8 ms·

How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.

by et15 8y ago

xori 8y ago
I was about to say, this would be the greatest social hack to get paranoid people to uncover their cameras only to use this very application to spy on them.
lucideer 8y ago
I got MicroSnitch as part of a bundle with LittleSnitch, without really knowing what it was at the time. When I figured it out, I had the same thought as you. It's definitely not something I'd ever trust completely, not only could it be spying on you, but I also don't really trust my hardware. However, I must say, it's still very nice to have. It at least narrows the possible spying vectors, and it's nice to know immediately what apps are listening; the best example being Android Studio emulator: always listening.
- brennebeck 8y ago
  Wouldn’t LittleSnitch be ideal in this situation to assist in checking if MicroSnitch is phoning home?
  - w1nst0nsm1th 8y ago
    Who knows if LittleSnitch is not a "social hack" by itself ?
    - djsumdog 8y ago
      I think there was a talk on breaking LittleSnitch at either Defcon or B-sides a few years back. I couldn't get in though; it was full. Whatever it was is probably fixed by now anyway.
      - imdsm 8y ago
        IIRC, that issue was patched. https://www.theregister.co.uk/2016/08/03/mac_firewall_littlesnitch/ https://www.theregister.co.uk/2016/08/03/mac_firewall_little...
    - brennebeck 8y ago
      Interesting thought. I would assume some audits have been done via blackbox testing of some sort (e.g. hardware monitor, routing all traffic through a proxy and logging it, etc.) by some infosec group/Co, but I also haven’t researched that.
  - lucideer 8y ago
    LittleSnitch does tell you when LittleSnitch and MicroSwitch phone home (auto-update checks only as far as I've seen), but they're the same developers so theoretically if one could fake one, one could fake both: they could be tightly coupled. So you have to implicitly trust the ObDev guys, and you have to implicitly trust the hardware, but beyond those two assumptions they function great for any other threat models. Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much.
    - brennebeck 8y ago
      Agreed. I replied in a sibling[0], which I think is relevant here. It seems I should definitely queue looking into what testing has been publicly done, etc. and collate that. >Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much Yup; definitely true. [0]: https://news.ycombinator.com/item?id=18201533 https://news.ycombinator.com/item?id=18201533
xoa 8y ago
>How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally blackbox anything: stick it on a virgin test box and monitor all I/O in a controlled setting (VM could work too, though if you're super paranoid you might take into account that can be detected and runtime behavior modified). I guess you could start disassembling it and poking around its memory and such too if you wanted. But seriously, it's a Mac product, so source access everywhere should kind of obviously be off your list already. How do you know when Apple spies on you? You won't find the source code. And the answer is you blackbox it and mostly you trust that it'd get noticed at some point and Apple would get the crap sued out of them and be investigated by governments worldwide etc etc. Objective Development is a very long standing dev and has put out a far more critical long standing security product that has been used by a lot of sec people for a very long time. Sure they could be compromised in the same way any dev could, but on the lowest critical factor level they're unlikely to be the biggest risk in most users' threat model.
- mr_overalls 8y ago
  Your healthy paranoia reminds me of a classic talk on the matter, Ken Thompson's 1984 Turing Award speech "Reflections on Trusting Trust." https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
  - paulgerhardt 8y ago
    The “Trusting Trust” argument comes up a lot as the final counter in this line of reasoning. It’s not and work continues. Do check out David Wheeler’s 2009 thesis on Double Diverse Compiling for instance: https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
- deleted 8y ago
  [deleted]
newsbinator 8y ago
How do you know when MacOS spies on you? (or your microwave, for that matter) At some level in the chain you put your trust in an authority. Ideally the kind of authority who has more to lose than to gain from spying on their users.

How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.

by et15 8y ago

How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere.

xori 8y ago

I was about to say, this would be the greatest social hack to get paranoid people to uncover their cameras only to use this very application to spy on them.

lucideer 8y ago

I got MicroSnitch as part of a bundle with LittleSnitch, without really knowing what it was at the time. When I figured it out, I had the same thought as you. It's definitely not something I'd ever trust completely, not only could it be spying on you, but I also don't really trust my hardware. However, I must say, it's still very nice to have. It at least narrows the possible spying vectors, and it's nice to know immediately what apps are listening; the best example being Android Studio emulator: always listening.

brennebeck 8y ago
Wouldn’t LittleSnitch be ideal in this situation to assist in checking if MicroSnitch is phoning home?
- w1nst0nsm1th 8y ago
  Who knows if LittleSnitch is not a "social hack" by itself ?
  - djsumdog 8y ago
    I think there was a talk on breaking LittleSnitch at either Defcon or B-sides a few years back. I couldn't get in though; it was full. Whatever it was is probably fixed by now anyway.
    - imdsm 8y ago
      IIRC, that issue was patched. https://www.theregister.co.uk/2016/08/03/mac_firewall_littlesnitch/ https://www.theregister.co.uk/2016/08/03/mac_firewall_little...
  - brennebeck 8y ago
    Interesting thought. I would assume some audits have been done via blackbox testing of some sort (e.g. hardware monitor, routing all traffic through a proxy and logging it, etc.) by some infosec group/Co, but I also haven’t researched that.
- lucideer 8y ago
  LittleSnitch does tell you when LittleSnitch and MicroSwitch phone home (auto-update checks only as far as I've seen), but they're the same developers so theoretically if one could fake one, one could fake both: they could be tightly coupled. So you have to implicitly trust the ObDev guys, and you have to implicitly trust the hardware, but beyond those two assumptions they function great for any other threat models. Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much.
  - brennebeck 8y ago
    Agreed. I replied in a sibling[0], which I think is relevant here. It seems I should definitely queue looking into what testing has been publicly done, etc. and collate that. >Would still be nice if they were both open source but hey: I use the open source vscode and it phones home uncontrollably all the time, so source code only benefits us so much Yup; definitely true. [0]: https://news.ycombinator.com/item?id=18201533 https://news.ycombinator.com/item?id=18201533

xoa 8y ago

>How do you know when Micro Snitch spies on you? I couldn't find the source code anywhere. Source code isn't really necessary. Nor sufficient for that matter even if it was there, you'd need verifiable builds and an assurance of no self updating capability too, basically for certain minimal products you need some level of trust. As far as extra verifying though you'd probably start the same way you would minimally blackbox anything: stick it on a virgin test box and monitor all I/O in a controlled setting (VM could work too, though if you're super paranoid you might take into account that can be detected and runtime behavior modified). I guess you could start disassembling it and poking around its memory and such too if you wanted. But seriously, it's a Mac product, so source access everywhere should kind of obviously be off your list already. How do you know when Apple spies on you? You won't find the source code. And the answer is you blackbox it and mostly you trust that it'd get noticed at some point and Apple would get the crap sued out of them and be investigated by governments worldwide etc etc. Objective Development is a very long standing dev and has put out a far more critical long standing security product that has been used by a lot of sec people for a very long time. Sure they could be compromised in the same way any dev could, but on the lowest critical factor level they're unlikely to be the biggest risk in most users' threat model.

mr_overalls 8y ago
Your healthy paranoia reminds me of a classic talk on the matter, Ken Thompson's 1984 Turing Award speech "Reflections on Trusting Trust." https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...
- paulgerhardt 8y ago
  The “Trusting Trust” argument comes up a lot as the final counter in this line of reasoning. It’s not and work continues. Do check out David Wheeler’s 2009 thesis on Double Diverse Compiling for instance: https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/
deleted 8y ago
[deleted]

newsbinator 8y ago

How do you know when MacOS spies on you? (or your microwave, for that matter) At some level in the chain you put your trust in an authority. Ideally the kind of authority who has more to lose than to gain from spying on their users.