple code, and thus ignores the firewall rules. My guess is, that it&#x27;ll get patched and that will be that.<p>If you think about it, blocking OS stuff makes less sense. You&#x27;re already trusting the OS to a great degree.<p>(I can understand the need for most people to control the OS to a great degree, but personally I don&#x27;t feel that need for macOS, which is my workhorse.)
评论 #25099323 未加载
评论 #25099441 未加载
Someoneover 4 years ago
On my system:<p><pre><code> % cd &#x2F;System&#x2F;Library&#x2F;Frameworks&#x2F; % cd NetworkExtension.framework&#x2F; % cd Versions&#x2F;A&#x2F;Resources&#x2F; % ls -l Info.plist -rw-r--r-- 1 root wheel 8.9K Jan 1 2020 Info.plist </code></pre> ⇒ I think this requires root. That, IMO, would make it less of an issue (maybe even a good thing, given the complaints people have about Apple not giving them control over their hardware)
评论 #25099845 未加载
intricatedetailover 4 years ago
Is Big Sur compliant with GDPR? Do they list what they send and why and is it opt in? Or the OS is using a loophole that GDPR only applies to the web? I think people should start sending GDPR complaints to Apple. But even if Apple gets multi billion fine, it won&#x27;t affect them in any way apart from loss of PR points.
hjuutilainenover 4 years ago
Please file new bugs for this even though it has obviously been already reported to Apple. Apple always touts that the more reports it gets for an issue, the more attention it’ll get.
apples_orangesover 4 years ago
I don&#x27;t understand. Can somebody explain what excatly he is doing?
bpshover 4 years ago
Welp, time to block softwareupdated and stick with Catalina for a while
评论 #25100271 未加载
coldteaover 4 years ago
This is &quot;bypassing firewalls in macOS BigSur&quot; by adding an address to the firewall bypass whitelist.<p>I can hack ipf in a similar way, adding an ACCEPT rule...<p>Nothing to see here, move along...
评论 #25099255 未加载