Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

OS X Leopard Firewall Flawed

Posted by kdawson on Tue Oct 30, 2007 02:10 PM
from the block-what-i-say dept.
Security OS X Apple
cycoj writes with a report in the German IT magazine Heise, taking a look at the new OS X Leopard firewall. They find it flawed. When setting access to specific services and programs to only allow SSH access, for example, they found that a manually started service was still accessible. From the article: "So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to 'Set access to specific services and programs,' which promises more control over network traffic. Mac OS X automatically enters all shared resources set up by the user, such as 'Remote login' for SSH servers, into the list of accessible resources... However, initial functional testing quickly dispels any feeling of improved security. A service started for testing purposes was able to be addressed from outside without any difficulty. The firewall records this occurrence... Even with the firewall set to 'Block all incoming connections' ports to netbios, ntp and other services were still open... Specifically these results mean that users can't rely on the firewall."

Related Stories

Firehose:OS X Leopard firewall flawed by cycoj (1010923)
This discussion has been archived. No new comments can be posted.
OS X Leopard Firewall Flawed | Log In/Create an Account | Top | 300 comments | Search Discussion
Display Options Threshold:
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • Leson 1.
    Never Trust Software firewalls. Software firewalls are only should be used in protection against "internet static" attacks. Where just random worms and viruses are trying to get in. Software Firewalls
    Are normally bad against direct attacks from real hackers. Because there are so many ways to trick the user to install software to get around it...

    Lesson 2.
    Never trust anyone to keep security up. Apple, Microsoft, Linux Distributions, even Open BSD they are all made by humans and humans make mistakes and forget to check out things...

    Lesson 3.
    Always keep a hardware firewall even if it is a cheap Linksys Firewall/Router they will double up protection and keep your system relatively safe.

    Lesson 4.
    Never assume that you are 100% safe. There are always ways around things...

  • Investigation flawed, more like (Score:4, Insightful)

    by Space cowboy (13680) * on Tuesday October 30, @02:11PM (#21174981)
    (Last Journal: Friday April 27 2007, @02:20PM)
    From the 'help' button available on the same screen (emphasis mine),

    In addition to the sharing services you turned on in Sharing preferences, the list may include other services, applications, and programs that are allowed to open ports in the firewall. An application or program might have requested and been given access through the firewall, or might be digitally signed by a trusted certificate and therefore allowed access


    IMPORTANT: Some programs have access through the firewall although they don't appear in the list. These might include system applications, services, and processes (for example, those running as "root"). They can also include digitally signed programs that are opened automatically by other programs.

    ... so if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem - if Jo(e)-evil-cracker already has 'root' on the system, the firewall isn't going to help save the system, after all... Perhaps Heise are just used to using Linux, where the firewall trumps all ?

    You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.

    And, FWIW, if I set the firewall to 'Set Access for specific services and applications', then disable SMB sharing, I can't connect using nmblookup. I can only get through when the service has been enabled (which seems reasonable).

    Simon

    • Re:Investigation flawed, more like (Score:5, Insightful)

      by Sloppy (14984) on Tuesday October 30, @02:36PM (#21175359)
      (http://www.biglumber.com/ | Last Journal: Tuesday September 18, @12:25PM)

      so if Leopard trusts the service .. it will have access through the firewall.

      The default configuration represents the situation where the user defers to Leopard's estimation of what can be trusted. If the user starts modifying the configuration, then the question of what Leopard trusts or doesn't trust, should be irrelevant.

      But sure: they documented the bug, thereby causing it to be merely lame design, rather than a bug.

      [ Parent ]

    • Re:Investigation flawed, more like (Score:5, Insightful)

      by kebes (861706) on Tuesday October 30, @02:37PM (#21175383)
      (Last Journal: Monday January 08 2007, @02:45PM)

      if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem
      The problem is that the user asked the OS for a certain action ("block everything") and the OS didn't implement that action. This is basically a case of the OS saying "don't worry, I'm smarter than you and I know what to do"... which isn't a good policy when it comes to security. If a user tries to activate a firewall policy (because they happen to know a certain service is insecure, or not needed, or whatever), then the firewall should implement that policy.

      You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.
      If the situation is indeed as you describe (that the problem here is just that the firewall is allowing certain connections that it "knows" are okay) then you're right: this isn't a security vulnerability, but rather a case of poor UI design. The UI is saying "I'm blocking all connections" even though it isn't. You're also right that in principle the user should educate themselves about their software. However the software should, as much as possible, not misrepresent what's going on. Saying "blocking all connections" and then allowing something to connect is a recipe for security mistakes.
      [ Parent ]
    • Re:Investigation flawed, more like by mcrbids (Score:1) Tuesday October 30, @02:38PM
    • Re:Investigation flawed, more like by ByOhTek (Score:2) Tuesday October 30, @02:47PM
    • Re:Investigation flawed, more like by roystgnr (Score:2) Tuesday October 30, @02:55PM
    • Badly worded ... by Pinky's Brain (Score:1) Tuesday October 30, @03:08PM

    • Don't backpedal too much, or you'll fall over. (Score:4, Insightful)

      by mattgreen (701203) on Tuesday October 30, @03:44PM (#21176295)

      ... so if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem - if Jo(e)-evil-cracker already has 'root' on the system, the firewall isn't going to help save the system, after all... Perhaps Heise are just used to using Linux, where the firewall trumps all ?
      And what happens in the event the trust system is subverted somehow? Either the user accidentally trusts malware, or malware manages to squeeze itself in, what would the user do? The only option they have left is to pull the network connection. At least with a real firewall, a savvy user can lock down their machine and safely investigate further.

      You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.
      I thought the appeal of Apple was that Things Just Work and it is so intuitive you don't have read the documentation? This is a major bug. Don't try to downplay it like its no big deal. Security is always a big deal. I thought we all learned that from the countless Windows worms?
      [ Parent ]
    • Re:Investigation flawed, more like by Schlaefer (Score:1) Tuesday October 30, @03:59PM

    • you could argue that reading the documentation for a new firewall would be a useful thing to do as well.

      Er, yeah, but... these are Mac users you're talking about. The people who've been sold a computer that ordinary people can use without being computer experts, and which doesn't get viruses like Windows does. (Not counting the Linux refugees, of course.)

      [ Parent ]
    • Re:Investigation flawed, more like by eli pabst (Score:2) Tuesday October 30, @09:13PM
    • Re:Investigation flawed, more like by dindae (Score:1) Tuesday October 30, @10:42PM
    • Re:Investigation flawed, more like by Space cowboy (Score:2) Tuesday October 30, @02:27PM
    • I'm not 100% sure on this, but if it uses the same certificate framework that's been present in OS X up until now (which I can't see why it wouldn't, honestly), it will mean having the CA for the signing certificate in as a trusted root. I assume Apple will have its own CA cert in there by default, but there will probably be a way that users can add other certificates as they see fit. I doubt this will be easy to do, because you don't want idiots doing it because it's easy to do and basically trojaning their own systems (e.g. "To install BigBoobsPorn.app, first download xyz.p12, and install it in your X509Anchors keyring..."), but I suspect that there's no technical reason why you can't do this.

      That said, according to what I've read from some people, the security might not even be that rigorous; it might be more about making sure that only the developer of an application can update it automatically (so it's more difficult for an attacker to create an update that 'fixes' your copy of Mail.app or some other approved program to do evil things) than making sure each developer has been vetted by Apple or some other Higher Authority.

      There is a posting from someone who supposedly has access to the Leopard previews over at ThinkMac basically saying this:

      I can't tell you much without (totally) violating my WWDC NDA, but suffice it to say that this is not as bad as you think it is.

      Anyone at all can easily make a new signing identity and use it to sign an application they just compiled.

      The main objective of code signing in Leopard is not the same as for SSL certificates -- it is not to evaluate the trust or confidence of something based on a list of trusted certificate authorities.

      Rather, it is to provide a much better means for users to identify applications. A good example is software updates. Right now, if a user updates your application, and your application asks for an item the user's keychain, the user will get a Keychain warning telling him the application has changed.

      With code signing, the user will get that dialog once the first time he or she runs your application, and if you sign every future versions of that application, the system will not bother the user again, because instead of using for example a hash of the application, it will now be using the code signature.
      (source [thinkmac.co.uk])
      [ Parent ]
    • 4 replies beneath your current threshold.

  • As any new OS (Score:4, Interesting)

    by El Lobo (994537) on Tuesday October 30, @02:12PM (#21174985)
    As any new OS out there, these are childre diseases. Every new system will have problems: small problems and big problesm. The difference is that some will get praise anyway and some others will get "defectivebydesign" or "haha" tags.

  • OS Firewalls (Score:5, Insightful)

    by nurb432 (527695) on Tuesday October 30, @02:13PM (#21174997)
    (http://slashdot.org/~nurb432/ | Last Journal: Friday August 27 2004, @03:24PM)
    Shouldn't be used in the first place. You really need an external dedicated firewall if you want to pretend to be safe.
    • Re:OS Firewalls by pandrijeczko (Score:2) Tuesday October 30, @02:22PM
    • Re:OS Firewalls by msimm (Score:2) Tuesday October 30, @03:05PM

    • Unfortunatly, Apple's apparently company line (based on what I've heard from Apple sales reps) is that you don't need any "3rd party security software". Specifically, I overheard a salesperson speaking to a customer who was buying a notebook computer for his daughter (who was going to college), saying that the customer didn't need to purchase any of that kind of software, because OS X had no security holes. I did restrain myself from taking the salesperson to task for this in front of the whole store - but only because I didn't want to get kicked out of the store - as I hadn't completed my purchase yet. If I'd already gotten my iPod, I would have, as least, brought this to the manager's attention. As it is, it'd been a long day, and I wanted to get my iPod and go, so didn't make a deal about it.

      In retrospect, I should have made a bit of a fuss about it, and were the situation to happen today, especialy with what I learned from TFA, I would certainly have called the salesperson on this (albeit after I'd gotten my iPod - I'd rather not get kicked out of the store before I made my purchase).

      [ Parent ]
    • Re:OS Firewalls by cycoj (Score:1) Tuesday October 30, @03:09PM
    • Re:OS Firewalls by LurkerXXX (Score:3) Tuesday October 30, @06:19PM
    • Re:OS Firewalls by trifish (Score:2) Wednesday October 31, @05:18AM

  • Hm (Score:2, Funny)

    by d3vo1d (607758) on Tuesday October 30, @02:14PM (#21175007)
    I guess we should expect to see 10.5.1 pretty soon.

  • Software firewall (Score:1)

    by GodCandy (1132301) on Tuesday October 30, @02:19PM (#21175089)
    I tend to agree with the fact that software firewalls are more or less a joke. Some I would consider OK for some things such as blocking out the "static" that tends to make its way across any network from time to time. Else the best protection for most users is a simple hardware firewall. It keeps the bad people outside and allows you to do what you need to do with few restrictions. This is however no replacement for good old common sense which seems to get lost in the translation for todays society. Normally if you are surfing slashdot, e-bay, google, yahoo, and other popular sites you wont end up with worms and malware on your computer. If your running a mac you will end up with less. However a mac is not the answer to all the problems. The answer lies with the end user.

    Else I feel that the firewall could probably use some work. I am sure that Apple is already working hard to correct whatever problems they are seeing and will be patching this within the first few weeks. I hate to see a patch that early as it reminds me a lot of a Microsoft release however it has to happen in this case.
  • "It's not much of a firewall, is it?"

    "Finest on this subnet, sir!"

    "And how to you come to that conclusion?"

    "Well, it's so *clean*!"

    "It's certainly uncontaminated by security!"

  • Little Snitch anyone? (Score:5, Informative)

    by solosaint (699000) on Tuesday October 30, @02:27PM (#21175213)
    most powerusers I know use Little Snitch ... its better than the firewall apple includes

  • apple defense force (Score:1, Funny)

    by Anonymous Coward on Tuesday October 30, @02:37PM (#21175375)
    to the rescue!

  • Apple's security model is... (Score:1)

    by throatmonster (147275) on Tuesday October 30, @02:37PM (#21175381)
    Security through obscurity! The saddest part is, way too much (i.e. more than zero) of the stuff I do and deal with use that security model too.
  • Strange nmap picks it up as an IronPort C60. I know they run a BSD variant on those boxes but the dump is that similar.

    PORT STATE SERVICE VERSION
    22/tcp filtered ssh
    80/tcp filtered http
    443/tcp filtered https
    554/tcp filtered rtsp
    1755/tcp filtered wms
    Device type: specialized
    Running: IronPort AsyncOS
    OS details: IronPort C60 email security appliance

  • Anyone tested this? (Score:3, Interesting)

    by commodoresloat (172735) * on Tuesday October 30, @02:43PM (#21175461)
    (http://shockandblog.com/blog)
    This was pointed out on a previous slashdot article and this poster [slashdot.org] claims it is not true.

  • Wait a second... (Score:5, Interesting)

    by CompMD (522020) on Tuesday October 30, @02:58PM (#21175681)
    I thought it was illegal for Germans to do this kind of investigation now. Is it? I mean, it requires "hacking tools."

  • "Software firewall" != "firewall" (Score:1, Informative)

    by Anonymous Coward on Tuesday October 30, @03:00PM (#21175727)
    The firewall maintained by the OS is, at best, a weak packet filtering defense when compared with a stand-alone, in-the-network firewall. The problem is that the on-board firewall is always at the mercy of the OS; anything with sufficient privileges can tamper with it. (Yes, I know of exceptions like FreeBSD's security levels, but that sort of defense is rare on most desktop computers.) A real network firewall
    1. sits inline in the network path
    2. is completely stand-alone, and not directly affected by changes to users' desktop environments
    3. is capable of moderately fine-grained access controls
    4. does not supplant other security measures, e.g., keeping your systems patched, practicing sanitary computing, etc.


    Ideally, a firewall also
    1. can do stateful inspection
    2. has some higher level awareness on the OSI stack (e.g., it can tell something might be amiss if it sees an SSH session being negotiated on 80/tcp and can react accordingly)
    3. can have a management interface that's completely separate from the interfaces on which it applies its rulesets


    Although I loathe analogies, in cars a real firewall sits between the dangerous (engine) and habitable (passenger) compartments, has a few holes poked in it to allow certain things through (throttle controls, wiring, etc.), and hopefully blocks everything else. The counterpart to a "software firewall" in such a case would be a piece of sheet metal between the engine and passenger compartments that spontaneously opened new holes whenever someone turned on the A/C, played a CD, or unfastened their seat belt. That's NOT A FIREWALL!
  • Perhaps I missed something...

    It looks like every test that was ran was run from the local machine. The tester set "block incoming connections" not "block local connections" and/or "block outbound connections"

    If you lsof, you're going to see ports open to localhost, unless the firewall is specifically dropping packets to 127.0.0.1.

    ntpdate is an ntp client tool, so it makes an outbound connection instead of an inbound connection.

    nmblookup actually warns the guy testing this - it realized that 192.168.69.21 was the local interface, so it responded as "localhost" instead of the samba name!

    The nmap test was the only tool that specifically checked a non-localhost IP, and it's not clear to me if it actually checked the localhost interface cleverly or actually sent packets out and through the firewall.

    As I said, perhaps I missed some critical fact. However, I would put more credibility in the tests if the tester had used a 2nd machine on his subnet to nmap the leopard firewall.

  • I am not convinced (Score:5, Informative)

    by avatar4d (192234) <avatar4d AT gmail DOT com> on Tuesday October 30, @03:23PM (#21176061)
    (http://www.5linxcommunications.com/)
    This article is a bit fishy in its interpretation. They don't list their expectations vs the results.. They just make assumptions. For instance:

    Users who want to raise their security level might choose the option "Block all incoming connections" - in the hope that this really will reject all incoming queries to network services.


    Which it appears to do if you look at the quote below. They show a deny in their logs. Seems to work so far.

    The initial tests looked promising. The SSH server activated for testing purposes and the primitive demo backdoor could no longer be accessed from outside. The firewall even blocked access to a test server on a UDP port:

    Oct 29 11:26:49 Qf98e Firewall[44]: Deny nc data in from 193.99.145.XXX:28524 uid = 0 proto=17

    However, a simple port scan was enough to destroy our misplaced optimism:

    # nmap -sU 192.168.69.21
    PORT STATE SERVICE
    123/udp open|filtered ntp
    137/udp open|filtered netbios-ns
    138/udp open|filtered netbios-dgm
    631/udp open|filtered unknown
    5353/udp open|filtered zeroconf
    MAC Address: 00:17:F2:DF:CD:B3 (Apple Computer)


    They are now basing an assumption (or marketing spin) because of output from an Nmap scan. This just indicates a flaw in the signature Nmap has (or the lack thereof) for this particular firewall implementation.

    Then straight from NMAP's documentation:

    "Nmap reports the state combinations open|filtered and closed|filtered when it cannot determine which of the two states describe a port." -(http://insecure.org/nmap/man/ [insecure.org])

    And as for the NTP response being received, well that goes back to what we should expect to see. Apple is about usability. I would suspect that "Block all INCOMING connections" to not refuse information that I request. Basically this just does ingress filtering and not egress.

    I haven't read the entire article yet, but from my brief scan I don't see how this is not a "functioning" firewall.

  • Misleading descriptions (Score:5, Informative)

    by Todd Knarr (15451) on Tuesday October 30, @03:25PM (#21176095)
    (http://www.silverglass.org/)

    I notice in their report that they complain about services Nmap lists as "open/filtered". Nmap reports that result when it encounters a port that elicits no reply whatsoever to a probe. This happens only when a firewall is dropping all traffic to a port and not generating any ICMP error packet for the attempt. The TCP spec says if a port isn't open the client should get an ICMP error, so Nmap knows that there's something there even if access to it's being blocked. If this is any indication of the quality of this "analysis", we can discount the article.

  • A hardware firewall explained (Score:4, Informative)

    by mkiwi (585287) on Tuesday October 30, @03:26PM (#21176097)
    I've read too many posts to ignore this.

    [Rant]

    There is no such thing as a purely hardware firewall in modern times.

    The hardware like a Cisco pix has software (i.e. firmware) running on top of a simple (usually Linux or bsd architecture). A true hardware firewall is John or Jane sitting at a switchboard plugging in and unplugging cables, like way back when telephones first existed. You could also theoretically unplug the networking cable every-so-often to get a firewall-like effect, but the bottom line is that there is something (a brain) that decides what goes in and what goes out. The brain is a bunch of code (software) that is the firewall.

    Hell, create a searing flame capable of burning anyone to death who dare walks through it- that's the literal definition of a firewall. The heat caused by the burning of wood or something else is a "hardware" firewall.

    [/Rant]

  • Why isn't this story also tagged as "haha"? (Score:3, Insightful)

    by PipingSnail (1112161) on Tuesday October 30, @03:44PM (#21176291)

    Why isn't this story also tagged as "haha"?

    If this was a story about a Windows Firewall, as well as defectivebydesign you'd also have the "haha" tag. Do I detect bias?

  • Solution? (Score:2)

    by failedlogic (627314) on Tuesday October 30, @03:56PM (#21176439)
    I'm using Leopard and enabled the firewall and per-application blocking. I find it convienient at its enabled in two or three mouse clicks like the Windows firewall. I'm not a security techie but I understand as far as OS firewalls and there never being a magic bullet that should not ever be the only solution I should use.

    Given that Apple may or likely has a flaw to fix in its Firewall, what solutions are there for additional protection? I'd been using PortSentry (a former Cisco package, now OSS on Sourceforge) on my Tiger system. It compiled, installed and worked on Tiger using GCC but no longer on Leopard. I frankly don't trust Norton and some of the other "firewall" expert 'solutions' companies. I'd like to say I would be willing to learn IPFW firewall rules (I assume Leopard uses this) but the level of technical expertise needed is well beyond my knowledge level. I'm not a techie and learning to implement firewall rules demands expertise and is a fine art in itself - as is computer security.

    So, what other level of security might make up for Leopard's lack of a good firewall? I like using OSS as there is support, its free (can't afford more software) and the code is open for review by community. Suggestions?

  • Firewalls are for wimps! (Score:2, Funny)

    by OptimusPaul (940627) on Tuesday October 30, @04:03PM (#21176527)
    Firewalls are half-assed anyway, why bother with half-assed security, never do it halfway... I say go full-assed and leave all ports open! Take back the internet! Let our data flow! Freedom! DISCLAIMER: I don't know shit about security, as a result I don't keep any sensitive info on my computer.

  • But Macs *just work* (Score:1, Troll)

    by Chas (5144) on Tuesday October 30, @04:17PM (#21176703)
    (http://www.evilnet.net/ | Last Journal: Wednesday August 30 2006, @12:30PM)
    Whether you want them to or not.

  • Apple should switch to PF anyway (Score:2)

    by chrysalis (50680) on Tuesday October 30, @05:29PM (#21177491)
    (http://00f.net/)
    As long as I love OSX, it really sucks as a firewall.

    Why don't they import PF, just like any modern BSD system?

  • severety of impact (Score:1)

    by v1 (525388) on Tuesday October 30, @08:15PM (#21178819)
    (http://vftp.net/ | Last Journal: Saturday December 09 2006, @09:52PM)
    Windows machines traditionally need the firewall to keep the nasties out because of all the open services, the insecure services, and the holes in the network stack. Mac OS X has really none of these. So this is like comparing an unlocked front door on a bank (with a closed vault) with a grocery store with same unlocked front door. Yes, it does lower the security, but amplifying a 1 in a million security problem by a factor of say 10, is not nearly as severe as amplifying a 1 in 100 security hole by 10.

    Still no excuse though. I'm sure we'll see many things fixed in 10.5.1, and unlike the usual suspects, they won't immediately be replaced by another dozen holes found the following morning.
  • My slak life has insulated me from many things. You have fires that will burn macs? Neato.

      Seriously I've never seen the need and I been out here a long time. Turn off what you don't need until you need it and then turn it back off when you done.

  • OS X != Mac OS X (Score:2)

    by Pliep (880962) on Wednesday October 31, @05:16AM (#21181365)
    (http://macwereld.nl/)
    No harisplitting intended, but the title and summary suggest we're talking about OS X (which is the OS for iPhone and iPod touch). Of course we are talking about Mac OS X, which is the operating system used on Macintosh computers.

  • Might also be a flawed analysis... (Score:4, Interesting)

    by CatOne (655161) on Wednesday October 31, @06:18AM (#21181619)
    http://leofud.blogspot.com/ [blogspot.com]

    Specifically that the open|filtered may mean the ports are in a stealth mode... which is what you want!

    I did a port scan of my Leopard machine from a Tiger machine and didn't see any open ports at all. I'm not running the firewall either -- but I don't have any services turned on right now. That's the way OS X ships by default (and has since as least 10.2).

    Not arguing that things couldn't be better communicated by Apple, but I think an article claiming they're taking a Microsoft-esque tact toward security is more than likely politically loaded.

  • Ho hum. (Score:1, Troll)

    by stewbacca (1033764) on Wednesday October 31, @06:28AM (#21181667)
    Call me when there is a serious threat to my Mac. Still don't see any viruses or malware 20+ years on now... With every new Apple product come the lowliest, most insecure, windows-using chumps with lame attempts like this thread to cast a bad light on Apple.

  • ipfw (Score:2)

    by mzs (595629) on Wednesday October 31, @08:19AM (#21182717)
    Does ipfw still work on Leopard? Are there some sort of new rules for per app/service in ipfw? Is there some kind of way to see what the rules really are in the SW firewall and to set them via a shell script?
    • Re:ipfw by Colpa (Score:1) Wednesday October 31, @10:51AM

  • UDP blocking requires separate activation (Score:2, Informative)

    by amoney (1182457) on Wednesday October 31, @02:53PM (#21187863)
    In OS 10.4 Tiger, in order to block UDP traffic, one had to click on the Advanced tab in the Firewall pane and select "block UDP traffic" otherwise the firewall would only block TCP traffic. If you notice in the article, all the open ports are UDP. I don't have a copy of Leopard yet, but given that the author didn't mention anything about the advanced tab I wouldn't be surprised if it's still the same for Leopard and that he didn't make this selection.

    Blocking UDP traffic in 10.4:

    http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh1242.html [apple.com]

  • New Rules for mac security posts (Score:1)

    by DrProton (79239) on Saturday November 03, @12:06AM (#21221539)
    New Rule: Any story trumpeting the latest security hole for OS X must include actual measurement data reporting the number of machines being infected out there on the net. Not hypothetical bullshit from some "security expert" with an axe to grind. Back up your "news" with real data. This is just speculation by heise.de.

    So how many systems have been compromised as a result of this flawed firewall? My guess is zero. Let us know when the number of compromised OS X macs in the wild reaches .01% of the number of compromised windows boxes corralled by botnet herders.
  • to be fair the wifi mess wasnt apples fault, it was a 3rd party driver (netgear?).
    [ Parent ]
    • 1 reply beneath your current threshold.

  • Re:yup (Score:1)

    by d3vo1d (607758) on Tuesday October 30, @02:31PM (#21175291)
    Perhaps you meant 10.5 (Leopard) rather tan 10.4 (Tiger) ?
    [ Parent ]

  • This is on OSX 10.4. I wanted to share an internet connection (internet to eth0, then the airport card serving as a gateway for 2 laptops and an iphone to access the internet). All peachy, but this stupid OS does not let me do it unless I also setup an apache webserver?!?!?!
    What the fuck are you smoking?

    I'm sitting here on my Macbook sharing my 3G connection from my phone over WiFi to a few of my coworkers' laptops, and Apache is certainly not running. Currently I'm on 10.5, but I never had to turn it on with 10.4 either.
    [ Parent ]

  • Re:other quirks with OSX and the services/firewall (Score:1)

    by cpotoso (606303) on Tuesday October 30, @08:23PM (#21178861)

    Huh? Apache? I think this might be a case where you just happened to click it and didn't realize the internet sharing was working. I've never had to enable Apache to share my internet connection.
    In 10.4.11, if you do not enable "personal web sharing" (which enables apache), then you cannot connect to the internet (the gateway is closed). It says so and it is so. I do not know why, but it is...
    [ Parent ]
  • 12 replies beneath your current threshold.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 SourceForge, Inc.