4 ms·

I appreciate and welcome this requirement from Apple. Some time ago I built something I call “Network Blackhole”. The project intercepts HTTP traffic from app

I appreciate and welcome this requirement from Apple. Some time ago I built something I call “Network Blackhole”. The project intercepts HTTP traffic from applications that I installed in either my MacBook or iPhone. An excellent example of this is Crashlytics [1], Segment [2], and Sentry [3], which are among a list of popular web services that many developers use to report bugs and crashes in their software, and the famous Google Analytics, which I hope I don’t need to explain what it is used for. With the help of Little Snitch [4] a popular network monitor for macOS, I detect when an app tries to connect to one of these services, or similar. Then I execute a tool written in Go like so: “blackhole example.com” which does the following: 1. Inserts domain into /etc/hosts 2. Create an HTTP web server (in Go) 3. Adds a match-all endpoint to the server 4. Creates an SSL certificate with mkcert [5] 5. Creates an Nginx virtual-host for the server 6. ??? 7. Profit In the end, and after 1-2 minutes, I have all the traffic to that domain gracefully redirected to a black hole, reducing the amount of data that I leak to 3rd-party websites. However, don’t get me wrong, I understand the purpose of these services, I haven’t said they are evil or anything like that. I would probably use them myself if I had to, but I certainly would add an alert to ask for explicit consent from the user to send this information to a service that I won’t even have control over. If one of them leaks my customer’s data, I will be the only one facing the consequences. I hope I don’t have to add another domain to my network black hole anymore. [1] https://crashlytics.com/ https://crashlytics.com/ [2] https://segment.com/ https://segment.com/ [3] https://sentry.io/ https://sentry.io/ [4] https://help.obdev.at/littlesnitch/ https://help.obdev.at/littlesnitch/ [5] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert

dmacedo 8y ago
You have two links labelled [4], and also didn't share your tool; which was the more interesting content of your comment ;)
- guessmyname 8y ago
  Thank you, I add the missing link. Unfortunately, I cannot share the tool because it contains multiple zero-days for apps that make use of Paddle [1] and Devmate [2] to grant and validate software licenses. It also contains zero-days for apps developed in partnership with Panic [3] and MacPaw [4]. I’ve been in contact with some of the developers of these apps to patch their software, and until they all release security updates I cannot share the code with the world. [1] https://paddle.com/ https://paddle.com/ [2] https://devmate.com/ https://devmate.com/ [3] https://panic.com/ https://panic.com/ [4] https://macpaw.com/ https://macpaw.com/

dmacedo 8y ago

You have two links labelled [4], and also didn't share your tool; which was the more interesting content of your comment ;)

guessmyname 8y ago
Thank you, I add the missing link. Unfortunately, I cannot share the tool because it contains multiple zero-days for apps that make use of Paddle [1] and Devmate [2] to grant and validate software licenses. It also contains zero-days for apps developed in partnership with Panic [3] and MacPaw [4]. I’ve been in contact with some of the developers of these apps to patch their software, and until they all release security updates I cannot share the code with the world. [1] https://paddle.com/ https://paddle.com/ [2] https://devmate.com/ https://devmate.com/ [3] https://panic.com/ https://panic.com/ [4] https://macpaw.com/ https://macpaw.com/