Forgot your password?
typodupeerror
Security Businesses OS X Operating Systems Apple

OS X Leopard Firewall Flawed 300

Posted by kdawson
from the block-what-i-say dept.
cycoj writes with a report in the German IT magazine Heise, taking a look at the new OS X Leopard firewall. They find it flawed. When setting access to specific services and programs to only allow SSH access, for example, they found that a manually started service was still accessible. From the article: "So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to 'Set access to specific services and programs,' which promises more control over network traffic. Mac OS X automatically enters all shared resources set up by the user, such as 'Remote login' for SSH servers, into the list of accessible resources... However, initial functional testing quickly dispels any feeling of improved security. A service started for testing purposes was able to be addressed from outside without any difficulty. The firewall records this occurrence... Even with the firewall set to 'Block all incoming connections' ports to netbios, ntp and other services were still open... Specifically these results mean that users can't rely on the firewall."
This discussion has been archived. No new comments can be posted.

OS X Leopard Firewall Flawed

Comments Filter:
  • by jellomizer (103300) * on Tuesday October 30, 2007 @03:11PM (#21174973)
    Leson 1.
    Never Trust Software firewalls. Software firewalls are only should be used in protection against "internet static" attacks. Where just random worms and viruses are trying to get in. Software Firewalls
    Are normally bad against direct attacks from real hackers. Because there are so many ways to trick the user to install software to get around it...

    Lesson 2.
    Never trust anyone to keep security up. Apple, Microsoft, Linux Distributions, even Open BSD they are all made by humans and humans make mistakes and forget to check out things...

    Lesson 3.
    Always keep a hardware firewall even if it is a cheap Linksys Firewall/Router they will double up protection and keep your system relatively safe.

    Lesson 4.
    Never assume that you are 100% safe. There are always ways around things...
    • by MBCook (132727) <foobarsoft@foobarsoft.com> on Tuesday October 30, 2007 @03:16PM (#21175031) Homepage

      I'll agree with most of that. I've got a Mac, and it's running Leopard (yeah!). At work I surf behind a real firewall, a Watchguard I think. At home, I'm behind my Linksys. I could run no firewall and be OK. That said, I leave it on for one simple reason: I can go to other people's networks without having to think about turning the firewall on. This way if I were to go to Starbucks or something, I'd be much more safe from so guy a few tables over (malicious or just bot-infested). I don't expect things to be perfect. I don't expect a software firewall to be as good as a hardware one. It's just one more layer.

      So what do I think of all this? I don't know. I saw comments somewhere the other day that claimed that these guys were just misunderstanding, but I'm not sure. I expect a firewall to block things if I tell it to though.

      • by RobertM1968 (951074) on Tuesday October 30, 2007 @04:16PM (#21175971) Homepage Journal

        I'll agree with most of that. I've got a Mac, and it's running Leopard (yeah!). At work I surf behind a real firewall, a Watchguard I think. At home, I'm behind my Linksys. I could run no firewall and be OK. That said, I leave it on for one simple reason: I can go to other people's networks without having to think about turning the firewall on. This way if I were to go to Starbucks or something, I'd be much more safe from so guy a few tables over (malicious or just bot-infested). I don't expect things to be perfect. I don't expect a software firewall to be as good as a hardware one. It's just one more layer.

        Regardless, if I am on a network where I dont have control of all the machines on it 24/7, then I think running the machine's OS (or add-on) Firewall is still a must. It really doesnt matter how great a hardware firewall is if someone infects their machine via a CD, DVD, USB Drive, etc from something they bring from their infected home machine or friend's machine or whatever. Since most direct network traffic doesnt (try to) pass through the hardware firewall, one should always be protected from the other machines on their network. For instance, in my office, we have a couple WinXP machines - and though they are not infected, they are constantly broadcasting nonsense trying to find their brethren (to EVERY machine on the network). Our "hardware" firewall does nothing to stop that - even though it does block the traffic from going OFF our network. I block that traffic on my other machines at their firewalls (no need to waste sockets or OS time handling the packets at all). If those XP machines were infected... well, you see the point.

        Having one machine on the network, or a few machines that only you use (with taking precautions not to infect them from an external source), then yeah, a hardware firewall is probably all you need.

    • Re: (Score:2, Offtopic)

      by ScytheBlade1 (772156)
      I trust my linux based software firewall a lot more than I trust a Linksys router doing NAT.
      • by toleraen (831634) on Tuesday October 30, 2007 @03:41PM (#21175425)
        My Linksys router runs a Linux based software firewall.
        • what router do you have? and can you run something full-featured like LEAF? I am looking into retiring my ancient (P133) linux router/fw for something more energy efficient and quiet and if there was something I could flash LEAF on it would be the perfect thing...
          • Re: (Score:3, Informative)

            by toleraen (831634)
            I had been using a WRT54G, but I retired it for Buffalo WHR-HP-54G. I've been using DD-WRT [dd-wrt.com] on both of them, and it's been pretty solid. V24 is looking to be a pretty good release too.
          • by 644bd346996 (1012333) on Tuesday October 30, 2007 @05:52PM (#21177089)
            You must be new here (despite your UID). The Linksys WRT54G and derivatives has been the most popular 802.11b/g/etc. router for years (since 2003, according to wikipedia). One of the reasons for its popularity is that it runs Linux, and there are many projects offering customized firmware, such as DD-WRT and OpenWRT. This has been popular enough that when Linksys chose to switch to VxWorks and halve the amount of flash, they released the WRT54GL with the old hardware configuration specifically for people wanting to modify the firmware.

            If you pick up one of the models with a USB port, you can trivially expand its storage capacity, although the built-in RAM and Flash is usually sufficient.
          • Re: (Score:3, Informative)

            by adavidw (31941)
            You want a WRT54G, which can be had dirt cheap, and be flashed to many specialized Linux distributions, some of which have LEAF. One example is http://openwrt.org/ [openwrt.org].

            Anybody still running an old standalone computer as a Linux software firewall probably pays enough in electricity to buy a new WRT54G or similar router every few months.
    • Re: (Score:2, Insightful)

      by JCSoRocks (1142053)

      Never trust anyone to keep security up. Apple, Microsoft, Linux Distributions, ...
      Do you see that apply fanboys!? Quick! Attack! GO GO GO!

      Seriously though, he's right. People in both camps should realize that no matter how great you think your software is, it's not perfect.
      • Re: (Score:3, Insightful)

        by jellomizer (103300) *
        Looking at your Moderation and the Parents soes that you statement is true... I am using OS X right now and I am hoping my Copy of Leapoard is in the mail and planning to install it as soon as I get home... Even Though I really like the OS right now it is my favorate, I don't want to be a FanBoy and assume that it is flawless perfect system that will protect me from nuclear blasts. And that Steve Jobs is always right... There are things I dislike about the OS but I dislike them less then my dislikes of Oth
    • by Anonymous Coward on Tuesday October 30, 2007 @03:19PM (#21175085)
      Couldn't you argue that more layers = more possibilities for attack vectors?
      Also, FYI, a hardware firewall is just a dedicated software firewall.
      • by gEvil (beta) (945888) on Tuesday October 30, 2007 @03:31PM (#21175295)
        Also, FYI, a hardware firewall is just a dedicated software firewall.

        I don't know if I buy that. I mean, one has the word "hard" in it, while the other has "soft" in it. Given the choice of the two, the "hard" one sounds far more secure.
        • by Sloppy (14984) on Tuesday October 30, 2007 @04:03PM (#21175775) Homepage Journal
          That's why, on my computer, I a use a hardware null device. I don't trust the OS' slow software-emulated null device to properly dispose of my unused bits. You never know who might be going through your trash, piecing together private information. The performance boost is just icing on the cake.
          • Re: (Score:2, Funny)

            by peragrin (659227)
            ah so you never returned your Sony Batteries.

            remind me never to borrow your computer.
        • Re: (Score:3, Informative)

          by ChrisA90278 (905188)
          So you buy a Lynksys "hardware" fire wall. What's inside? There is a CPU, some RAM, an operating system, likely VxWorks and some software. There are no truely hardware-only firewalls.

          And then what does a fire wall do? If the computer is configured corectly there is no need for a firewall. Firewals are just the "suspenders" part of a "belt and suspenders" security system. And even then the virus comes in via email and the web which your fire wall lets in.

          That said, I use redundant layers of protection
          • Re: (Score:3, Interesting)

            by jandrese (485)
            The worst part about those hardware firewalls is that they're buggy. People think that because they're in hardware they're bug free, but frankly I've discovered way more bugs in those cheap commercial "internet routers" that I've ever seen in iptables, ipfw, and pf combined. VxWorks is not easy to debug and most vendors seem to do as little work in it as possible. I actually had one on my home network that got replaced by a FreeBSD box when I discovered a firmware bug that DOSed my local network and the
      • by nharmon (97591) on Tuesday October 30, 2007 @03:34PM (#21175323) Homepage
        Fine. Just don't have your main firewall be on the same machine as the data you're trying to protect.
      • by Cecil (37810) on Tuesday October 30, 2007 @03:35PM (#21175351) Homepage
        Couldn't you argue that more layers = more possibilities for attack vectors?

        That would only apply if breaking one link in the chain is as good as breaking all the links in the chain - ie, if they give special accomodations to one another because they are all part of the "same network" or one contains passwords to the others or something of that nature. In this case that should not happen, thus you must break each link in succession to get through.

        Also, FYI, a hardware firewall is just a dedicated software firewall.

        The key word here is "dedicated". A dedicated firewall means you are not installing other software on it which could compromise the firewall itself (either intentionally or through poor design), and it also means that should a hacker somehow break into the firewall, your losses are limited as they have not also gained entry to your files, your passwords, your keyboard, your browser, etc and they cannot rootkit your PC. They only get a tiny, wimpy processor with little-to-no storage and complete network access. Dangerous, yes, but not a complete disaster.
        • by walt-sjc (145127)
          They only get a tiny, wimpy processor with little-to-no storage

          This depends on what you use as a dedicated firewall. Some of the dedicated commercial firewalls are actually fairly powerful systems.

      • by Zenaku (821866) on Tuesday October 30, 2007 @03:37PM (#21175371)
        If the the layers of security are really layers of security, then no you couldn't argue that. You have to breech the outtermost layer before you can even attack the second layer, and you have to breech that layer before you can attack the third, etc.
      • by Bryansix (761547)
        Actually some firewalls do the filtering and packet checking in hardware and some (mostly newer ones) actually just run software to do the task. Linksys for instance has both. One is not better at being a firewall then the other although you might argue that the hardware version will have more uptime.

        As for more layers equalling more attack vectors; that is complete hogwash. The second firewall doesn't open holes in the first in order to function. It just filters the traffic that actually makes it throug
      • No not for this case.

        Firewall A has all ports blocked

        Firewall B has all ports blocked

        Breaking Firewall A doesn't effect Firewall B Tequnique for Firewall B is different the Firewall A. It is like having 2 Locked Doors with different Keys and lock types. It is like saying if you have More Keys and Doors that are locked the less time it will take for a burgler to break into you house...

        Yes a Gardware furewakk us a det=ducated software firewall but that is all it is dooing you don't go install software on it
        • Re: (Score:3, Funny)

          by Anonymous Coward

          Yes a Gardware furewakk us a det=ducated software firewall but that is all it is dooing you


          Quick, call 911! Dude's having a stroke!
      • by Bob-taro (996889)

        Couldn't you argue that more layers = more possibilities for attack vectors?

        I've never heard of a firewall bug creating a new attack vector, though in theory I guess it could happen. Still, I'd argue that multiple firewalls is safer. If there are two firewalls between you and the bad guys / bots, they would have to get past BOTH firewalls.

    • jellomizer,

      Good post, but hardware firewalls are not infallible as they are also affected by Lesson #2 (made by humans who make mistakes) and can be hacked, as per Lesson #1.

      So, rather than have an either/or solution, why not apply all the tools at our disposal?
      * If you have a hardware firewall, use it.
      * If you have a software firewall, use that, too.

      And regardless, run a service such as "Little Snitch" which requires each application explicitly ask permission before communicating with external resources (
    • Re: (Score:2, Interesting)

      by VisceralLogic (911294)
      Of course, I was once running OS X for quite awhile with no firewall, because I had turned it off for some reason (debugging X11 connection, I think), and forgot to turn it back on. Still no problems when I realized it was off several months later.
    • by Cally (10873)
      Oh dear. Look, I'm sorry to break it to you, but that "hardware firewall"? That's a computer, running software. Your Windows machine's built-in, "software", firewall? That's a computer, running software.

      I think the distinction you're trying to make is between dedicated appliances and general purpose computers. Well, there's a security advantage to having your firewall device be on a separate host than the machine you use for web and mail - but most of that advantage is that you've got a separate device tel

  • by Space cowboy (13680) * on Tuesday October 30, 2007 @03:11PM (#21174981) Journal
    From the 'help' button available on the same screen (emphasis mine),

    In addition to the sharing services you turned on in Sharing preferences, the list may include other services, applications, and programs that are allowed to open ports in the firewall. An application or program might have requested and been given access through the firewall, or might be digitally signed by a trusted certificate and therefore allowed access


    IMPORTANT: Some programs have access through the firewall although they don't appear in the list. These might include system applications, services, and processes (for example, those running as "root"). They can also include digitally signed programs that are opened automatically by other programs.

    ... so if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem - if Jo(e)-evil-cracker already has 'root' on the system, the firewall isn't going to help save the system, after all... Perhaps Heise are just used to using Linux, where the firewall trumps all ?

    You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.

    And, FWIW, if I set the firewall to 'Set Access for specific services and applications', then disable SMB sharing, I can't connect using nmblookup. I can only get through when the service has been enabled (which seems reasonable).

    Simon

    • by Sloppy (14984) on Tuesday October 30, 2007 @03:36PM (#21175359) Homepage Journal

      so if Leopard trusts the service .. it will have access through the firewall.

      The default configuration represents the situation where the user defers to Leopard's estimation of what can be trusted. If the user starts modifying the configuration, then the question of what Leopard trusts or doesn't trust, should be irrelevant.

      But sure: they documented the bug, thereby causing it to be merely lame design, rather than a bug.

    • by kebes (861706) on Tuesday October 30, 2007 @03:37PM (#21175383) Journal

      if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem
      The problem is that the user asked the OS for a certain action ("block everything") and the OS didn't implement that action. This is basically a case of the OS saying "don't worry, I'm smarter than you and I know what to do"... which isn't a good policy when it comes to security. If a user tries to activate a firewall policy (because they happen to know a certain service is insecure, or not needed, or whatever), then the firewall should implement that policy.

      You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.
      If the situation is indeed as you describe (that the problem here is just that the firewall is allowing certain connections that it "knows" are okay) then you're right: this isn't a security vulnerability, but rather a case of poor UI design. The UI is saying "I'm blocking all connections" even though it isn't. You're also right that in principle the user should educate themselves about their software. However the software should, as much as possible, not misrepresent what's going on. Saying "blocking all connections" and then allowing something to connect is a recipe for security mistakes.
      • by elrous0 (869638) *

        This is basically a case of the OS saying "don't worry, I'm smarter than you and I know what to do"

        If you don't trust Father Steve, you don't deserve an Apple, Heathen Infidel!!

      • by gatekeep (122108) on Tuesday October 30, 2007 @05:10PM (#21176633)
        The UI is saying "I'm blocking all connections" even though it isn't.

        Well technically, the only examples this article provides are of UDP services listening. So there's no evidence that the firewall is allowing 'connections'

        I agree that to the end user connections probably means something different, but in the world of network protocols it has a very specific meaning, which doesn't include UDP services by definition. The only way for the firewall to deny inbound UDP sessions would be to fake connection state for these protocols. Many popular commercial enterprise class firewalls do just this, but I'm not surprised that a desktop firewall isn't doing it.
      • If the situation is indeed as you describe (that the problem here is just that the firewall is allowing certain connections that it "knows" are okay) then you're right: this isn't a security vulnerability, but rather a case of poor UI design. The UI is saying "I'm blocking all connections" even though it isn't.

        Eh - I don't know if I buy even that.

        I know a car's engine makes a "vroooom" sound but I'm not going to try and replace the flywheel. People need to know what they are doing, not "think" they know.

      • Re: (Score:3, Interesting)

        by Tom (822)
        You are doing the usual mistake of judging from your perspective.

        Apple is the one company on the market who I trust to actually do user tests. I'm also fairly sure they found out that Joe Average clicks on "block incoming connections" and still expects stuff to work. Which is why they made it behave that way, put the info into the help file for those of us who RTFM and give you commandline access and ipfw if you really know what you're doing.
    • Re: (Score:2, Interesting)

      by ByOhTek (1181381)
      The argument against that is in TFS even.

      If you are testing software and don't want it accessible from the outside world, Leopards trust be damned, you want it blocked. I agree with the author here, even if he managed to miss the obvious text: any hole in the firewall should be put there explicitly via the administrator of said firewall (or the machine it is on), not left default by the OS and it's own preferences. If MS didn't the same thing everyone would get pissed. If Linux did the same thing [I'd hope]
    • by roystgnr (4015) *
      An application or program might have requested and been given access through the firewall, or

      So, this firewall, it just blocks remote access to applications who don't open TCP or UDP ports for listening? Awesome! I've been running a firewall for years and I didn't even know it!
    • by mattgreen (701203) on Tuesday October 30, 2007 @04:44PM (#21176295)

      ... so if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem - if Jo(e)-evil-cracker already has 'root' on the system, the firewall isn't going to help save the system, after all... Perhaps Heise are just used to using Linux, where the firewall trumps all ?
      And what happens in the event the trust system is subverted somehow? Either the user accidentally trusts malware, or malware manages to squeeze itself in, what would the user do? The only option they have left is to pull the network connection. At least with a real firewall, a savvy user can lock down their machine and safely investigate further.

      You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.
      I thought the appeal of Apple was that Things Just Work and it is so intuitive you don't have read the documentation? This is a major bug. Don't try to downplay it like its no big deal. Security is always a big deal. I thought we all learned that from the countless Windows worms?
      • I thought the appeal of Apple was that Things Just Work and it is so intuitive you don't have read the documentation? This is a major bug.

        I think you missed a huge point in your haste to make a point against Apple. When the "Block all incoming connections" it blocks all user applications, not root applications.

        now for a legitimate complaint -- Why did it disable my firewall during the upgrade? or did it??

        So I decided to do an EXTERNAL port scan to see what was happening. Admittedly, I'm too lazy right

    • by Cally (10873) on Tuesday October 30, 2007 @05:09PM (#21176609) Homepage

      you could argue that reading the documentation for a new firewall would be a useful thing to do as well.

      Er, yeah, but... these are Mac users you're talking about. The people who've been sold a computer that ordinary people can use without being computer experts, and which doesn't get viruses like Windows does. (Not counting the Linux refugees, of course.)

  • As any new OS (Score:4, Interesting)

    by El Lobo (994537) on Tuesday October 30, 2007 @03:12PM (#21174985)
    As any new OS out there, these are childre diseases. Every new system will have problems: small problems and big problesm. The difference is that some will get praise anyway and some others will get "defectivebydesign" or "haha" tags.
    • "defective by design" makes no sense if you're not a monopoly.
      • Re:As any new OS (Score:4, Insightful)

        by east coast (590680) on Tuesday October 30, 2007 @03:28PM (#21175233)
        Apple may not be a monopoly but they certainly act a lot more like one than Microsoft does.
      • Tagging this "defectivebydesign" doesn't make any sense here at all, whether or not Apple's a monopoly. "Defective by design" is a phrase coined to describe DRM encumbered products, because they really are designed to be that way. A defect in a firewall is most definitely not intentional. Unfortunately, "defective by design" has lost its roots, and has become a phrase that is mindlessly repeated by the slashdot hoards whenever any product has any problem with it whatsoever. Obviously it couldn't be due to o
        • The roots of this slashdot tag are in the juvenile site Bad Vista [fsf.org] run by Stallman's FSF.

          They were asking people(don't know if they still do) as part of a astroturfing campaign to help out by tagging all Vista stories as defectivebydesign. Thus, it has lost its meaning and is just mindless people doing off topic tagging.

          I once attended a talk by Stallman, it was fun and all, and the hall was jampacked. But seriously, FSF needs to close that site, it's full of meaningless and mindless half-true FUD and

    • Re:As any new OS (Score:5, Informative)

      by croddy (659025) * on Tuesday October 30, 2007 @03:50PM (#21175565)
      "Defective by design" is not typically used to refer to "any defective technology, har har", except by a few folks here on Slashdot. "Defective by Design" is a campaign of the FSF, referring specifically devices or software that are deliberately crippled with DRM. see defectivebydesign.org [defectivebydesign.org].
  • OS Firewalls (Score:5, Insightful)

    by nurb432 (527695) on Tuesday October 30, 2007 @03:13PM (#21174997) Homepage Journal
    Shouldn't be used in the first place. You really need an external dedicated firewall if you want to pretend to be safe.
    • Actually, a good security policy is to take a layered approach & to not simply just trust one device.

      Yes, an external NAT/firewall/router is advisable but there's nothing wrong activating the computer's firewall also - especially because firewall activation is usually associated with additional activity logging which, on a computer will be more comprehensive & more likely to be looked at than any logging on the router.

    • by msimm (580077)
      Do they use a different firewall on their servers?
    • Re:OS Firewalls (Score:4, Interesting)

      by AceCaseOR (594637) <alexander.case@noSpam.gmail.com> on Tuesday October 30, 2007 @04:06PM (#21175823) Homepage Journal

      Unfortunatly, Apple's apparently company line (based on what I've heard from Apple sales reps) is that you don't need any "3rd party security software". Specifically, I overheard a salesperson speaking to a customer who was buying a notebook computer for his daughter (who was going to college), saying that the customer didn't need to purchase any of that kind of software, because OS X had no security holes. I did restrain myself from taking the salesperson to task for this in front of the whole store - but only because I didn't want to get kicked out of the store - as I hadn't completed my purchase yet. If I'd already gotten my iPod, I would have, as least, brought this to the manager's attention. As it is, it'd been a long day, and I wanted to get my iPod and go, so didn't make a deal about it.

      In retrospect, I should have made a bit of a fuss about it, and were the situation to happen today, especialy with what I learned from TFA, I would certainly have called the salesperson on this (albeit after I'd gotten my iPod - I'd rather not get kicked out of the store before I made my purchase).

    • Re: (Score:3, Insightful)

      by LurkerXXX (667952)
      Who the hell modded that insightful?

      Yes they SHOULD be used, in ADDITION to external dedicated firewalls.

      Anyone plugging in an infected laptop behind your LAN's firewall now has a shot at your firewall-free computer.

      Use both hardware and software firewalls. Layers of protection are good.
  • Hm (Score:2, Funny)

    by d3vo1d (607758)
    I guess we should expect to see 10.5.1 pretty soon.
  • by Tumbleweed (3706) * on Tuesday October 30, 2007 @03:20PM (#21175099)
    "It's not much of a firewall, is it?"

    "Finest on this subnet, sir!"

    "And how to you come to that conclusion?"

    "Well, it's so *clean*!"

    "It's certainly uncontaminated by security!"
  • by solosaint (699000) on Tuesday October 30, 2007 @03:27PM (#21175213)
    most powerusers I know use Little Snitch ... its better than the firewall apple includes
    • Re: (Score:3, Informative)

      by frodo527 (614767)
      I use Little Snitch on my MacBook Pro (still running Tiger) becsuse OS X's built-in firewall doesn't configure or notify you about outbound connections. The problem reported in the OP about Leopard's firewall concerns inbound connections. Little Snitch doesn't do anything about those. IOW, Little Snitch complement's OS X's firewall but does not replace it.
    • Real powerusers write their own ipfw rules! But that's not the point.
  • Anyone tested this? (Score:3, Interesting)

    by commodoresloat (172735) * on Tuesday October 30, 2007 @03:43PM (#21175461)
    This was pointed out on a previous slashdot article and this poster [slashdot.org] claims it is not true.
    • by prockcore (543967)
      That poster didn't have permission to view all the running services. He should've used sudo.
    • Re: (Score:3, Interesting)

      by juct (549812)
      This guy missed to run with "sudo" -- so lsof has not sufficient rights to query.
      Do a

      sudo lsof -iUDP

      and you will see all the services listening on UDP ports.

      bye, ju
  • Wait a second... (Score:5, Interesting)

    by CompMD (522020) on Tuesday October 30, 2007 @03:58PM (#21175681)
    I thought it was illegal for Germans to do this kind of investigation now. Is it? I mean, it requires "hacking tools."
  • by hbp4c (315334) <howard,powell&gmail,com> on Tuesday October 30, 2007 @04:02PM (#21175751) Homepage
    Perhaps I missed something...

    It looks like every test that was ran was run from the local machine. The tester set "block incoming connections" not "block local connections" and/or "block outbound connections"

    If you lsof, you're going to see ports open to localhost, unless the firewall is specifically dropping packets to 127.0.0.1.

    ntpdate is an ntp client tool, so it makes an outbound connection instead of an inbound connection.

    nmblookup actually warns the guy testing this - it realized that 192.168.69.21 was the local interface, so it responded as "localhost" instead of the samba name!

    The nmap test was the only tool that specifically checked a non-localhost IP, and it's not clear to me if it actually checked the localhost interface cleverly or actually sent packets out and through the firewall.

    As I said, perhaps I missed some critical fact. However, I would put more credibility in the tests if the tester had used a 2nd machine on his subnet to nmap the leopard firewall.
    • by juct (549812) <ju@heisec.de> on Tuesday October 30, 2007 @04:22PM (#21176045) Homepage
      Yes you are missing something.

      I run all tests from a linux machine. Look at the packet dumps. It shows two machines communicating over a network.
      Look at the IP address given as an argument to ntpdate -- it is a public IP of an ISP that I queried from our company network.
      Look at the quoted logfile entries. All of them show that the tests have been run from external machines.

      bye, ju
  • I am not convinced (Score:5, Informative)

    by avatar4d (192234) <avatar4d@gma i l . c om> on Tuesday October 30, 2007 @04:23PM (#21176061)
    This article is a bit fishy in its interpretation. They don't list their expectations vs the results.. They just make assumptions. For instance:

    Users who want to raise their security level might choose the option "Block all incoming connections" - in the hope that this really will reject all incoming queries to network services.


    Which it appears to do if you look at the quote below. They show a deny in their logs. Seems to work so far.

    The initial tests looked promising. The SSH server activated for testing purposes and the primitive demo backdoor could no longer be accessed from outside. The firewall even blocked access to a test server on a UDP port:

    Oct 29 11:26:49 Qf98e Firewall[44]: Deny nc data in from 193.99.145.XXX:28524 uid = 0 proto=17

    However, a simple port scan was enough to destroy our misplaced optimism:

    # nmap -sU 192.168.69.21
    PORT STATE SERVICE
    123/udp open|filtered ntp
    137/udp open|filtered netbios-ns
    138/udp open|filtered netbios-dgm
    631/udp open|filtered unknown
    5353/udp open|filtered zeroconf
    MAC Address: 00:17:F2:DF:CD:B3 (Apple Computer)


    They are now basing an assumption (or marketing spin) because of output from an Nmap scan. This just indicates a flaw in the signature Nmap has (or the lack thereof) for this particular firewall implementation.

    Then straight from NMAP's documentation:

    "Nmap reports the state combinations open|filtered and closed|filtered when it cannot determine which of the two states describe a port." -(http://insecure.org/nmap/man/ [insecure.org])

    And as for the NTP response being received, well that goes back to what we should expect to see. Apple is about usability. I would suspect that "Block all INCOMING connections" to not refuse information that I request. Basically this just does ingress filtering and not egress.

    I haven't read the entire article yet, but from my brief scan I don't see how this is not a "functioning" firewall.
    • Re: (Score:3, Interesting)

      by Todd Knarr (15451)

      The NTP port is easy enough to explain. NTP is a UDP-based protocol, so there aren't any connections. When operating properly, the time interval between packet exchanges with the time servers is long so maintaining the equivalent of a TCP masquerading map isn't feasible (you either need unreasonably long timeouts leading to odd behavior when the entries become invalid but aren't timed-out, or you tend to time out active entries). Since NTP packets are fairly simple and, being UDP, arrive in a single message

  • by Todd Knarr (15451) on Tuesday October 30, 2007 @04:25PM (#21176095) Homepage

    I notice in their report that they complain about services Nmap lists as "open/filtered". Nmap reports that result when it encounters a port that elicits no reply whatsoever to a probe. This happens only when a firewall is dropping all traffic to a port and not generating any ICMP error packet for the attempt. The TCP spec says if a port isn't open the client should get an ICMP error, so Nmap knows that there's something there even if access to it's being blocked. If this is any indication of the quality of this "analysis", we can discount the article.

    • by gatekeep (122108)
      The TCP spec says if a port isn't open the client should get an ICMP error,

      Huh? ICMP doesn't relay any information about ports. It's not even part of TCP but a completely different ip protocol. You'll get ICMP redirects or unreachables at layer 3 based on routing, but never based on port.

      If a port isn't listening, the destination will reply with a TCP RST. If it's firewalled, most firewalls will silently discard it and the source gets no response their SYN just goes off into the ether. If it's open, t
  • by mkiwi (585287) on Tuesday October 30, 2007 @04:26PM (#21176097)
    I've read too many posts to ignore this.

    [Rant]

    There is no such thing as a purely hardware firewall in modern times.

    The hardware like a Cisco pix has software (i.e. firmware) running on top of a simple (usually Linux or bsd architecture). A true hardware firewall is John or Jane sitting at a switchboard plugging in and unplugging cables, like way back when telephones first existed. You could also theoretically unplug the networking cable every-so-often to get a firewall-like effect, but the bottom line is that there is something (a brain) that decides what goes in and what goes out. The brain is a bunch of code (software) that is the firewall.

    Hell, create a searing flame capable of burning anyone to death who dare walks through it- that's the literal definition of a firewall. The heat caused by the burning of wood or something else is a "hardware" firewall.

    [/Rant]

    • by Anonymous Coward on Tuesday October 30, 2007 @04:43PM (#21176285)
      Actually, no, the literal definition of a firewall is a wall built to block the spread of fire, like the wall between the engine and passenger sections of a car. Not a wall made of fire, lol.
    • "Hell, create a searing flame capable of burning anyone to death who dare walks through it- that's the literal definition of a firewall. The heat caused by the burning of wood or something else is a "hardware" firewall."

      Personally I'd call that a vaporware firewall.
    • I think the lingo has evolved and left you behind. I understand "hardware firewall" to mean a hardware device that only functions as a firewall. Obviously the firewall it runs will be software or firmware. The idea of having some sort of "pure" hardware firewall implementation where you flick DIP switches to accept or drop packets is ludicrous. Perhaps the term "discrete firewall" would suit you better?

      Also, as far as Leopard's firewall functionality goes I think they have struck quite a nice balance betwee
  • by PipingSnail (1112161) on Tuesday October 30, 2007 @04:44PM (#21176291)

    Why isn't this story also tagged as "haha"?

    If this was a story about a Windows Firewall, as well as defectivebydesign you'd also have the "haha" tag. Do I detect bias?

  • I'm using Leopard and enabled the firewall and per-application blocking. I find it convienient at its enabled in two or three mouse clicks like the Windows firewall. I'm not a security techie but I understand as far as OS firewalls and there never being a magic bullet that should not ever be the only solution I should use.

    Given that Apple may or likely has a flaw to fix in its Firewall, what solutions are there for additional protection? I'd been using PortSentry (a former Cisco package, now OSS on Sourcefo
    • Unlike Windows, OSX does not run with services enabled unless you explicitly enable them.

      It sounds like if you don't enable a service, it doesn't enable the firewall rules for that service. If you do enable the service, then it turns on the firewall rules for that service. This is not a problem unless you install a third-party program that provides the same network service, *and* you want to restrict access to it.

      The argument in the article that the firewall would prevent a trojan from opening a listener on
  • Firewalls are half-assed anyway, why bother with half-assed security, never do it halfway... I say go full-assed and leave all ports open! Take back the internet! Let our data flow! Freedom! DISCLAIMER: I don't know shit about security, as a result I don't keep any sensitive info on my computer.
  • by CatOne (655161) on Wednesday October 31, 2007 @07:18AM (#21181619)
    http://leofud.blogspot.com/ [blogspot.com]

    Specifically that the open|filtered may mean the ports are in a stealth mode... which is what you want!

    I did a port scan of my Leopard machine from a Tiger machine and didn't see any open ports at all. I'm not running the firewall either -- but I don't have any services turned on right now. That's the way OS X ships by default (and has since as least 10.2).

    Not arguing that things couldn't be better communicated by Apple, but I think an article claiming they're taking a Microsoft-esque tact toward security is more than likely politically loaded.

Sentient plasmoids are a gas.

Working...