4 ms·

While it's good that they're going to improve Gatekeeper's certificate checks, don't forget the other major issue raised recently: all of Big Sur's system netwo

While it's good that they're going to improve Gatekeeper's certificate checks, don't forget the other major issue raised recently: all of Big Sur's system network traffic is deliberately leaked around VPNs. Will they change course on that issue? Or will you have to carry a raspberry pi around as a hardware firewall if you want to have an actually private network connection? (or alternately, not use a Mac)

dannyw 6y ago
That is unbelievable. Breaking VPNs is literally a life-or-death situation for many journalists and activists in certain countries; not to mention something that would (justifiably) give network admins a heart attack. It also increases the attack surface, as malicious programs may find ways to hijack their traffic, or attach their traffic to OS traffic. All you need is an Apple service that relays the information somehow -- for example, a hypothetical Apple service that requests information/metadata from an application specified URL.
- sneak 6y ago
  The malicious firewall bypass is already here: https://twitter.com/patrickwardle/status/1327726807089520640 https://twitter.com/patrickwardle/status/1327726807089520640 Believe me, I won’t be using a mac not via an external VPN router ever again. I already needed to take that step for iPad/iPhone and was putting it off. This sort of seals the deal, as all of the devices can use the same wifi device.
  - coldtea 6y ago
    The 'malicious firewall bypass' is "lemme add a rule to bypass firewall, o gee, now I can bypass the firewall". You can do this with any existing software firewall on any OS, here it just happens on a secondary whitelist (as opposed to the firewall configuration).
    - saagarjha 6y ago
      Uh, isn’t the concern that Apple’s services cannot be firewalled?
      - coldtea 6y ago
        Yes. And that's a valid concern. The "malicious firewall bypass" (that you can use the same system to add exception for another app) as in the twitter example, though, is not.
        saagarjha 6y ago
        Right, but isn’t the issue then “I can trick a system service to do the malicious thing for me”? Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections.
        coldtea 6y ago
        >Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections. Aren't they? They're signed, notarized, sandboxed, have ASLR, and other protections, in Big Sur they even recide on a read-only partition iirc...
        sneak 6y ago
        There are a million other ways to “convince” them when they are operating normally, which presumably these apps are not explicitly hardened/audited against.
        saagarjha 6y ago
        I am very familiar with macOS's security features. Preventing an application from having something maliciously command them into sending things on the network is not one of the threat models Apple considers (or at least, they have no specific mitigations against this). As a simple (but conspicuous) example, consider an app simply opening a customized HTTP link if Safari was exempt from the firewall to exfiltrate information. There are hundreds of ways to do effectively the same thing more surreptitiously.
- pwinnski 6y ago
  It is unbelievable. It also appears to not be true. System-level VPNs apparently continue to work as always. It's the new app-level APIs used by programs like Little Snitch that are bypassed by Apple services. Journalists, activists, and really anyone using something they would rightly consider a VPN, they're fine, because system-level VPNs aren't bypassed.
judge2020 6y ago
Curious, if there is no internet outside the VPN, does it fallback to sending traffic via the VPN?
wlesieutre 6y ago
Some clarification in another thread here: https://news.ycombinator.com/item?id=25113039 https://news.ycombinator.com/item?id=25113039 The VPN leak is only around per-application VPNs and filters, which is the mechanism used by firewalls like Little Snitch and LuLu. These can not be applied to Apple's apps. System-wide VPNs thankfully don't have the same problem. Can anyone weigh in on why Apple would prevent this? It's not as though redirecting the traffic from Apple's software will let you impersonate Apple (unless you've also been able to load your own fake certificates, in which case the client is already hosed). At worst you can selectively block them, no? And you can do that anyway with a hosts file.

dannyw 6y ago

That is unbelievable. Breaking VPNs is literally a life-or-death situation for many journalists and activists in certain countries; not to mention something that would (justifiably) give network admins a heart attack. It also increases the attack surface, as malicious programs may find ways to hijack their traffic, or attach their traffic to OS traffic. All you need is an Apple service that relays the information somehow -- for example, a hypothetical Apple service that requests information/metadata from an application specified URL.

sneak 6y ago
The malicious firewall bypass is already here: https://twitter.com/patrickwardle/status/1327726807089520640 https://twitter.com/patrickwardle/status/1327726807089520640 Believe me, I won’t be using a mac not via an external VPN router ever again. I already needed to take that step for iPad/iPhone and was putting it off. This sort of seals the deal, as all of the devices can use the same wifi device.
- coldtea 6y ago
  The 'malicious firewall bypass' is "lemme add a rule to bypass firewall, o gee, now I can bypass the firewall". You can do this with any existing software firewall on any OS, here it just happens on a secondary whitelist (as opposed to the firewall configuration).
  - saagarjha 6y ago
    Uh, isn’t the concern that Apple’s services cannot be firewalled?
    - coldtea 6y ago
      Yes. And that's a valid concern. The "malicious firewall bypass" (that you can use the same system to add exception for another app) as in the twitter example, though, is not.
      - saagarjha 6y ago
        Right, but isn’t the issue then “I can trick a system service to do the malicious thing for me”? Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections.
        coldtea 6y ago
        >Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections. Aren't they? They're signed, notarized, sandboxed, have ASLR, and other protections, in Big Sur they even recide on a read-only partition iirc...
        sneak 6y ago
        There are a million other ways to “convince” them when they are operating normally, which presumably these apps are not explicitly hardened/audited against.
        saagarjha 6y ago
        I am very familiar with macOS's security features. Preventing an application from having something maliciously command them into sending things on the network is not one of the threat models Apple considers (or at least, they have no specific mitigations against this). As a simple (but conspicuous) example, consider an app simply opening a customized HTTP link if Safari was exempt from the firewall to exfiltrate information. There are hundreds of ways to do effectively the same thing more surreptitiously.
pwinnski 6y ago
It is unbelievable. It also appears to not be true. System-level VPNs apparently continue to work as always. It's the new app-level APIs used by programs like Little Snitch that are bypassed by Apple services. Journalists, activists, and really anyone using something they would rightly consider a VPN, they're fine, because system-level VPNs aren't bypassed.

judge2020 6y ago

Curious, if there is no internet outside the VPN, does it fallback to sending traffic via the VPN?

wlesieutre 6y ago

Some clarification in another thread here: https://news.ycombinator.com/item?id=25113039 https://news.ycombinator.com/item?id=25113039 The VPN leak is only around per-application VPNs and filters, which is the mechanism used by firewalls like Little Snitch and LuLu. These can not be applied to Apple's apps. System-wide VPNs thankfully don't have the same problem. Can anyone weigh in on why Apple would prevent this? It's not as though redirecting the traffic from Apple's software will let you impersonate Apple (unless you've also been able to load your own fake certificates, in which case the client is already hosed). At worst you can selectively block them, no? And you can do that anyway with a hosts file.