Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by johnmaguire2013 on Tuesday October 20, 2020 @02:29PM (#24840777)

I think you misunderstand.

The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it.

To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine the current time, so as to verify the signature provided by the keyboard.

So, if NTP is slow to respond or time out, you are stuck waiting for your Mac to verify your keyboard's signature.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by userbinator on Tuesday October 20, 2020 @03:34PM (#24841492)

If I was an attacker I would simply hook into the key matrix. The extra obfuscation in firmware is just user-hostile and stupid.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by GekkePrutser on Tuesday October 20, 2020 @03:19PM (#24841322)

So they introduce a major usability breaker (consider opening up your macbook on a plane with no internet access) to prevent a really obscure security issue that requires an attacker to replace the entire system's top case without you noticing. Nice.

At least give the user the ability to turn that off.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by likeclockwork on Tuesday October 20, 2020 @04:25PM (#24842000)

What happens if you have networking turned off or your WiFi isn't configured for the local network?

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by johnmaguire2013 on Tuesday October 20, 2020 @07:38PM (#24843409)

Per the grandparent...

> At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by Dylan16807 on Tuesday October 20, 2020 @05:44PM (#24842664)

> Further, to avoid replay attacks it must include the current time in the message it signs.

Use a counter...?

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by johnmaguire2013 on Tuesday October 20, 2020 @07:38PM (#24843413)

I'm not trying to defend Apple here, just explain the mechanism to the parent.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by Dylan16807 on Tuesday October 20, 2020 @08:06PM (#24843607)

Oh, okay. You said "must" so I was wondering if there was another important factor.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by johnmaguire2013 on Wednesday October 21, 2020 @11:44AM (#24848935)

Sorry, that wasn't the best word choice. Certainly a counter is another viable way of performing that check. (And obviously comes with its own set of trade-offs which I'm not interested in performing value judgments on!)

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by mulmen on Tuesday October 20, 2020 @02:40PM (#24840891)

I was thinking of an external keyboard. That might be the cause of confusion.

[ Parent | on HN ]