31 ms·

OS X Yosemite Security and Privacy Guide

262 points by noondip 11y ago

ced 11y ago
That's a long list. Is it commonly believed that out-of-the-box Ubuntu is more secure than OSX?
- rasengan 11y ago
  This isn't exactly an answer to your question, as I do not know what the common belief could be and, as well, without doing serious research through the exploration of blogs, social networks and such to determine what said belief could be, it would be impossible to give a definitive answer. That being said, I don't think Ubuntu is any more or less secure than OS X. This is just a personal opinion.
- jkyle 11y ago
  By default, neither operating system is running any publicly accessible services. By that metric, they're equally "secure" by virtue of not having anything an attacker could attack on first startup. After that, you could look at browser exploits as the most common attack vector. They tend to go back and forth, but all of them get pretty quickly rooted in competitions like Pwn2Own.
geofft 11y ago
Out of curiosity, does the recovery-mode download verify the integrity of the downloaded image (either with HTTPS or with some sort of static signature check)?
- deleted 11y ago
  [deleted]
fredkbloggs 11y ago
Please do not enable "stealth mode" in the ALF. This violates applicable standards, impedes system and network management, and provides no additional security (as anyone with nmap can readily verify). Hosts are required to respond to unicast ICMP echo requests, period [0]. No exceptions. [0] https://tools.ietf.org/html/rfc1122#page-42 https://tools.ietf.org/html/rfc1122#page-42
- gress 11y ago
  Many of the other recommendations on this list are similarly 'conservative'. Basically it's an attempt to reduce surface area as much as possible.
  - simoncion 11y ago
    > Basically it's an attempt to reduce surface area as much as possible. Attempts to reduce surface area that fail to actually achieve their goal and impede the proper functioning of networks the affected system connects to should be avoided whenever possible, no?
- tptacek 11y ago
  "Impeding system and network management" is potentially a real argument (though one most OS X users, whose machines are not rightfully overseen by any network manager, might dismiss). But the appeal to IETF standards that brackets that argument, with it's "period, no exceptions" language, is a bit galling. Who cares? The IETF has made all manner of silly rules in its history. Why isn't this simply one of them?
  - seanhunter 11y ago
    Totally agree. It's fair to realise that there are consequences to deviation from standards, but (like many people) I don't consider the fact that IETF makes something a standard to be a binding requirment on me to do something on my boxes. For one thing, the standard was built for an extremely different internet than the one we have today.
- drdaeman 11y ago
  Or at least re-enable in advance those if you call your ISP and complain about any connectivity issues. You're unlikely to know this, but some engineer will thank you in their mind. (I've used to work at ISP. ICMP echoes towards the customer's machine is a first step in diagnosing what could be wrong - and sometimes it really helps to get an image of what's going on. Sadly, a lot of machines do not respond to those.)
- 11y ago
tetraodonpuffer 11y ago
anybody knowledgeable could comment on the list of disable services and agents? I can't find a good site discussing what each service/agent is and what it is for
natch 11y ago
This looks great. However for a document that is so hyper vigilant about preventing little phone-home-to-Apple behaviors, isn't there some cognitive dissonance in the fact that it recommends installing Google Chrome? What am I missing?
- Karunamon 11y ago
  The fact that, much like Mac OS, all of the phone-home-ness of Chrome can be turned off (regardless of how much doing so might be more of a threat to you)
  - Udo_Schmitz 11y ago
    Really? I got rid of Chrome when I saw Google-stuff constantly connecting to different servers even when Chrome wasn't running. And I was kinda surprised what a bitch it was to uninstall. Google put stuff everywhere :-/
    - pki 11y ago
      Have you try Chromium?
      - dunkelheit 11y ago
        not safe either: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909
        ossreality 11y ago
        holy shit are people still latching onto this? IT WAS A MISTAKE.
        shit_parade 11y ago
        that issue was solved within hours.
        11y ago
danieleggert 11y ago
You're worried about security, but you install homebrew?!?
- billyhoffman 11y ago
  even better, let's just execute the random contents of a URL with a Ruby interpreter. Pretty sure curl's -f will suppress any SSL errors you'd receive as someone MITM's you...
  - noondip 11y ago
    I believe you're confusing the -f argument for -k. If you have a better suggestion for installing Homebrew, please send a pull request.
  - acdha 11y ago
    This is a commonly-repeated cargo-cult security trope: if you're going to run arbitrary code from Homebrew, your risk exposure is no different whether you download the installer and run it as two separate actions or one combined command. The option you're thinking of is -k — -f simply tells curl to fail silently on errors, not ignore them: http://curl.haxx.se/docs/manpage.html#-f http://curl.haxx.se/docs/manpage.html#-f
reledi 11y ago
I expect there to be a lot of criticism in this thread. May I suggest that you direct your energy towards the guide by opening an issue or pull request instead. It's a better medium for discussion and there's a chance the guide will be improved, benefiting everyone.
- axx 11y ago
  Yes please!
waz0wski 11y ago
This guide has some useful tips (enable filevault2, disable mdns advertise), but recommends wholly disabling most of the usable functions of applications like calendar, finder, spotlight, etc in the name of "security", which is futile considering every single security update for OSX addresses tons of userland and kernel remote-code execution or local r00t privilege escalations[1][2][3], as well as the well publicized thunderstrike[4] family of vulnerabilities which allow for osx hw/sw compromise. Every major/minor system update (IE 10.10.x, 10.11) will require these tweaks be reapplied as well. Lets not call using ruby to run curl to install homebrew secure either. Just because homebrew doesn't need sudo doesn't mean it's inherently secure, and the dependency tree of some of the software the guide recommends you install come with their own set of security issues which need to be manually maintained outside of OSX update procedures. I'm typing this from an OSX machine with a few of these tweaks applied already, and I love using it for my desktop OS -- but if you really need to be this paranoid about security, you shouldn't be using OSX. There are several security-or-paranoia oriented linux distros you can run. [1] - https://support.apple.com/en-us/HT205031 https://support.apple.com/en-us/HT205031 [2] - https://support.apple.com/en-us/HT204942 https://support.apple.com/en-us/HT204942 [3] - https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 [4] - https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike & https://trmm.net/Thunderstrike_2 https://trmm.net/Thunderstrike_2
- armitron 11y ago
  100% agree. OSX is not an OS one should be running if one cares about security (but then neither is unhardened Linux). Guides such as these are meaningless at best and can give people the illusion of security or worse, you can't build a fortress on top of shifting foundations.
- grrowl 11y ago
  It's definitely a comprehensive guide, and disabling "phone home" services is the heaviest-hitting bit — but it's not a single large script for a reason, and as the guide mentions you should at least scan the list before blindly disabling agents named "CoreLocationAgent" and "notificationcenterui" and "TMCacheDelete".
newman314 11y ago
Cert removal does not seem to work on El Capitan. Maybe because of rootless?
- gurkendoktor 11y ago
  I'm not on El Capitan, but does disabling them in the GUI work (Trust: Never)? I think that's better than removing them anyway, as it seems to persist across OS upgrades.
gcb0 11y ago
gotta love how it gives out hashes for the OSX install image, and then ignores all that nonsense when installing homebrew with shellcode directly from github.
- noondip 11y ago
  Would you mind explaining why you think that's a contradiction? The "shellcode" is downloaded over SSL from a very popular repository on github. I'm genuinely interested in your alternative approach to securely downloading and installing programs from source, and why you think this way is problematic.
  - sitharus 11y ago
    You should publish the hash of the script, then the user should download it to disk, verify the script and then execute it. The same as would apply to any binary download - if a binary can be compromised so can a shell script. Alternatively you can code review the script before executing it, which is a plus.
    - superuser2 11y ago
      Hashes are useful when software is hosted on third-party mirrors or CDNs. If the software is hosted on the same server as the webpage about it, then anyone in a position to replace the download can and will replace the hash as well.
      - vbezhenar 11y ago
        Better solution is to use signed software packages. Compromising website is more common than compromising developer private keys.
        superuser2 11y ago
        How are you going to trust the public key? HN doesn't seem to like Apple/Microsoft as trust brokers, and absent a trusted CA I don't see how this makes the problem any better.
gok 11y ago
> Don't use Safari. The code is a mess and security vulnerabilities are frequent, but slow to patch. Over the last two years, Safari has had half the vulnerabilities [1] as Chrome [2] or Firefox [3]. Security updates are frequent [4]. As to code being a mess... perhaps there's a particularly offensive part of the WebKit code style guidelines [5] that make them less secure than Blink code style guidelines[6]? [1] http://www.cvedetails.com/product/2935/Apple-Safari.html?vendor_id=49 http://www.cvedetails.com/product/2935/Apple-Safari.html?ven... [2] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v... [3] http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452 http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?... [4] https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222 [5] http://www.webkit.org/coding/coding-style.html http://www.webkit.org/coding/coding-style.html [6] https://www.chromium.org/blink/coding-style https://www.chromium.org/blink/coding-style
- rsy96 11y ago
  Chrome is subject to analysis by much more people than Safari by virtue of its larger market share and cross-platform nature. In addition, Google pays a great deal for security researchers to actively find bugs in Chrome. I would take the higher number of CVEs of Chrome as a positive sign for its security, in that they are preemptively searching and fixing security vulnerabilities.
  - axx 11y ago
    right! Just because there are less known security issues doesn't mean there aren't any.
- pcwalton 11y ago
  Yeah, I find the claim that Safari "is a mess" compared to Chrome extremely unfair (if not just plain insulting to the WebKit contributors), given that Blink and WebKit are so close to each other. The overall architectures of the two engines are incredibly similar, despite having diverged somewhat over time. As an aside, the number of people who are qualified to speak about the "messiness" of rendering engine architecture is incredibly low.
MagerValp 11y ago
Author of AutoDMG here, and since imaging is my day job I was happy to see that the article starts with a solid introduction to deploying OS X. However I'd do a few things differently: * It's best to build the image using a full installer of the latest version of OS X downloaded from the App Store (currently 10.10.5 14F27). Do not build a 10.10 14A389 image and apply the combo update to it as updates are meant to be installed on live systems and occasionally causes headaches. * Avoid including extra packages on the image, it'll only make it a pain to maintain and update. Also many packages are badly written and don't install correctly (see https://github.com/MagerValp/AutoDMG/wiki/Packages-Suitable-for-Deployment https://github.com/MagerValp/AutoDMG/wiki/Packages-Suitable-...). * Rather than installing packages into the image you can include them but install them on first boot, e.g. with Outset: https://github.com/chilcote/outset https://github.com/chilcote/outset * Even better, it's easy to set up Munki for software management, this way you can keep your machines updated too: https://github.com/munki/munki https://github.com/munki/munki * If you build your image with AutoDMG a recovery partition should be included in the image and created automatically when you restore with asr. If for some reason it's missing you can create a package that will create it for you (again using the latest OS X installer): https://github.com/MagerValp/Create-Recovery-Partition-Installer https://github.com/MagerValp/Create-Recovery-Partition-Insta... Now on to reading the rest of the guide... :) Edit: reworded
cmurf 11y ago
"Use of the OS X OpenSSL libraries by apps is strongly discouraged." https://developer.apple.com/library/mac/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/mac/documentation/Securi... OK, so why even include it then?

262 points by noondip 11y ago

ced 11y ago

That's a long list. Is it commonly believed that out-of-the-box Ubuntu is more secure than OSX?

rasengan 11y ago
This isn't exactly an answer to your question, as I do not know what the common belief could be and, as well, without doing serious research through the exploration of blogs, social networks and such to determine what said belief could be, it would be impossible to give a definitive answer. That being said, I don't think Ubuntu is any more or less secure than OS X. This is just a personal opinion.
jkyle 11y ago
By default, neither operating system is running any publicly accessible services. By that metric, they're equally "secure" by virtue of not having anything an attacker could attack on first startup. After that, you could look at browser exploits as the most common attack vector. They tend to go back and forth, but all of them get pretty quickly rooted in competitions like Pwn2Own.

geofft 11y ago

Out of curiosity, does the recovery-mode download verify the integrity of the downloaded image (either with HTTPS or with some sort of static signature check)?

deleted 11y ago
[deleted]

fredkbloggs 11y ago

Please do not enable "stealth mode" in the ALF. This violates applicable standards, impedes system and network management, and provides no additional security (as anyone with nmap can readily verify). Hosts are required to respond to unicast ICMP echo requests, period [0]. No exceptions. [0] https://tools.ietf.org/html/rfc1122#page-42 https://tools.ietf.org/html/rfc1122#page-42

gress 11y ago
Many of the other recommendations on this list are similarly 'conservative'. Basically it's an attempt to reduce surface area as much as possible.
- simoncion 11y ago
  > Basically it's an attempt to reduce surface area as much as possible. Attempts to reduce surface area that fail to actually achieve their goal and impede the proper functioning of networks the affected system connects to should be avoided whenever possible, no?
tptacek 11y ago
"Impeding system and network management" is potentially a real argument (though one most OS X users, whose machines are not rightfully overseen by any network manager, might dismiss). But the appeal to IETF standards that brackets that argument, with it's "period, no exceptions" language, is a bit galling. Who cares? The IETF has made all manner of silly rules in its history. Why isn't this simply one of them?
- seanhunter 11y ago
  Totally agree. It's fair to realise that there are consequences to deviation from standards, but (like many people) I don't consider the fact that IETF makes something a standard to be a binding requirment on me to do something on my boxes. For one thing, the standard was built for an extremely different internet than the one we have today.
drdaeman 11y ago
Or at least re-enable in advance those if you call your ISP and complain about any connectivity issues. You're unlikely to know this, but some engineer will thank you in their mind. (I've used to work at ISP. ICMP echoes towards the customer's machine is a first step in diagnosing what could be wrong - and sometimes it really helps to get an image of what's going on. Sadly, a lot of machines do not respond to those.)
11y ago

tetraodonpuffer 11y ago

anybody knowledgeable could comment on the list of disable services and agents? I can't find a good site discussing what each service/agent is and what it is for

natch 11y ago

This looks great. However for a document that is so hyper vigilant about preventing little phone-home-to-Apple behaviors, isn't there some cognitive dissonance in the fact that it recommends installing Google Chrome? What am I missing?

Karunamon 11y ago
The fact that, much like Mac OS, all of the phone-home-ness of Chrome can be turned off (regardless of how much doing so might be more of a threat to you)
- Udo_Schmitz 11y ago
  Really? I got rid of Chrome when I saw Google-stuff constantly connecting to different servers even when Chrome wasn't running. And I was kinda surprised what a bitch it was to uninstall. Google put stuff everywhere :-/
  - pki 11y ago
    Have you try Chromium?
    - dunkelheit 11y ago
      not safe either: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909
      - ossreality 11y ago
        holy shit are people still latching onto this? IT WAS A MISTAKE.
      - shit_parade 11y ago
        that issue was solved within hours.
      - 11y ago

danieleggert 11y ago

You're worried about security, but you install homebrew?!?

billyhoffman 11y ago
even better, let's just execute the random contents of a URL with a Ruby interpreter. Pretty sure curl's -f will suppress any SSL errors you'd receive as someone MITM's you...
- noondip 11y ago
  I believe you're confusing the -f argument for -k. If you have a better suggestion for installing Homebrew, please send a pull request.
- acdha 11y ago
  This is a commonly-repeated cargo-cult security trope: if you're going to run arbitrary code from Homebrew, your risk exposure is no different whether you download the installer and run it as two separate actions or one combined command. The option you're thinking of is -k — -f simply tells curl to fail silently on errors, not ignore them: http://curl.haxx.se/docs/manpage.html#-f http://curl.haxx.se/docs/manpage.html#-f

reledi 11y ago

I expect there to be a lot of criticism in this thread. May I suggest that you direct your energy towards the guide by opening an issue or pull request instead. It's a better medium for discussion and there's a chance the guide will be improved, benefiting everyone.

axx 11y ago
Yes please!

waz0wski 11y ago

This guide has some useful tips (enable filevault2, disable mdns advertise), but recommends wholly disabling most of the usable functions of applications like calendar, finder, spotlight, etc in the name of "security", which is futile considering every single security update for OSX addresses tons of userland and kernel remote-code execution or local r00t privilege escalations[1][2][3], as well as the well publicized thunderstrike[4] family of vulnerabilities which allow for osx hw/sw compromise. Every major/minor system update (IE 10.10.x, 10.11) will require these tweaks be reapplied as well. Lets not call using ruby to run curl to install homebrew secure either. Just because homebrew doesn't need sudo doesn't mean it's inherently secure, and the dependency tree of some of the software the guide recommends you install come with their own set of security issues which need to be manually maintained outside of OSX update procedures. I'm typing this from an OSX machine with a few of these tweaks applied already, and I love using it for my desktop OS -- but if you really need to be this paranoid about security, you shouldn't be using OSX. There are several security-or-paranoia oriented linux distros you can run. [1] - https://support.apple.com/en-us/HT205031 https://support.apple.com/en-us/HT205031 [2] - https://support.apple.com/en-us/HT204942 https://support.apple.com/en-us/HT204942 [3] - https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 [4] - https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike & https://trmm.net/Thunderstrike_2 https://trmm.net/Thunderstrike_2

armitron 11y ago
100% agree. OSX is not an OS one should be running if one cares about security (but then neither is unhardened Linux). Guides such as these are meaningless at best and can give people the illusion of security or worse, you can't build a fortress on top of shifting foundations.
grrowl 11y ago
It's definitely a comprehensive guide, and disabling "phone home" services is the heaviest-hitting bit — but it's not a single large script for a reason, and as the guide mentions you should at least scan the list before blindly disabling agents named "CoreLocationAgent" and "notificationcenterui" and "TMCacheDelete".

newman314 11y ago

Cert removal does not seem to work on El Capitan. Maybe because of rootless?

gurkendoktor 11y ago
I'm not on El Capitan, but does disabling them in the GUI work (Trust: Never)? I think that's better than removing them anyway, as it seems to persist across OS upgrades.

gcb0 11y ago

gotta love how it gives out hashes for the OSX install image, and then ignores all that nonsense when installing homebrew with shellcode directly from github.

noondip 11y ago
Would you mind explaining why you think that's a contradiction? The "shellcode" is downloaded over SSL from a very popular repository on github. I'm genuinely interested in your alternative approach to securely downloading and installing programs from source, and why you think this way is problematic.
- sitharus 11y ago
  You should publish the hash of the script, then the user should download it to disk, verify the script and then execute it. The same as would apply to any binary download - if a binary can be compromised so can a shell script. Alternatively you can code review the script before executing it, which is a plus.
  - superuser2 11y ago
    Hashes are useful when software is hosted on third-party mirrors or CDNs. If the software is hosted on the same server as the webpage about it, then anyone in a position to replace the download can and will replace the hash as well.
    - vbezhenar 11y ago
      Better solution is to use signed software packages. Compromising website is more common than compromising developer private keys.
      - superuser2 11y ago
        How are you going to trust the public key? HN doesn't seem to like Apple/Microsoft as trust brokers, and absent a trusted CA I don't see how this makes the problem any better.

gok 11y ago

> Don't use Safari. The code is a mess and security vulnerabilities are frequent, but slow to patch. Over the last two years, Safari has had half the vulnerabilities [1] as Chrome [2] or Firefox [3]. Security updates are frequent [4]. As to code being a mess... perhaps there's a particularly offensive part of the WebKit code style guidelines [5] that make them less secure than Blink code style guidelines[6]? [1] http://www.cvedetails.com/product/2935/Apple-Safari.html?vendor_id=49 http://www.cvedetails.com/product/2935/Apple-Safari.html?ven... [2] http://www.cvedetails.com/product/15031/Google-Chrome.html?vendor_id=1224 http://www.cvedetails.com/product/15031/Google-Chrome.html?v... [3] http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452 http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?... [4] https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222 [5] http://www.webkit.org/coding/coding-style.html http://www.webkit.org/coding/coding-style.html [6] https://www.chromium.org/blink/coding-style https://www.chromium.org/blink/coding-style

rsy96 11y ago
Chrome is subject to analysis by much more people than Safari by virtue of its larger market share and cross-platform nature. In addition, Google pays a great deal for security researchers to actively find bugs in Chrome. I would take the higher number of CVEs of Chrome as a positive sign for its security, in that they are preemptively searching and fixing security vulnerabilities.
- axx 11y ago
  right! Just because there are less known security issues doesn't mean there aren't any.
pcwalton 11y ago
Yeah, I find the claim that Safari "is a mess" compared to Chrome extremely unfair (if not just plain insulting to the WebKit contributors), given that Blink and WebKit are so close to each other. The overall architectures of the two engines are incredibly similar, despite having diverged somewhat over time. As an aside, the number of people who are qualified to speak about the "messiness" of rendering engine architecture is incredibly low.

MagerValp 11y ago

Author of AutoDMG here, and since imaging is my day job I was happy to see that the article starts with a solid introduction to deploying OS X. However I'd do a few things differently: * It's best to build the image using a full installer of the latest version of OS X downloaded from the App Store (currently 10.10.5 14F27). Do not build a 10.10 14A389 image and apply the combo update to it as updates are meant to be installed on live systems and occasionally causes headaches. * Avoid including extra packages on the image, it'll only make it a pain to maintain and update. Also many packages are badly written and don't install correctly (see https://github.com/MagerValp/AutoDMG/wiki/Packages-Suitable-for-Deployment https://github.com/MagerValp/AutoDMG/wiki/Packages-Suitable-...). * Rather than installing packages into the image you can include them but install them on first boot, e.g. with Outset: https://github.com/chilcote/outset https://github.com/chilcote/outset * Even better, it's easy to set up Munki for software management, this way you can keep your machines updated too: https://github.com/munki/munki https://github.com/munki/munki * If you build your image with AutoDMG a recovery partition should be included in the image and created automatically when you restore with asr. If for some reason it's missing you can create a package that will create it for you (again using the latest OS X installer): https://github.com/MagerValp/Create-Recovery-Partition-Installer https://github.com/MagerValp/Create-Recovery-Partition-Insta... Now on to reading the rest of the guide... :) Edit: reworded

cmurf 11y ago

"Use of the OS X OpenSSL libraries by apps is strongly discouraged." https://developer.apple.com/library/mac/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html https://developer.apple.com/library/mac/documentation/Securi... OK, so why even include it then?