4 ms·

How does one go about creating a little snitch rule to prevent these connections?

by cyberpunk 2y ago

deleted 2y ago
[deleted]
frankjr 2y ago
Paste the following on the All Rules view [link redacted] (Posting a link because HN formatting breaks the format).
- lapcat 2y ago
  That's obsolete. macOS now uses ocsp2.apple.com. The process is "trustd".
  - frankjr 2y ago
    Thanks. Does that depend on macOS version? Better to block both I guess.
    - lapcat 2y ago
      > Does that depend on macOS version? Yes, though I couldn't say offhand when exactly it changed.
    - phi0 2y ago
      I've checked my DNS logs and there hasn't been a single hit against ocsp.apple.com over the last year, but around 20-30 hits for ocsp2.apple.com per day per device. (iphone, macMini, macbook) Just blocking ocsp2.apple.com is probably fine if you're running anything recent-ish.
      - JBiserkov 2y ago
        Block ocsp3.apple.com while you're at it. And ocsp4. And 5. Block them all!
      - Wowfunhappy 2y ago
        Does Little Snitch support regex? Perhaps it should be `ocsp\d*\.apple\.com`
FireBeyond 2y ago
Well, let's not forget the little dance Apple did to make their programs and the system be able to bypass packet filters like Little Snitch... ... and then claim it was necessary for "updates and upgrades". Not sure why TextEdit.app needed a kernel network extension for "updates and upgrades". They also denied it was possible until it was provably demonstrated that they did. I like Apple stuff, everything I use is Apple. But too many see them as infallible or go to the whataboutism for missteps like these.
- flemhans 2y ago
  Oddly enough, UTM VMs also bypass Little Snitch, making me wonder if you could always just bypass LS by running a VM in your evil app.
  - wpm 2y ago
    Will it bypass it regardless of the virtualization engine, or only if you're using the Hypervisor framework for macOS VMs?
    - frankjr 2y ago
      Depends on the network adapter in use. E.g. a bridged adapter will bypass it, an emulated vlan won't.
      - lloeki 2y ago
        Ah that clarifies things, I was confused for a moment. Well, the goal of a bridged net adapter for VMs is to make the VM as if it were physically plugged in directly into the network, independently of the host, so it makes sense for it not to be affected by a firewall. > running a VM in your evil app. IIRC back then, creating a bridged net adapter required a special entitlement (special as in you can't get it without explicitly asking Apple for it and the dev cert for it has additional entries, like for kernel extensions). Dunno if that's still the case.
IndySun 2y ago
related... https://mjtsai.com/blog/2023/04/28/bypassing-little-snitch-with-empty-tcp-packets/ https://mjtsai.com/blog/2023/04/28/bypassing-little-snitch-w...
ProllyInfamous 2y ago
Little Snitch WAS NEVER A GOOD PRODUCT if you're worried about DNS-leaks. Fact: Little Snitch resolves the IP address (i.e. does domain-to-IP lookup) before the Deny/Allow dialogue ever appears onscreen. Only by pressing "Allow" does Little Snitch then allow/initiate connections to the already-resolved IP ADDRESS.
- maeil 2y ago
  Then do you have a suggested alternative?
  - ProllyInfamous 2y ago
    /r/PiHole I run four, locally [50+ users]. Local DNS Server issues default lookup server @x.x.x.2 (e.g. minimal blocklist PageAd, CloudFare), for maximal client compatibility. Users can thereafter upgrade levels of blocking by manually increasing DNS IP +1 (e.g. x.x.x.3 for stricter blocking, whereas default x.2 only blocks seven very common trackers), at host-level. They can also manually enter x.x.x.1 and thereafter have no DNS-restrictions [this is the router itself, which each x.x.x.N itself resolves to, via our ISP's own DNS serverlist]. Our x.x.x.5 is top-notch white-page browsing, but many applications won't work (e.g. banking; although surprisingly Youtube still works although you do have to watch pre-roll ads). I have one user who there-after has his own local subnet/PiHole, although you can hop-up to PiHoles, as long as the subnet is a child or sibling of that DNS-resolver.

How does one go about creating a little snitch rule to prevent these connections?

deleted 2y ago

[deleted]

frankjr 2y ago

Paste the following on the All Rules view [link redacted] (Posting a link because HN formatting breaks the format).

lapcat 2y ago
That's obsolete. macOS now uses ocsp2.apple.com. The process is "trustd".
- frankjr 2y ago
  Thanks. Does that depend on macOS version? Better to block both I guess.
  - lapcat 2y ago
    > Does that depend on macOS version? Yes, though I couldn't say offhand when exactly it changed.
  - phi0 2y ago
    I've checked my DNS logs and there hasn't been a single hit against ocsp.apple.com over the last year, but around 20-30 hits for ocsp2.apple.com per day per device. (iphone, macMini, macbook) Just blocking ocsp2.apple.com is probably fine if you're running anything recent-ish.
    - JBiserkov 2y ago
      Block ocsp3.apple.com while you're at it. And ocsp4. And 5. Block them all!
    - Wowfunhappy 2y ago
      Does Little Snitch support regex? Perhaps it should be `ocsp\d*\.apple\.com`

FireBeyond 2y ago

Well, let's not forget the little dance Apple did to make their programs and the system be able to bypass packet filters like Little Snitch... ... and then claim it was necessary for "updates and upgrades". Not sure why TextEdit.app needed a kernel network extension for "updates and upgrades". They also denied it was possible until it was provably demonstrated that they did. I like Apple stuff, everything I use is Apple. But too many see them as infallible or go to the whataboutism for missteps like these.

flemhans 2y ago
Oddly enough, UTM VMs also bypass Little Snitch, making me wonder if you could always just bypass LS by running a VM in your evil app.
- wpm 2y ago
  Will it bypass it regardless of the virtualization engine, or only if you're using the Hypervisor framework for macOS VMs?
  - frankjr 2y ago
    Depends on the network adapter in use. E.g. a bridged adapter will bypass it, an emulated vlan won't.
    - lloeki 2y ago
      Ah that clarifies things, I was confused for a moment. Well, the goal of a bridged net adapter for VMs is to make the VM as if it were physically plugged in directly into the network, independently of the host, so it makes sense for it not to be affected by a firewall. > running a VM in your evil app. IIRC back then, creating a bridged net adapter required a special entitlement (special as in you can't get it without explicitly asking Apple for it and the dev cert for it has additional entries, like for kernel extensions). Dunno if that's still the case.

IndySun 2y ago

related... https://mjtsai.com/blog/2023/04/28/bypassing-little-snitch-with-empty-tcp-packets/ https://mjtsai.com/blog/2023/04/28/bypassing-little-snitch-w...

ProllyInfamous 2y ago

Little Snitch WAS NEVER A GOOD PRODUCT if you're worried about DNS-leaks. Fact: Little Snitch resolves the IP address (i.e. does domain-to-IP lookup) before the Deny/Allow dialogue ever appears onscreen. Only by pressing "Allow" does Little Snitch then allow/initiate connections to the already-resolved IP ADDRESS.

maeil 2y ago
Then do you have a suggested alternative?
- ProllyInfamous 2y ago
  /r/PiHole I run four, locally [50+ users]. Local DNS Server issues default lookup server @x.x.x.2 (e.g. minimal blocklist PageAd, CloudFare), for maximal client compatibility. Users can thereafter upgrade levels of blocking by manually increasing DNS IP +1 (e.g. x.x.x.3 for stricter blocking, whereas default x.2 only blocks seven very common trackers), at host-level. They can also manually enter x.x.x.1 and thereafter have no DNS-restrictions [this is the router itself, which each x.x.x.N itself resolves to, via our ISP's own DNS serverlist]. Our x.x.x.5 is top-notch white-page browsing, but many applications won't work (e.g. banking; although surprisingly Youtube still works although you do have to watch pre-roll ads). I have one user who there-after has his own local subnet/PiHole, although you can hop-up to PiHoles, as long as the subnet is a child or sibling of that DNS-resolver.