Slashdot Log In
Apple Fixes 'Misleading' Leopard Firewall Settings
Posted by
Zonk
on Thursday November 15, @05:23PM
from the walls-need-to-be-just-a-teensy-bit-thicker dept.
from the walls-need-to-be-just-a-teensy-bit-thicker dept.
4 for 52 writes "ZDNet is reporting that Apple has fessed up to at least three serious design weaknesses in the new application-based firewall that ships with Mac OS X Leopard. The acknowledgment comes less than a month after independent researchers threw cold water on Apple's claim that Leopard's firewall can block all incoming connections. The firewall patches come 24 hours after a Mac OS X update that provided cover for at least 41 security vulnerabilities."
Related Stories
[+]
OS X Leopard Firewall Flawed 300 comments
cycoj writes with a report in the German IT magazine Heise, taking a look at the new OS X Leopard firewall. They find it flawed. When setting access to specific services and programs to only allow SSH access, for example, they found that a manually started service was still accessible. From the article: "So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to 'Set access to specific services and programs,' which promises more control over network traffic. Mac OS X automatically enters all shared resources set up by the user, such as 'Remote login' for SSH servers, into the list of accessible resources... However, initial functional testing quickly dispels any feeling of improved security. A service started for testing purposes was able to be addressed from outside without any difficulty. The firewall records this occurrence... Even with the firewall set to 'Block all incoming connections' ports to netbios, ntp and other services were still open... Specifically these results mean that users can't rely on the firewall."
Firehose:Apple Fixes 'Misleading' Leopard Firewall Settings by Anonymous Coward
Apple Fixes 'Misleading' Leopard Firewall Settings
|
Log In/Create an Account
| Top
| 264 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
As usual, other considerations... (Score:5, Informative)
(http://das.doit.wisc.edu/)
They won't be able to answer that any more than they know what to pick on the Firewall preferences screen.
So what Apple does is a little bit of deciding for the user what makes sense. The first step was going to an intelligent application level firewall that makes it a lot more functional and easier to use. The next was making some policies that allow services Apple considers "essential" to the whole Mac OS X user experience. And like it or not, Bonjour is an integral part of that.
Anyone who knows enough to know, for certain, that they don't want, e.g., Bonjour open, also knows how to use any of a number of free or commercial commandline or graphical options to set up ipfw or other network level protections any way they wish. That's the bottom line: anyone who knows enough to "know" they "really" want to disable all incoming connections can still easily do so.
This is about making security easy for typical, average users, while still keeping things that make the Mac experience "just work".
Now, I *do* wish that Apple had one more option: Block *everything*, but explain, hey, this is going to break some things like Bonjour, etc., so be SURE that you want to do this, and don't complain if all of a sudden your AppleTV syncing and iTunes sharing and automatic local machine discovery no longer work.
Apple describes all of this very explicitly here [apple.com]:
The 10.5.0 Application Firewall blocked all but:
Processes that are running as UID 0
mDNSResponder
The 10.5.1 Application Firewall blocks all but:
configd, which implements DHCP and other network configuration services
mDNSResponder, which implements Bonjour
racoon, which implements IPSec
So, while I haven't extensively tested yet, it does NOT appear to allow UID 0 processes, but rather only the above processes.
And from here [apple.com]:
Based on this, I'd say that several major issues with the Application Firewall have been addressed. Namely, the assertion that "Block all incoming connections" was misleading, and always allowing access to all UID 0 applications, regardless of explicit settings.
And from the comments in the last slashdot article about this, a lot of people weren't upset so much that Apple was making a judgment to still allow things like, e.g., Bonjour, but that "Block all incoming connections" didn't do just that. So they've tightened up the implementation and clarified the user interface. And, "ipfw technology is still accessible [...] and the Application Firewall does not overrule rules set with ipfw; if ipfw blocks an incoming packet, the Application Firewall will not process it."
That, and firewalls that are blocking "everything" often really still aren't blocking everything. They're still allowing back stateless traffic from DNS queries and VPN traffic and things of that nature, often by default. There's a lot more nuance here. And Apple fixing these problems isn't "fessing up" to anything. It's addressing legitimate security concerns that have been brought to their attention in a timely manner. Is that not what we expect and want Apple to be doing?
This summary is laughable: "fessed up"..."threw cold water on"..."provided cover for"..."Apple's claim that Leopard's firewall can block all incoming connections". Come on. It wasn't like Apple tried to make a firewall that could block all incoming connections and failed. They made a firewall that intentionally still allowed some services; essentially "Block all (but essential) incoming connections". And they had some mistakes in implementation. And the other security updates are for 10.4.x.
But instead of pointing out that Apple, for the first time, is also providing [apple.com] security updates for 10.x-2 where 10.x is the current release (Sec Update 2007-008 provides fixes for 10.3.9), I guess it's better to poke fun at Apple for actually fixing security vulnerabilities...
Re:As usual, other considerations... (Score:5, Informative)
(http://das.doit.wisc.edu/)
Re:As usual, other considerations... (Score:5, Insightful)
That's not the product. (Score:4, Insightful)
(http://www.isights.org/)
That's not the product. The product is the analysis and commentary and opinion posted ABOUT the content. Knowing viewpoints and trends can be as valuable as the content itself, if not more so.
What /. does (Score:4, Insightful)
(http://www.lkmc.ch/)
- Filter the news so I don't have to read everything on every site, but can hit one site for all (or most of) the tech stuff that's relevant for me
- Provide a somewhat civil way to discuss the news
I didn't pay, but I also don't block the ads, and I see nothing wrong with paying for it. IfRe:As usual, other considerations... (Score:5, Funny)
(http://sitetheory.com/ | Last Journal: Friday October 24 2003, @10:59AM)
Is there even anything left to say?
Re:As usual, other considerations... (Score:5, Insightful)
But... can anyone here honestly say that if you took the entire story about the 'dodgy' firewall and replaced Apple with Microsoft that there wouldn't be people literally screaming themselves blue in the face about how insecure MS is _by_design_?
Seriously, if an MS-shipped firewall decided (without telling you) that 'block all incoming connections' really meant 'block all incoming connections except for MSN Messenger and oh, I don't know, maybe Media Player', would you be making excuses about how it was really necessary and understandable to deliver the "Microsoft Experience(TM)"?
No, I didn't think so either.
Yes, Apple should be applauded for recognising a problem in their software, as well as a problem in the way their software presents itself, and fixing it.
But they should not be forgiven for creating the problem in the first place because their hearts were in the right place. That kind of thinking leads to bad places.
Re:As usual, other considerations... (Score:4, Informative)
I admit in my original post my words were inaccurate.
I meant something more like "forgive, but don't forget". Also more like I said in my reply to your reply.
Again, apologies for inaccurate and/or argumentative tone.
Re:As usual, other considerations... (Score:5, Funny)
(http://slashdot.org/ | Last Journal: Thursday February 21 2002, @04:37PM)
I was about to quote you and make you eat those words. But you had to go read you post and post a nice apology.
How can I insult you now, and retain the high ground?
Jeez, we get anymore people like you on slashdot it might get all 'reasonable' and 'adult' like.
Re:As usual, other considerations... (Score:4, Insightful)
There is a significant difference between Apple's firewall settings and MS's use of DirectX. Apple changed the way the firewall worked to be application level and sandboxed the services that it let by the firewall. Unfortunately they misleadingly labeled that setting. When users tested it, they became upset. Apple needs to keep customers happy in order to make money, so they changed it to conform to what customers wanted. It is good business and the way the market is supposed to work. Apple wants to make money, so acting out of what could be called avarice, they give users what they want.
Microsoft has monopoly influence in the desktop OS market as well as a few other markets. They included ActiveX partly to motivate sales, but also partly to try to make Web applications tied to their monopoly to lock in customers and help leverage that OS monopoly into a Web monopoly and into the online media and services markets. It makes them a lot of money, even if it brings negative consequences to users. Users don't want to be locked in making migrations and cross-platform tools hard. Users don't gain benefit from MS taking over other markets. Because MS has a monopoly, however, it doesn't matter what users want. Since they don't have to keep users happy, MS has literally no financial motivation to fix the security problems ActiveX creates and they have significant financial motivation to not fix it.
On a very basic level, a monopolist will almost always be worse at innovating and giving users what they want than a company competing in a healthy market. The #1 best way I can think of to fix all of Window's security problems is to break up MS. Split the company into two new companies, forbid them from any non-public communication or collusion, and give both the rights to all the code, copyrights, trademarks, and patents in Windows. Users want security and both will start making real improvements since otherwise the other will be getting the money from consumers. It is my firm belief that until MS's monopoly is broken one way or another, MS will never be able to compete with Apple or Linux when it comes to security. They just aren't motivated.
Re:As usual, other considerations... (Score:5, Insightful)
I disagree that Microsoft doesn't have any financial motivation to fix the problems in ActiveX and their various technologies. Take a look at IE7. Where are all the ActiveX exploits that target IE7? Microsoft has a HUGE installed userbase that depends on IE/IIS and Visual Studio for development. They have a huge incentive to keep that cash cow secure.
From real world experience, I can tell you that Microsoft does just fine with security. I have hands on experience with literally thousands of desktops and hundreds of servers running 2000/XP/2003 and zero security incidents. With good firewalls, security policies, group policies, WSUS, AV, etc. it is possible to secure Microsoft networks. You just have to know what you are doing and stay abreast of the latest developments. It also helps if you use some open source tools like Snort, nmap and the like to keep an eye on what is going on behind the scenes.
The original point of my first post still stands though. As Apple moves forward, they are going to have to face the same challenges that Microsoft faced... balancing the user expectation of an easy to use interface and "it just works" mentality with security needs.
Re:As usual, other considerations... (Score:5, Insightful)
Well, I've been working at a network security company for the last four years and have been reading detailed weekly reports for internal consumption, written by well regarded professionals. What, exactly is your expertise?
Everything has vulnerabilities. Linux and OS X boxes, have fewer, exposed for shorter periods of time, and less regularly exploited, especially in an automated fashion.
You did note that the new version of OS X ships with a MAC ported from SELinux and comes with all the services exposed by default preconfigured to run in sandboxes. And because it is included by default, unlike Linux distros, applications developed from now on can count on it and come preconfigured as well.
No, they're not because default Linux and OS X install have fewer exposed services and fewer known, unfixed vulnerabilities at any given point. Aside from that, most exploits are not directed, but automated and Windows is vastly more exposed to those attacks.
Please. The numbers belie your assertion. The average user, simply buying a Mac significantly reduces their risk of having their machine compromised.
Interested in finding Apple's place? Go to BlackHat, or DefCon, or one of the other big security conferences in the next year. When there, take a quick count of how many Mac laptops you see in use among security experts. It was upwards of 50% at the last one I went to, and it was a private conference for security experts at tier 1 network operators. Why do you suppose that is, because all those security experts are idiots and just not as brilliant as you are?
Re:As usual, other considerations... (Score:4, Insightful)
Umm, people were screaming themselves blue about how Apple's firewall was broken or fundamentally flawed or misleading. There were dozens of articles about it and hundreds of postings in discussion groups.
The difference between Apple and MS (or for that matter Linux developers and MS) is that Apple does not have a monopoly so they actually have to listen to their users and make changes to make them happy. They very quickly made sensible changes to make it clearer how the firewall behaves and addressed pretty much everyone's concerns, even those of people who really didn't know what they were talking about.
Security is a journey not a destination. Security is about trying to allow users to do what they want while stopping things they don't want from happening. There will always be security holes and room for improvement. Concentrating on mistakes made by any vendor is counter productive. So long as the vendor responds and fixes the problem and takes a responsible attitude, they're doing fine by me.
Re:As usual, other considerations... (Score:5, Insightful)
Funny. Technically, I don't need to use the Web at all in coffee shops, so by your argument I should block all traffic. On the other hand, I prefer my computer to be functional, when that functionality does not pose a significant security risk. Guess what, I also have SSH enabled for access, even though I only need to access it occasionally. The service I originally referred to (Bonjour) is unlikely to pose a security risk, especially since in addition to finding an exploit in it, an attacker would have to find an exploit in the Mandatory Access Control sandbox OS X runs it in by default. I'm a lot more likely to be exploited by an attack on my Mail.app than by an attack on Bonjour. Do you also advocate that I do not check my e-mail while at the coffee shop?
Screw that. Half the benefit of Bonjour enabled chatting is that I can easily talk to people I don't have in my "buddy" list while at conferences and coffee shops. Sacrificing function out of unjustified fear is not my cup of tea.
Umm, okay, then don't use it. Good luck finding a capable first party GUI firewall configuration tool on a platform that is not riddled with security holes.
Honestly, it sounds to me like you're looking for something to complain about. I really wish people with your sort of an attitude on security would revisit your basic assumptions. Security is about allowing users to do what they want with a system, and prevent things they don't want from happening, especially without their permission. Reducing functionality just means users turn off security features or move to a system where they have more functionality. If I had a dollar for every time I've seen someone at a LAN party shut off their firewall completely because it was restricting something they wanted to do and was too hard to enable just that application/behavior... well, I'd have enough cash to buy a good steak and some scotch anyway.
Does it move files correctly? (Score:3, Informative)
(Last Journal: Monday November 28 2005, @12:21PM)
Haven't tested, but the notes said yes. (Score:5, Informative)
http://docs.info.apple.com/article.html?artnum=306907 [apple.com]
- Addresses a potential data loss issue when moving files across partitions in the Finder.
Re:Does it move files correctly? (Score:5, Funny)
Macs have one mouse button. Java is slow. You can't run Office on a Mac, so it's useless. Windows machines lock up every 14.5 minutes. Microsoft innovates (tm). An iPod can't play mp3s.
/ Myths are cool
Skype vs. the Leopard firewall! (Score:3, Informative)
(http://www.hylobatidae.org/minerva/)
I had to re-download and install Skype, and now I have to run it with the firewall switched off. Pending a fixed Skype in 'a few weeks' [skype.com]. Aaaargh...
Time Machine doesn't work on my old-fashioned partitioned external hard disk (half is an NTFS partition for Windows backups...), the Leopard installer initially wouldn't detect my MacBook Pro's own hard disk, and my iMac got nearly deaded [apple.com] by the upgrade (fortunately I had SSH enabled, and was able to get in and run Software Update from the command line, and thus could install the important iMac updates). Oh, and it's all a little bit crashy. It's nearly fantastic - apart from those issues...
"macosux" ... ? (Score:5, Funny)
(Last Journal: Tuesday May 29, @09:14PM)
Wow. Our lovely tag trolls have been forced to go all the way back to 1986.
I remember the endless "macs sux" ... "dos sux" ... repeat ad nauseam flamefests on BBSes. Evidently nothing has changed since we were all 8 and had nothing better to do than keep our parents from using the phone.
Seriously, people, if you don't want to hear about Mac OS X, is it really that hard to turn off the Apple stories in your /. preferences?
modes (Score:3, Interesting)
Basic is ideal for most folks, but if you're so inclined just click on the advanced tab and not only have more configuration options but also a through, detailed explanation oh what the firewall is actually doing.
That'd be a great feature.
Slightly Disingenuous Summary (Score:5, Informative)
(http://garethpotter.com/)
Yes, that was an update for Mac OS X 10.4. This patch is for Mac OS X 10.5. The two are essentially unrelated, so trying to imply that this represents some kind of patch frenzy is at least a little disingenuous.
Misleading! (Score:3, Informative)
(Last Journal: Thursday February 21 2002, @09:22AM)
The three issues in the 10.5 firewall were the only security fixes for 10.5.
maybe not (Score:2)
Oxymoron (Score:2, Insightful)
Hopefully you can just turn the bloody thing off.
"Software firewall" is an oxymoron. A firewall is a physical box that sits between two networks, filtering the exchange of information between them.
For those of us who actually have firewalls, having the operating system muck things up with a "software firewall" is just a nuisance. For those who don't, it's a false and dangerous sense of security.
And yet, no problems? (Score:2)
now - i 100% agree that if it says "everything closed" it damn well better be.
But its still comforting to know that despite the legitimate problem - there was not galaxy-wide pandemonium as all the Macs running 10.5 cried out in terror. In fact, there were no problems at all.
In other words - just business as usual on the Mac front.
Now they need to fix the Printing options (Score:2, Interesting)
(http://paulpi3rce.blogspot.com/)
There is an app online that can do this for you, but it seems to only be for native programs (Safari, mail, etc...). Is it just me or should those options be built into the OS.
Everything else on Leopard has been very impressive, most of all it sped my computer up. Everything is faster, which I find very impressive for a new OS (ahem, buy-a-new-computer-4-me Vista).
OT: IPv6 still isn't working for me. (Score:3, Interesting)
(http://honeypot.net/ | Last Journal: Thursday November 15, @11:49AM)
I upgraded from Tiger to Leopard last week and love it, except that I can no longer use IPv6. I've triple-checked my router, address, and prefix length manual settings and they're all correct. I just can't get out of the machine at all:
Even though I have an address and router set up, it doesn't seem to be actually configuring any interfaces to use them. Another machine on the same network has no trouble:
Even our old CRT iMac running Tiger works perfectly. Is anyone else successfully using IPv6 on Leopard? Is there some new gotcha that everyone but me knows about?
But.... (Score:1)
(Last Journal: Tuesday September 05 2006, @02:49AM)
Link to the original article (Score:1)
Really really dumb OS X question here (Score:1)
(http://slashdot.org/)
Are these fixes part of the automatic updates that come down and require an restart? If so how can I see what was added to my system? With Windows Update (at least under XP) I could pick and choose what I wanted, see everything they wanted me to install, but I haven't found that in my Mac.
If I do software update all I ever see to get is a new version of iTunes and Quicktime. So pardon the confusion.
The firewall documentation in 10.5.1 (Score:1)
(http://www.fluffdesign.com/)
Defective by Design Tag?? (Score:2)
(http://www.securityzone.org/)
It seems to be missing the defectivebydesign tag that everyone likes to throw around.
P.S. I'm using OS X right now (not Leopard though).
802.1X still broken (Score:2, Interesting)
(Last Journal: Wednesday November 14, @03:51PM)
X11.app broken with update (Score:1)
huh? (Score:1)
(Last Journal: Sunday November 04, @03:38AM)
Re:Did they really say that? (Score:1, Offtopic)
(http://slashdot.org/ | Last Journal: Thursday February 21 2002, @04:37PM)
Of course, I have read the posts and understand it is a poor description in the gui.
I am still at a loss as to being marked troll. Sometime I may nopt come across the way I intended online, but I can't figure out how that can be interpret as a troll.