5 ms·
Little Snitch (https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html) is excellent.
by frio 11y ago
Little Snitch (https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html) is excellent.
- noondip 11y agoSo excellent that some malware deletes itself if Little Snitch is even installed (https://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_a.shtml https://www.f-secure.com/v-descs/trojan-downloader_osx_flash...). However, it's worth noting "DYLD_PRINT_TO_FILE" is a root exploit, which may circumvent or disable Little Snitch entirely if used by APT; Little Snitch may not see all network activity. In fact, a root exploit allows one to write malware completely hidden from userland altogether (lsof, ps, tcpdump, etc.) (https://github.com/hackedteam/driver-macos https://github.com/hackedteam/driver-macos). It is truly scary how vulnerable OS X is at the moment.
- rosser 11y agoAs a Little Snitch user, I'm inclined to agree, but I find that I sometimes end up in a state of "WTF wants to use the network now?!" saturation. My solution for that is to deny anything I don't recognize, and create rules for things I see more than twice, but if you're conditioned to click "OK" on everything you see, Little Snitch isn't going to to much for you...
- danudey 11y agoI really wish Little Snitch could generate aggregate rules for apps. I keep having situations where an app starts making requests over and over until I realize that the developer is using https requests to cdn###.somehost.com where ### is apparently a dozen or more different hosts, and the only option I have is to just allow all https traffic rather than more granular by-host rules.
- reubenmorais 11y agoAlthough be aware that it can be quite daunting for a novice user. If you're installing for a friend or family member, you should go through all of this apps to whitelist requests and maybe teach them how to identify bad requests, but it's non-trivial. The UI doesn't interact very well with CDNs, for example, sometimes telling you that "App Store" is trying to access "arstechnica.com" because they use the same CDN provider.
- 616c 11y agoOur old infosec guy at work used the icefloor PF management tool at work. It seemed interesting, and I mention it in the vein of the venerable Little Snitch. http://www.hanynet.com/icefloor/ http://www.hanynet.com/icefloor/
- joeyspn 11y agoI've used both, they're a good start, but any sophisticated rootkit will be able to work under the hood and these tools won't detect it. Also some malware functionality can be injected into legit processes that make use of the network and appear invisible to these filters eyes. http://www.arbingersys.com/osx-injection-override-tutorial-hello-world/ http://www.arbingersys.com/osx-injection-override-tutorial-h... If you really want to monitor what's going in&out of your computer you'll need to use wireshark from other computer in your network... =)
- heywire 11y agoDoes anyone know of anything like Little Snitch or ZoneAlarm for Linux? I miss the program-level firewall capabilities of these programs when I'm on Linux.
- arca_vorago 11y agoDoes anyone know of a FOSS tool similar to littlesnitch?
- flyryan 11y agoPatrick Wardle dropped two Little Snitch bypasses at BlackHat [1] this year. [1] https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-W... [PDF Warning]