4 ms·
That is unbelievable. Breaking VPNs is literally a life-or-death situation for many journalists and activists in certain countries; not to mention something tha
by dannyw 6y ago
That is unbelievable. Breaking VPNs is literally a life-or-death situation for many journalists and activists in certain countries; not to mention something that would (justifiably) give network admins a heart attack.
It also increases the attack surface, as malicious programs may find ways to hijack their traffic, or attach their traffic to OS traffic. All you need is an Apple service that relays the information somehow -- for example, a hypothetical Apple service that requests information/metadata from an application specified URL.
- sneak 6y agoThe malicious firewall bypass is already here: https://twitter.com/patrickwardle/status/1327726807089520640 https://twitter.com/patrickwardle/status/1327726807089520640 Believe me, I won’t be using a mac not via an external VPN router ever again. I already needed to take that step for iPad/iPhone and was putting it off. This sort of seals the deal, as all of the devices can use the same wifi device.
- coldtea 6y agoThe 'malicious firewall bypass' is "lemme add a rule to bypass firewall, o gee, now I can bypass the firewall". You can do this with any existing software firewall on any OS, here it just happens on a secondary whitelist (as opposed to the firewall configuration).
- saagarjha 6y agoUh, isn’t the concern that Apple’s services cannot be firewalled?
- coldtea 6y agoYes. And that's a valid concern. The "malicious firewall bypass" (that you can use the same system to add exception for another app) as in the twitter example, though, is not.
- saagarjha 6y agoRight, but isn’t the issue then “I can trick a system service to do the malicious thing for me”? Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections.
- coldtea 6y ago>Apple’s apps are absolutely not secured against being convinced to make arbitrary outbound connections. Aren't they? They're signed, notarized, sandboxed, have ASLR, and other protections, in Big Sur they even recide on a read-only partition iirc...
- sneak 6y agoThere are a million other ways to “convince” them when they are operating normally, which presumably these apps are not explicitly hardened/audited against.
- saagarjha 6y agoI am very familiar with macOS's security features. Preventing an application from having something maliciously command them into sending things on the network is not one of the threat models Apple considers (or at least, they have no specific mitigations against this). As a simple (but conspicuous) example, consider an app simply opening a customized HTTP link if Safari was exempt from the firewall to exfiltrate information. There are hundreds of ways to do effectively the same thing more surreptitiously.
- Someone 6y ago“I can trick a system service to do the malicious thing for me if I have root”, and that’s as designed, and something at least people on HN want (“I want control over what my hardware runs”) If you have root, you can also remove Apple’s exceptions from that list. I haven’t checked, but that should fix the issue of Apple’s services bypassing firewalls.
- sneak 6y agoIf you can do it (without a trip to a recovery boot), then malware or spyware can do it. That’s the point.
- pwinnski 6y agoIt is unbelievable. It also appears to not be true. System-level VPNs apparently continue to work as always. It's the new app-level APIs used by programs like Little Snitch that are bypassed by Apple services. Journalists, activists, and really anyone using something they would rightly consider a VPN, they're fine, because system-level VPNs aren't bypassed.