5 ms·

macOS underlying system is really opaque, is Little Snitch really do block all that there is ?

newaccount74 4y ago
Probably, but we don't know. macOS 11 stopped support for kernel extensions, and now requires firewall apps like Little Snitch to use "Network Extensions". In early versions of macOS 11, some Apple apps bypassed network extensions. This was supposedly fixed in macOS 11.2, but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.
- capableweb 4y ago
  > Probably, but we don't know. Why not? It's not like it'd be hard to know. The submission article even talks about running it in a VM, wouldn't be hard to connect tcpdump to whatever bridge it's using and inspect if Little Snitch can truly capture and block all traffic.
  - newaccount74 4y ago
    Because you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malicious app to circumvent network extensions. If you look for leaks, and don't find any, it doesn't mean there aren't any.
- throw0101c 4y ago
  > […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions. Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire: * https://community.fs.com/blog/port-mirroring-explained-basis-configuration-and-fa-qs.html https://community.fs.com/blog/port-mirroring-explained-basis... * https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html https://www.cisco.com/c/en/us/support/docs/switches/catalyst... * https://en.wikipedia.org/wiki/Port_mirroring https://en.wikipedia.org/wiki/Port_mirroring If it's encrypted we may not know the exact contents, but you can't conceal IPs.
  - codetrotter 4y ago
    Not everyone can afford a managed switch and a second computer to inspect the traffic with. Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with
    - lapcat 4y ago
      > Not everyone can afford a managed switch and a second computer to inspect the traffic with. Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
    - chasd00 4y ago
      It’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.
    - bell-cot 4y ago
      > Not everyone can afford a... For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?
  - newaccount74 4y ago
    While this would allow you to prove the presence of exceptions, it won't prove the absence of exceptions.
dan1234 4y ago
I think Little Snitch does a good job, but it would be easy to see any leaks at the router/hardware firewall if there's a real concern.

Probably, but we don't know. macOS 11 stopped support for kernel extensions, and now requires firewall apps like Little Snitch to use "Network Extensions". In early versions of macOS 11, some Apple apps bypassed network extensions. This was supposedly fixed in macOS 11.2, but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.

capableweb 4y ago
> Probably, but we don't know. Why not? It's not like it'd be hard to know. The submission article even talks about running it in a VM, wouldn't be hard to connect tcpdump to whatever bridge it's using and inspect if Little Snitch can truly capture and block all traffic.
- newaccount74 4y ago
  Because you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malicious app to circumvent network extensions. If you look for leaks, and don't find any, it doesn't mean there aren't any.
throw0101c 4y ago
> […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions. Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire: * https://community.fs.com/blog/port-mirroring-explained-basis-configuration-and-fa-qs.html https://community.fs.com/blog/port-mirroring-explained-basis... * https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html https://www.cisco.com/c/en/us/support/docs/switches/catalyst... * https://en.wikipedia.org/wiki/Port_mirroring https://en.wikipedia.org/wiki/Port_mirroring If it's encrypted we may not know the exact contents, but you can't conceal IPs.
- codetrotter 4y ago
  Not everyone can afford a managed switch and a second computer to inspect the traffic with. Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with
  - lapcat 4y ago
    > Not everyone can afford a managed switch and a second computer to inspect the traffic with. Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
  - chasd00 4y ago
    It’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.
  - bell-cot 4y ago
    > Not everyone can afford a... For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?
- newaccount74 4y ago
  While this would allow you to prove the presence of exceptions, it won't prove the absence of exceptions.

dan1234 4y ago

I think Little Snitch does a good job, but it would be easy to see any leaks at the router/hardware firewall if there's a real concern.