5 ms·

Surely it would be easier to simply disable internet access until the user enables it. Bonus points if you can control what it talks to at the IP stack and DNS

Surely it would be easier to simply disable internet access until the user enables it. Bonus points if you can control what it talks to at the IP stack and DNS level. Something i've wanted for decades at this point.... yea, little snitch does this, but it's not built in and belongs on my phone as well. Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior.

greggsy 3y ago
I recently attempted to trace exactly which app is making a particular DNS SOA query. I can confidently say that there are very few applications in the *nix space that do proper DNS reporting at all, and Little Snitch seems to be the only one that would map the actual app. I found no working solution to match a query to a pid in Linux. This tells me that either people rarely need to do this, or that it’s very hard to do in userland.
mschuster91 3y ago
> Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior. Depends on the threat model. Yes, protecting browser data does not help if the attacker gained entry into the system by exploiting a vulnerability in the browser. But it helps against all other entry points: USB sticks laced with malware (common threat against companies), malware that came as part of an email attachment or by dodgy warez, an attacker that's already in the network (either because they're laterally moving or because the victim is in a scenario like a public wifi) and exploits some vulnerability in network-enabled software... Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion.
- diogenes4 3y ago
  > Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion. Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. What about ads? Tracking? Apps sending fingerprinting home? That seems like a more obvious place to start.
  - duskwuff 3y ago
    > Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???
    - diogenes4 3y ago
      Yes
  - mschuster91 3y ago
    > Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network. And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers. > What about ads? Tracking? Apps sending fingerprinting home? That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.
    - diogenes4 3y ago
      I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)
judge2020 3y ago
Disabling internet access only prevents exfiltration. Ransomware, for instance, wouldn't need to access the internet at all if it used hard-coded public keys to encrypt content.
- diogenes4 3y ago
  Presumably exfiltration would work for most people, no? It is quite unusual to have physical access to a computer, and if you do generally all bets are off.
  - judge2020 3y ago
    This is just the hypothetical situation where ransomware is a static binary that doesn't care about any data exfiltration - it just encrypts files in-place with a pre-defined public key. So no exfiltration, physical or over the internet, is required.
    - diogenes4 3y ago
      Ah, i see your point.

greggsy 3y ago

I recently attempted to trace exactly which app is making a particular DNS SOA query. I can confidently say that there are very few applications in the *nix space that do proper DNS reporting at all, and Little Snitch seems to be the only one that would map the actual app. I found no working solution to match a query to a pid in Linux. This tells me that either people rarely need to do this, or that it’s very hard to do in userland.

mschuster91 3y ago

> Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior. Depends on the threat model. Yes, protecting browser data does not help if the attacker gained entry into the system by exploiting a vulnerability in the browser. But it helps against all other entry points: USB sticks laced with malware (common threat against companies), malware that came as part of an email attachment or by dodgy warez, an attacker that's already in the network (either because they're laterally moving or because the victim is in a scenario like a public wifi) and exploits some vulnerability in network-enabled software... Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion.

diogenes4 3y ago
> Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion. Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. What about ads? Tracking? Apps sending fingerprinting home? That seems like a more obvious place to start.
- duskwuff 3y ago
  > Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Malware exfiltrating users' browser sessions and passwords is a "very arbitrary threat model" that "doesn't seem to affect people"???
  - diogenes4 3y ago
    Yes
- mschuster91 3y ago
  > Sure, but this is a very arbitrary threat model to prioritize that doesn't seem to affect people. Credential stealer malware is abundant, it's often enough how attackers gain initial access to a company's internal network - grab the credentials off of Chrome, Firefox or one of the other popular password manager apps, and you're bound to find a set of credentials there. Now all you need is some piece of software that's reachable from the Internet and lacks 2FA (which applies to a shocking lot of legacy software), and you got some sort of persistent access to the network. And in ye early days of cryptocurrencies, before hardware vaults became the norm among crypto enthusiasts, a fair amount of people got their wallets drained by targeted cookie (=session) stealers. > What about ads? Tracking? Apps sending fingerprinting home? That is bad, but not "someone can drain your bank account or take over your social media accounts to spam" bad.
  - diogenes4 3y ago
    I disagree; i think the proliferation of ads is a type of malware that has far more detrimental effects on society than credit card theft (which, incidentally, wouldn't be a problem if the industry bothered to protect their cards with basic authentication on use, which they refuse to)

judge2020 3y ago

Disabling internet access only prevents exfiltration. Ransomware, for instance, wouldn't need to access the internet at all if it used hard-coded public keys to encrypt content.

diogenes4 3y ago
Presumably exfiltration would work for most people, no? It is quite unusual to have physical access to a computer, and if you do generally all bets are off.
- judge2020 3y ago
  This is just the hypothetical situation where ransomware is a static binary that doesn't care about any data exfiltration - it just encrypts files in-place with a pre-defined public key. So no exfiltration, physical or over the internet, is required.
  - diogenes4 3y ago
    Ah, i see your point.