3 ms·

I'm confused. Is this a real problem under default OS X settings? Is the OS X GUI misleading me? In my settings in Network -> Advanced -> Proxies, all the litt

I'm confused. Is this a real problem under default OS X settings? Is the OS X GUI misleading me? In my settings in Network -> Advanced -> Proxies, all the little boxes are unchecked. There is an "Automatic Proxy Configuration" line but only when I check it do I see a method to enter the URL to a .pac file. So, as a naive user, when I see everything unchecked I assume that everything is disabled. But perhaps the checkbox only provides a method to supply information that a DHCP server omits? So if the DHCP server does return an URL to a .pac file, will OS X will accept it regardless of the check box?

nmc 10y ago
The "Automatic Proxy Configuration" setting allows you to manually set the URL of the PAC file for automatic configuration. Maybe setting a custom PAC file can override the one sent by the DHCP server. Anyway, unchecking that one will not protect you. However, in the same list, you should see a checkbox labeled "Auto Proxy Discovery". This is the one you want to uncheck so that OS X does not accept the URL sent by the DHCP server.
- PhantomGremlin 10y ago
  you should see a checkbox labeled "Auto Proxy Discovery" In my experience, that box is unchecked by default for a clean installation of El Capitan. So I don't think that OS X is vulnerable (unless that box is explicitly changed by an end user). I just found this Apple KB https://support.apple.com/kb/PH18553?locale=en_US https://support.apple.com/kb/PH18553?locale=en_US that instructs users to select that setting if needed. That seems to confirm that the default is off. The Ars Technica article should have been more nuanced. It strongly implies (IMO) that OS X is vulnerable by default.