Slashdot Mirror
OS X Leopard Firewall Flawed
cycoj writes with a report in the German IT magazine Heise, taking a look at the new OS X Leopard firewall. They find it flawed. When setting access to specific services and programs to only allow SSH access, for example, they found that a manually started service was still accessible. From the article: "So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to 'Set access to specific services and programs,' which promises more control over network traffic. Mac OS X automatically enters all shared resources set up by the user, such as 'Remote login' for SSH servers, into the list of accessible resources... However, initial functional testing quickly dispels any feeling of improved security. A service started for testing purposes was able to be addressed from outside without any difficulty. The firewall records this occurrence... Even with the firewall set to 'Block all incoming connections' ports to netbios, ntp and other services were still open... Specifically these results mean that users can't rely on the firewall."
Leson 1.
Never Trust Software firewalls. Software firewalls are only should be used in protection against "internet static" attacks. Where just random worms and viruses are trying to get in. Software Firewalls
Are normally bad against direct attacks from real hackers. Because there are so many ways to trick the user to install software to get around it...
Lesson 2.
Never trust anyone to keep security up. Apple, Microsoft, Linux Distributions, even Open BSD they are all made by humans and humans make mistakes and forget to check out things...
Lesson 3.
Always keep a hardware firewall even if it is a cheap Linksys Firewall/Router they will double up protection and keep your system relatively safe.
Lesson 4.
Never assume that you are 100% safe. There are always ways around things...
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well.
And, FWIW, if I set the firewall to 'Set Access for specific services and applications', then disable SMB sharing, I can't connect using nmblookup. I can only get through when the service has been enabled (which seems reasonable).
Simon
Physicists get Hadrons!
As any new OS out there, these are childre diseases. Every new system will have problems: small problems and big problesm. The difference is that some will get praise anyway and some others will get "defectivebydesign" or "haha" tags.
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
Shouldn't be used in the first place. You really need an external dedicated firewall if you want to pretend to be safe.
---- Booth was a patriot ----
I guess we should expect to see 10.5.1 pretty soon.
I tend to agree with the fact that software firewalls are more or less a joke. Some I would consider OK for some things such as blocking out the "static" that tends to make its way across any network from time to time. Else the best protection for most users is a simple hardware firewall. It keeps the bad people outside and allows you to do what you need to do with few restrictions. This is however no replacement for good old common sense which seems to get lost in the translation for todays society. Normally if you are surfing slashdot, e-bay, google, yahoo, and other popular sites you wont end up with worms and malware on your computer. If your running a mac you will end up with less. However a mac is not the answer to all the problems. The answer lies with the end user.
Else I feel that the firewall could probably use some work. I am sure that Apple is already working hard to correct whatever problems they are seeing and will be patching this within the first few weeks. I hate to see a patch that early as it reminds me a lot of a Microsoft release however it has to happen in this case.
"It's not much of a firewall, is it?"
"Finest on this subnet, sir!"
"And how to you come to that conclusion?"
"Well, it's so *clean*!"
"It's certainly uncontaminated by security!"
jellomizer,
Good post, but hardware firewalls are not infallible as they are also affected by Lesson #2 (made by humans who make mistakes) and can be hacked, as per Lesson #1.
So, rather than have an either/or solution, why not apply all the tools at our disposal?
* If you have a hardware firewall, use it.
* If you have a software firewall, use that, too.
And regardless, run a service such as "Little Snitch" which requires each application explicitly ask permission before communicating with external resources (e.g. "phoning home").
most powerusers I know use Little Snitch ... its better than the firewall apple includes
to be fair the wifi mess wasnt apples fault, it was a 3rd party driver (netgear?).
turn up the jukebox and tell me a lie
Perhaps you meant 10.5 (Leopard) rather tan 10.4 (Tiger) ?
It must be Tuesday.......Wednesday, Thursday, Friday.........
to the rescue!
Security through obscurity! The saddest part is, way too much (i.e. more than zero) of the stuff I do and deal with use that security model too.
All pass beyond reach of medicine. None pass beyond the reach of love.
Strange nmap picks it up as an IronPort C60. I know they run a BSD variant on those boxes but the dump is that similar.
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp filtered http
443/tcp filtered https
554/tcp filtered rtsp
1755/tcp filtered wms
Device type: specialized
Running: IronPort AsyncOS
OS details: IronPort C60 email security appliance
http://www.uninformed.org/?v=8&a=4&t=sumry
Look like it was in the built-in Atheros driver.
This was pointed out on a previous slashdot article and this poster claims it is not true.
Tagging this "defectivebydesign" doesn't make any sense here at all, whether or not Apple's a monopoly. "Defective by design" is a phrase coined to describe DRM encumbered products, because they really are designed to be that way. A defect in a firewall is most definitely not intentional. Unfortunately, "defective by design" has lost its roots, and has become a phrase that is mindlessly repeated by the slashdot hoards whenever any product has any problem with it whatsoever. Obviously it couldn't be due to oversight or incompetence, Apple must have intentionally gone out of their way to make a flaw in their firewall because they're evil. /sarcasm
I thought it was illegal for Germans to do this kind of investigation now. Is it? I mean, it requires "hacking tools."
This is a known issue with the Tiger firewall. It only filters TCP unless you check the "Block UDP Traffic" advanced option. Even then it doesn't block all UDP traffic.
Why would they change this in Leopard?
Ideally, a firewall also
Although I loathe analogies, in cars a real firewall sits between the dangerous (engine) and habitable (passenger) compartments, has a few holes poked in it to allow certain things through (throttle controls, wiring, etc.), and hopefully blocks everything else. The counterpart to a "software firewall" in such a case would be a piece of sheet metal between the engine and passenger compartments that spontaneously opened new holes whenever someone turned on the A/C, played a CD, or unfastened their seat belt. That's NOT A FIREWALL!
Perhaps I missed something...
It looks like every test that was ran was run from the local machine. The tester set "block incoming connections" not "block local connections" and/or "block outbound connections"
If you lsof, you're going to see ports open to localhost, unless the firewall is specifically dropping packets to 127.0.0.1.
ntpdate is an ntp client tool, so it makes an outbound connection instead of an inbound connection.
nmblookup actually warns the guy testing this - it realized that 192.168.69.21 was the local interface, so it responded as "localhost" instead of the samba name!
The nmap test was the only tool that specifically checked a non-localhost IP, and it's not clear to me if it actually checked the localhost interface cleverly or actually sent packets out and through the firewall.
As I said, perhaps I missed some critical fact. However, I would put more credibility in the tests if the tester had used a 2nd machine on his subnet to nmap the leopard firewall.
The netbios name service and NTP run regardless of how empty the services list seems to be. Also they never mentioned root, they ran netcat as a user and it was remotely accessible.
... it's a completely meaningless argument. It's just plain untruthful. Heise are used to the meaning of words not being changed just to make it so Apple is right.
I can't see how you could argue Leopard's setting are badly worthed, or the other way around
Which it appears to do if you look at the quote below. They show a deny in their logs. Seems to work so far.
They are now basing an assumption (or marketing spin) because of output from an Nmap scan. This just indicates a flaw in the signature Nmap has (or the lack thereof) for this particular firewall implementation.
Then straight from NMAP's documentation:
"Nmap reports the state combinations open|filtered and closed|filtered when it cannot determine which of the two states describe a port." -(http://insecure.org/nmap/man/)
And as for the NTP response being received, well that goes back to what we should expect to see. Apple is about usability. I would suspect that "Block all INCOMING connections" to not refuse information that I request. Basically this just does ingress filtering and not egress.
I haven't read the entire article yet, but from my brief scan I don't see how this is not a "functioning" firewall.
Confucius say: "Man who associates with smarter men than himself is smarter than the men he associates with."
No one ever thinks of the sandbox. Just sayin, is all.
I notice in their report that they complain about services Nmap lists as "open/filtered". Nmap reports that result when it encounters a port that elicits no reply whatsoever to a probe. This happens only when a firewall is dropping all traffic to a port and not generating any ICMP error packet for the attempt. The TCP spec says if a port isn't open the client should get an ICMP error, so Nmap knows that there's something there even if access to it's being blocked. If this is any indication of the quality of this "analysis", we can discount the article.
[Rant]
There is no such thing as a purely hardware firewall in modern times.
The hardware like a Cisco pix has software (i.e. firmware) running on top of a simple (usually Linux or bsd architecture). A true hardware firewall is John or Jane sitting at a switchboard plugging in and unplugging cables, like way back when telephones first existed. You could also theoretically unplug the networking cable every-so-often to get a firewall-like effect, but the bottom line is that there is something (a brain) that decides what goes in and what goes out. The brain is a bunch of code (software) that is the firewall.
Hell, create a searing flame capable of burning anyone to death who dare walks through it- that's the literal definition of a firewall. The heat caused by the burning of wood or something else is a "hardware" firewall.
[/Rant]
This is on OSX 10.4. I wanted to share an internet connection (internet to eth0, then the airport card serving as a gateway for 2 laptops and an iphone to access the internet). All peachy, but this stupid OS does not let me do it unless I also setup an apache webserver?!?!?! Why? Why? Why? Why? Why? Why? Why? I do NOT want a webserver, just for the machine to be a gateway, but no... (sure there must be a way, but I did not feel like digging through pages of documentation... ended up allowing the server but changing the httpd config file to listen only to 127.0.0.1. The Macs always force you do work around the OS in silly ways... Sure it is a nicer system than Windoze and it has more apps available than linux (I used to be a linux-only person), but it is weird...
In the words of Nelson Muntz "Ha Ha"
Agreed. There's a huge difference between "designed to be defective" and "designed defectively". Perhaps "defective by intent" would be more accurate, but you lose the satisfying and easy-to-remember assonance.
Why isn't this story also tagged as "haha"?
If this was a story about a Windows Firewall, as well as defectivebydesign you'd also have the "haha" tag. Do I detect bias?
... so if Leopard trusts the service (it's a root process, or it's signed with an acceptable crypto signature), it will have access through the firewall. Since Leopard ships with cryptographically-signed binaries/packages, I guess I'm not seeing the problem - if Jo(e)-evil-cracker already has 'root' on the system, the firewall isn't going to help save the system, after all... Perhaps Heise are just used to using Linux, where the firewall trumps all ? And what happens in the event the trust system is subverted somehow? Either the user accidentally trusts malware, or malware manages to squeeze itself in, what would the user do? The only option they have left is to pull the network connection. At least with a real firewall, a savvy user can lock down their machine and safely investigate further. You could argue that the 'Block all incoming connections' is badly worded, but you could argue that reading the documentation for a new firewall would be a useful thing to do as well. I thought the appeal of Apple was that Things Just Work and it is so intuitive you don't have read the documentation? This is a major bug. Don't try to downplay it like its no big deal. Security is always a big deal. I thought we all learned that from the countless Windows worms?They were asking people(don't know if they still do) as part of a astroturfing campaign to help out by tagging all Vista stories as defectivebydesign. Thus, it has lost its meaning and is just mindless people doing off topic tagging.
I once attended a talk by Stallman, it was fun and all, and the hall was jampacked. But seriously, FSF needs to close that site, it's full of meaningless and mindless half-true FUD and the joke's on FSF for creating that site. Maybe it was just an attempt at spreading FUD on MS to counter(or complement?) MS's anti-Linux FUD, but to anyone with half a brain, the joke's on FSF.
This space for rent.
I'm using Leopard and enabled the firewall and per-application blocking. I find it convienient at its enabled in two or three mouse clicks like the Windows firewall. I'm not a security techie but I understand as far as OS firewalls and there never being a magic bullet that should not ever be the only solution I should use.
Given that Apple may or likely has a flaw to fix in its Firewall, what solutions are there for additional protection? I'd been using PortSentry (a former Cisco package, now OSS on Sourceforge) on my Tiger system. It compiled, installed and worked on Tiger using GCC but no longer on Leopard. I frankly don't trust Norton and some of the other "firewall" expert 'solutions' companies. I'd like to say I would be willing to learn IPFW firewall rules (I assume Leopard uses this) but the level of technical expertise needed is well beyond my knowledge level. I'm not a techie and learning to implement firewall rules demands expertise and is a fine art in itself - as is computer security.
So, what other level of security might make up for Leopard's lack of a good firewall? I like using OSS as there is support, its free (can't afford more software) and the code is open for review by community. Suggestions?
Firewalls are half-assed anyway, why bother with half-assed security, never do it halfway... I say go full-assed and leave all ports open! Take back the internet! Let our data flow! Freedom! DISCLAIMER: I don't know shit about security, as a result I don't keep any sensitive info on my computer.
Whether you want them to or not.
Chas - The one, the only.
THANK GOD!!!
Out in hall, wasn't it? No, don't get up...
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
So - Leopard has major security holes right out of the box!!! See subject!!! Mod me down because the truth hurts!
[So the first step after starting Leopard should be to activate the firewall. The obvious choice to do so is the option to "Set access to specific services and programs", which promises more control over network traffic.]
This very early sentence tells us that these people know absolutely nothing about security in OS X. The firewall is already on - it is on by default. The first thing they actually did was to _allow_ incoming connections. Other than changing that setting, they did nothing to the default firewall rules. And they certainly didn't "activate the firewall".
Then they changed it to "block all incoming connections". This admittedly didn't do exactly what it said. However, Apple has never said that you get perfectly granular or absolute control over the firewall through the gui controls in Preferences. To really control any firewall, you have to know what you are doing, and modifying the appropriate unix config settings - in this case, for ipfw. See http://www.macdevcenter.com/pub/a/mac/2005/03/15/firewall.html.
What Apple has done is to put into the preference pane a set of simplified security settings which make sense for most people running consumer or workstation machines. They've added more granular control to the simplified settings, which is impressive. But it would not be good PR for Apple if consumers who thought they had to "activate the firewall" messed around and disabled some key functionality.
If you are a network admin who really has to worry about these things, you will 1)be more knowledgeable, and 2)be running OS X Server, which I'm just guessing doesn't work quite this way.
For what it's worth, Apple has made a fairly idiot proof system. A casual user can't mess this up too much.
1. If you have OS X Tiger, turn on the firewall in System Preferences
2. Open Terminal in your admin account and type at the prompt: sudo ipfw list
3. Apply these rules to Leopard
4. For more info, type: man ipfw
P.S. Imagine Apple is trying to help you learn something.
I think you meant a so-called "personal firewall" when you said "software firewall". They are inherently weak and most are worthless.
I think you meant "a dedicated firewall host" when you said "hardware firewall". Most are inherently strong when properly used.
Don't forget to make sure you haven't stored a password to your firewall host on your PC. If possible, you should only log into the firewall host from its console, although that's not really doable on cheap linksys-type appliances. Always use https: and not http: connections if you are forced to use a web-based console, and make sure your browser isn't set to remember passwords. Always change the default password before connecting to any networks (use a loopback or a crossover cable to your PC if the device forces you to have a live ethernet port at bootup).
Your lesson #4, "Never assume that you are 100% safe" is excellent advice. Similar to "never discuss anything that might be considered illegal on the phone, even if you are just talking about some role-playing game".
As long as I love OSX, it really sucks as a firewall.
Why don't they import PF, just like any modern BSD system?
{{.sig}}
Allowing a signed application to punch through the firewall is indeed "defective by design".
Windows machines traditionally need the firewall to keep the nasties out because of all the open services, the insecure services, and the holes in the network stack. Mac OS X has really none of these. So this is like comparing an unlocked front door on a bank (with a closed vault) with a grocery store with same unlocked front door. Yes, it does lower the security, but amplifying a 1 in a million security problem by a factor of say 10, is not nearly as severe as amplifying a 1 in 100 security hole by 10.
Still no excuse though. I'm sure we'll see many things fixed in 10.5.1, and unlike the usual suspects, they won't immediately be replaced by another dozen holes found the following morning.
I work for the Department of Redundancy Department.
Unlike Windows, OSX does not run with services enabled unless you explicitly enable them.
It sounds like if you don't enable a service, it doesn't enable the firewall rules for that service. If you do enable the service, then it turns on the firewall rules for that service. This is not a problem unless you install a third-party program that provides the same network service, *and* you want to restrict access to it.
The argument in the article that the firewall would prevent a trojan from opening a listener on a low port is bogus, because any program that can open a listener on a low port can also remove the corresponding firewall rule... you have to be root to do either.
The fact that Samba processes were still running after sharing was turned off, however, is a concern. That absolutely should not happen, and Apple needs to fix it.
The workaround is to make sure that after you disable a service, you reboot to make sure it is really disabled. If you don't enable any services that should not be an issue.
My slak life has insulated me from many things. You have fires that will burn macs? Neato.
Seriously I've never seen the need and I been out here a long time. Turn off what you don't need until you need it and then turn it back off when you done.
DRM DRM DRM DRM DRM!!!
Oh, wait, we only say that when it is MS, when Apple does it, it is SECURITY...
If anything, we should be laughing at the people who report nmap's "open|filtered" state as if it were a problem -- as if it were somehow open. At people who are writing an article about security, yet don't appear to understand how UDP works.
And, especially, at an article blatantly cashing in on Leopard's release -- if these are "flaws", they are just about exactly the same "flaws" that exist in Tiger.
Don't thank God, thank a doctor!
Learn more about the firewall.
Enough to discover that this article is by someone who has absolutely no clue about OS X firewalls or security. Several of the responses here are pretty much the same.
PortSentry, if I understand, is to protect you from people doing portscans on you. While useful, that really doesn't seem anywhere near as essential as having a working firewall to begin with.
And you're right not to trust Norton -- that would likely make you LESS secure.
Personally, I run Linux with no firewall. I figure, by the time I need it (rather than simply refusing packets), I'm already 0wned. But dig through the comments a bit more, and you'll find that no matter what my personal beliefs are about firewalls, this one really is fine, if you need one. (I seem to remember leaving it on by default, since OS X never made it difficult for me to open the ports I needed.)
Don't thank God, thank a doctor!
This was bound to happen. Software is flawed no matter how much you fix it. Just because Windows was used by a large number of people it was the target till now. As Linux and MAC OS get more and more popular and people start adopting it in a large scale, there will be more people trying to break its security system, finding buffer overflow bugs etc etc...
Mac OS is just as flawed as Windows or Linux and just because "It just works" doesn't mean "It is not flawed".
*Gets ready for apple fanboy bashing*
No harisplitting intended, but the title and summary suggest we're talking about OS X (which is the OS for iPhone and iPod touch). Of course we are talking about Mac OS X, which is the operating system used on Macintosh computers.
http://leofud.blogspot.com/
Specifically that the open|filtered may mean the ports are in a stealth mode... which is what you want!
I did a port scan of my Leopard machine from a Tiger machine and didn't see any open ports at all. I'm not running the firewall either -- but I don't have any services turned on right now. That's the way OS X ships by default (and has since as least 10.2).
Not arguing that things couldn't be better communicated by Apple, but I think an article claiming they're taking a Microsoft-esque tact toward security is more than likely politically loaded.
Call me when there is a serious threat to my Mac. Still don't see any viruses or malware 20+ years on now... With every new Apple product come the lowliest, most insecure, windows-using chumps with lame attempts like this thread to cast a bad light on Apple.
Does ipfw still work on Leopard? Are there some sort of new rules for per app/service in ipfw? Is there some kind of way to see what the rules really are in the SW firewall and to set them via a shell script?
I have done a few tests myself from a remote linux box (using nmap). By default, there doesn't seem to be any ports open, but I have a python script that listens for connections on any specified port.
It seems that the firewall is a bit odd... From my quick tests, it seems that if you run something as root (i.e. sudo it) then the firewall lets it listen and allows incoming connections, however as a user it blocks it. Therefore it seems that this firewall is aimed at users running some malicious code, rather than for protecting against vunerabilities in the underlying OS.
It would be interesting if someone could confirm this.
In OS 10.4 Tiger, in order to block UDP traffic, one had to click on the Advanced tab in the Firewall pane and select "block UDP traffic" otherwise the firewall would only block TCP traffic. If you notice in the article, all the open ports are UDP. I don't have a copy of Leopard yet, but given that the author didn't mention anything about the advanced tab I wouldn't be surprised if it's still the same for Leopard and that he didn't make this selection.
Blocking UDP traffic in 10.4:
http://docs.info.apple.com/article.html?path=Mac/10.4/en/mh1242.html
One doesn't need to rely on the fuzzy new "application firewall", since the tried and true ipfw is still included, although disabled by default and with no GUI for configuring it. There are other ways though:
http://www.netmojo.ca/blog/2007/10/31/fixing-leopards-firewall/
"Block all incoming connections" simply does not work, period. I've posted my test results here: http://forums.macrumors.com/showpost.php?p=4425082&postcount=199
(tests performed on a different machine)
The problem is that even if they come up with a fix, I will never trust this "firewall" if they can't even get the most basic thing right.
"Never Trust Software firewalls" is a good idea, but that does not mean that you should use a software-less firewall. Fixing a flaw in a hardware firewall is as hard as that hardware. Because of that, time to market for fixes and improvements will be awful. A software firewall that is sufficiently shielded from the malicious updates (for instance by running in a separate piece of hardware that itself does not have any connection between the internet and its program store) is a much better choice
New Rule: Any story trumpeting the latest security hole for OS X must include actual measurement data reporting the number of machines being infected out there on the net. Not hypothetical bullshit from some "security expert" with an axe to grind. Back up your "news" with real data. This is just speculation by heise.de.
.01% of the number of compromised windows boxes corralled by botnet herders.
So how many systems have been compromised as a result of this flawed firewall? My guess is zero. Let us know when the number of compromised OS X macs in the wild reaches
"Mit der Dummheit kaempfen Goetter selbst vergebens." - Schiller