Add macOS Security Overview #270
Conversation
✅ Deploy Preview for privsec-dev ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
From https://support.apple.com/en-gb/guide/security/secebb113be1/web:
|
|
Will it be recommended to use Safari or will the recommendation be to use a Chromium-based browser? |
I'm not sure how significant those are. |
I think just leave it up to the reader. |
Signed-off-by: Tommy <[email protected]>
Signed-off-by: Tommy <[email protected]>
Signed-off-by: Tommy <[email protected]>
|
NIST offers configuration profiles and scripts for automatic configuration: https://github.com/usnistgov/macos_security/tree/sequoia. Can some of them be recommended? |
|
|
||
| macOS comes with a built-in [firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-on-mac-mh11783/mac). Make sure it's enabled at the very least, but you can block all incoming connections for the best security/privacy. | ||
|
|
||
| Avoid third-party firewalls like LittleSnitch or LuLu that require you to install a system extension. They don't cover DNS so data exfiltration is still possible. |
There was a problem hiding this comment.
- LittleSnitch and LuLu block outgoing connections; built-in firewall – only incoming. There's no built-in replacement for these tools.
- Latest version of LittleSnitch does cover DNS. With LuLu, it's possible to use dnscrypt-proxy locally.
There was a problem hiding this comment.
There are other bypasses. This should be updated with the empty TCP connection bypass - that one is trivial
|
|
||
| All encryption keys are handled by the Secure Enclave. Swap space is also [encrypted](https://support.apple.com/en-euro/guide/mac-help/mh11852/mac). | ||
|
|
||
| Your Mac is at its most secure when it's fully off and the data is at rest. Depending on your threat model, it might behoove you to turn your Mac off completely whenever you're not using it, especially since Macs do not have memory encryption. |
There was a problem hiding this comment.
macOS can be forced to clear FileVault keys from memory when hibernating by executing:
sudo pmset -a hibernatemode 25and installing DestroyFVKeyOnStandby profile.
There was a problem hiding this comment.
Is this actually documented anywhere by apple or nah?
There was a problem hiding this comment.
man pmset, online version e.g. at https://www.unix.com/man_page/osx/1/pmset/
hibernatemode = 25 (binary 0001 1001) is only settable via pmset. The system will store a copy of memory to persistent storage (the disk), and will remove power to memory. The system will restore from disk image. If you want "hibernation" - slower sleeps, slower wakes, and better battery life, you should use this setting.
Configuration profiles documentation: https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions.
All configuration profiles in an official Git repository; check new commits after every system update to see the difference between releases: https://github.com/apple/device-management/tree/release/mdm/profiles.
There was a problem hiding this comment.
hibernatemode = 25 makes fingerprint unlock useless. Everytime you trying to wake Mac from sleep you have to wait for 10 seconds and input your password.
|
May be worth adding: Compared to Linuxes, macOS doesn't sanitise
Defaults env_keep += "HOME MAIL"It may also be worthwhile to mark shell init scripts as immutable as the link suggests. |
|
@friadev @nihil-admirari is right on the point about schg - it is not bypassable like chattr -i on Linux. This is quite interesting. We 100% should mention this. And we gotta somehow word it so that its clear this mitigates attacks against the shell but still will not stop other scenarios of unsandboxed apps attacking each other |
|
I suggest to use configuration profiles instead of command line to alter system settings. |
|
Is anyone aware of an in-depth analysis of macOS telemetry? Germany's Federal Office for Information Security did one for Windows: #287 (comment). Microsoft also provides Diagnostic Data Viewer which allows one to look at the data that was collected. Doug Leith from Trinity College did analysis on stock Android and iOS: https://www.scss.tcd.ie/doug.leith/pubs/apple_google2.pdf
macOS apparently transmits tons of data to Apple: https://sneak.berlin/20210202/macos-11.2-network-privacy/. There wasn't an attempt to decrypt it to find out what is transmitted exactly, compared to Windows, Android, and iOS. |
On iOS you can easily see the analytics it sends in the settings, can't find it on macOS though. It's really nothing of substance, just a bunch of crash reports and random stuff. No personal data or anything from what I can see. It's really very boring. I think if there was anything interesting it definitely would be reported on by now. |
It was found out and reported, please look at the quote:
The info was obtained by jailbreaking iPhone, patching SSL library to accept any connection as valid, and then decrypting what iPhone sends to Apple on a MitM proxy, with iPhone thinking that it's talking to genuine Apple servers. It doesn't show up in analytics logs. Same was done to Android. Windows telemetry components were disassembled (if I'm not mistaken). The question is: does anybody know about similar research done on macOS? |
Want to cover FileVault, App Sandbox, Hardened Runtime, XProtect, Gatekeeper, Notarization, threat models for each
Disclosure: I copied/used parts of https://github.com/drduh/macOS-Security-and-Privacy-Guide?tab=readme-ov-file#app-sandbox but I wrote those parts so I'm only plagiarizing myself. I also copied parts of official Apple documentation, didn't want to change them for the sake of accurate information. Wherever I do I link back to the source.