News, info, and opinion by Mac users, for Mac users.

October 31, 2007

security

Leopard’s firewall isn’t so hot

Posted Oct. 31, ’07, 6:29 AM PT by Derik DeLong
Category | Security

Firewall Our constantly online lifestyle has made a firewall a must for essentially every computer user. This is so much so that it’s hard to find an internet capable OS without one built in. These days, Windows enables its own by default. That’s great. Unfortunately, Apple still isn’t enabling OS X’s by default. And that’s the least of its worries.

Heise Security runs down several issues with Leopard’s firewall. They’re all worth our attention. First, in the normal operating mode (allow specific service ports), it doesn’t just open ports for the listed services. Rather, it allows any service started on the Mac to poke holes. That includes malicious software.

Further, there are some other services that Apple keeps running, like ntp and netbios that have open ports not listed in System Preferences. Now, you might argue that’s ok because you trust Apple to keep those services up to date (and relatively free of vulnerabilities). If you’re paranoid, you’d turn on the straight deny option of the firewall to close up all ports. That still wouldn’t protect you. NTP, for example, is still available, even in that mode.

This is one of those reasons that I still recommend the use of a router even with a single Mac (and turn off UPnP for the love of Pete). I hope Apple addresses these issues soon.


3 Comments

Dave-O said:

I just installed Leopard last night and I can't make any sense of the Firewall preference pane anymore. Definite downgrade.

October 31, 2007 7:08 AM
Oliver said:

There appears to be a "work-around" for this problem. If you enable "Stealth Mode" those open UDP ports will be blocked.

October 31, 2007 8:05 AM
Khurt Williams Author Profile Page said:

I am an informations security professional and I struggled to understand the Firewall options. I just may open up the console and edit the iptables directly.

October 31, 2007 9:56 AM

Leave a comment

 



Visit other IDG sites: