GreenMamba

Q: Unwanted network connections.

To start I am hoping this post will be put in Apple Support Communities > Mac OS & System Software > El Capitan...

 

I am currently using a 13" Macbook Pro late 2014 RETINA display SSD hard drive with an i5 intel. However I have been using mac's for the past 10 or so years and I love them. I am starting this discussion for the simple yet complex questions involved with network activity. What ever happened to booting up your mac/system and you "the user" is the person who makes all of these outside connections to the internet. I use Little Snitch, along with iStats. It seems kind of weird to need an app to watch all of your network connections. I was always under the impression only Windows (especially windows 10) was the OS that kept and sent all of your data back to Microsoft. Simply put for the lay mac user we don't even know what the majority of these daemons are trying to connect to the web for. A quick example is gamed. I have researched and looked up all of the Game Kit Frameworks which support this protocol, in total I believe there are 16. I have looked at each and decided I don't use any of them so why does this daemon need to connect to the outside world automatically? So I decided I would not allow it to connect to the web. Unfortunately i have recently read El Capitan has "System Integrity Protection" which prevents even root from modifying system files. So in short what does this mean? Again as a lay mac user (i am not a programmer or computer engineer) why must certain items run even if I don't use them? Geo-location is another example, probably better than gamed. I am under the assumption after researching a little bit, the com.apple.geod.xpc protocol basically is a location service. Well what if I don't want my location to be documented constantly while using my mac? Why can't i just turn it off. I believe it is mainly used for Maps. I started this thread with the intention of maybe getting an answer with a list of protocols/daemons/connections which need to be made and why. It seems like everyday I am googling to see what one of these Apple services are and why I need to be allowing it to connect to the web. Recently I had an unauthorized ovh.net server attached to my netstats and it was only receiving data from my laptop. I am not sure if i caught a virus on a website or something, but it spooked me enough to wipe my SSD and do a clean re-install. For me this process isn't very difficult because i keep all of my photos and data backed up on external hard drives and i just wanted to make sure that the server which was connecting to me was gone, and took whatever little code that allowed it to connect was gone with it. In short I would really appreciate some replies with Apple services which try to connect upon startup but you do not need. I am trying to run a system with as little bloat as possible. I do not want to use iCloud but it almost seems impossible because i own an iPhone, Macbook, and other Apple products which all want to communicate (even though i wish they were just single entities). If I can please get some help with things I can get rid of without disrupting the integrity of my UNIX-like OS aka OS X El Capitan I would be very happy. I would also like to see some replies to see if anyone feels the same way I do.


Thanks


MacBook Pro (Retina, 13-inch, Mid 2014), OS X El Capitan (10.11.3)

Posted on Feb 1, 2016 8:30 AM

Close

Q: Unwanted network connections.

  • All replies
  • Helpful answers

first Previous Page 4 of 5 last Next
  • by OregonRebel,

    OregonRebel OregonRebel Mar 2, 2016 6:06 PM in response to Drew Reece
    Level 1 (37 points)
    Mac OS X
    Mar 2, 2016 6:06 PM in response to Drew Reece

    There is no installer, it's an app. Period.

     

    Please provide proof of other junk inside Rubbernet.

    EasyFind can't find any reference whatsoever to the words words yahoo or mackeeper inside the app, even when searching file contents and package contents.

     

     

    It's running just fine on my computer although its daemon has disconnected from monitoring the network occasionally (it just happened again).

    Rubbernet.png

     

    Looks like it's not stable enough to stay connected all the time.

    When it disconnects you just have to hit the Connect button to reconnect.

  • by Drew Reece,

    Drew Reece Drew Reece Mar 2, 2016 6:05 PM in response to OregonRebel
    Level 5 (7,490 points)
    Notebooks
    Mar 2, 2016 6:05 PM in response to OregonRebel

    Your short link http://goo.gl/QpIayO goes to…

    http://www.mac-torrents.com/torrents.php?mode=details&id=a603626b64d48040e9650e8 db5a8df0b630c023f

     

    The huge download button pulls in an installer, try it.

  • by OregonRebel,

    OregonRebel OregonRebel Mar 2, 2016 6:16 PM in response to Drew Reece
    Level 1 (37 points)
    Mac OS X
    Mar 2, 2016 6:16 PM in response to Drew Reece

    DON'T CLICK THE GREEN BUTTON!

    Click above it on the app's name to download a torrent file (you'll need a torrent client).

     

    Sorry, didn't think about explaining how to download it since I've used that site before and know how it works.

     

    I made it easier, here's a link to download the app directly from a hosting site where I uploaded it. http://s000.tinyupload.com/?file_id=67652173436658543657

  • by Drew Reece,

    Drew Reece Drew Reece Mar 2, 2016 6:27 PM in response to OregonRebel
    Level 5 (7,490 points)
    Notebooks
    Mar 2, 2016 6:27 PM in response to OregonRebel

    The big green button that says Rubbernet Download!

    Yep, I realise it is a scammy site & I was duped! You trust it, more than Apple?

     

    I don't need to test Rubbernet I tried it a while ago. I was more concerned with the download link & the chance others would click through & get pwned

     

    Good luck with it.

  • by GreenMamba,

    GreenMamba GreenMamba Mar 3, 2016 9:25 AM in response to OregonRebel
    Level 1 (13 points)
    Desktops
    Mar 3, 2016 9:25 AM in response to OregonRebel

    What is this link?

     

    Something to help monitor protocols?

  • by GreenMamba,

    GreenMamba GreenMamba Mar 3, 2016 9:27 AM in response to Drew Reece
    Level 1 (13 points)
    Desktops
    Mar 3, 2016 9:27 AM in response to Drew Reece

    "This helped me."

     

    I can't click it, but it did.

  • by GreenMamba,

    GreenMamba GreenMamba Mar 3, 2016 9:31 AM in response to Drew Reece
    Level 1 (13 points)
    Desktops
    Mar 3, 2016 9:31 AM in response to Drew Reece

    The Sparkle.framework vulnerability gives "apps" which don't use HTTPS or the Mac protocol's a VERY easy way to run a MITM attack which than can allow you to run RCE. Try to always use "apps" you need to drag into your /Applications/ folder.

  • by OregonRebel,

    OregonRebel OregonRebel Mar 3, 2016 10:40 AM in response to GreenMamba
    Level 1 (37 points)
    Mac OS X
    Mar 3, 2016 10:40 AM in response to GreenMamba

    "The Sparkle.framework vulnerability gives "apps" which don't use HTTPS or the Mac protocol's a VERY easy way to run a MITM attack which than can allow you to run RCE. Try to always use "apps" you need to drag into your /Applications/ folder."

     

    What has that got to do with the topic of this discussion, which is Unwanted network connections?

     

    Rubbernet IS an app, I already said that - it has NO installer.

    I don't know what the green button tries to give you because I don't use it.

     

    People aren't going to stop using package installers like ALL of Adobe's apps just because of the Sparkle vulnerability (which has already been addressed in a lot of updated apps).

  • by Drew Reece,

    Drew Reece Drew Reece Mar 3, 2016 2:46 PM in response to GreenMamba
    Level 5 (7,490 points)
    Notebooks
    Mar 3, 2016 2:46 PM in response to GreenMamba

    GreenMamba wrote:

     

    "This helped me."

     

    I can't click it, but it did.

    Thanks, I wasn't sure it you'd take it how it was intended.

     

    I think there is a limit to the 'this helped me' button.

  • by NCBlues,

    NCBlues NCBlues Mar 5, 2016 9:24 PM in response to Grant Bennet-Alder
    Level 1 (0 points)
    Mar 5, 2016 9:24 PM in response to Grant Bennet-Alder

    An extraordinarily unhelpful response, Grant.  Especially from what one assumes is an experienced user (Level 9). 

     

    The question -- how does one turn off unwanted and invisible processes that regularly reach out to the internet without specifically needing the access -- is a good question, and the concern is shared widely among Mac users.

     

    I've owned Macs since 1985, and am increasingly frustrated with the OS, which sacrifices enormous control and privacy for the sake of convenience and marketing. 

     

    Is there an effective way to regain control of the Mac's interaction with the internet?  I don't think so.

  • by GreenMamba,

    GreenMamba GreenMamba Mar 8, 2016 7:44 AM in response to NCBlues
    Level 1 (13 points)
    Desktops
    Mar 8, 2016 7:44 AM in response to NCBlues

    NCBlues,

     

    I think you are the first person to understand my post. I think Grant troll's most of the time. By the way NCBlue's I don't know if you have seen this new article which is out. But basically it uses 1password to relay ALL of your information over loopback in clear text. Meaning your financial data aka credit cards, passwords, personal data, etc. I actually turned wireshark on to sniff the vectors myself. And I just get more aggravated each and every time I use it.

     

    Maybe I can simplify this "question" even though its a discussion. How THE **** can I turn everything off which tries to connect to the internet on system startup. Then I will decide which ones I want to run, like App Store (because i have to in order to get OS updates). Obviously OS X is now made for people who want EVERYTHING connected. Well I am not one of those people. I want ethernet cables and external physical storage for my data. Two more examples which drive me nuts and i CAN NOT turn "OFF".. iCloud... and having iMessages/Facetime etc. pop-up on my MacBook Pro.. yea no thanks. I disable them in preferences yet they still come up. I don't get it.

     

    P.S

    NCBlues >>> https://medium.com/@rosshosman/1password-sends-your-password-across-the-loopback -interface-in-clear-text-307cefca6389#.8…

    Make sure you check that site out.

     

    Thanks,

    Mamba

  • by OregonRebel,

    OregonRebel OregonRebel Mar 9, 2016 4:21 PM in response to GreenMamba
    Level 1 (37 points)
    Mac OS X
    Mar 9, 2016 4:21 PM in response to GreenMamba

    I believe you could create a rule for Any Process in Little Snitch to deny all outgoing connections. But then you'd have no access to the Internet or email.

    LS is supposed to check for Deny rules before Allow rules, so that should stop all outgoing connections even if the default system rules are still are enabled.

     

    It may be time-consuming, but the best way is probably to create individual Deny rules for each process you want to block, which is rather easily done from the LS Network Monitor window: Right-click a connection and select Create Rule...

     

    You could always disable your network in System Preferences before rebooting, or unplug your Ethernet cable if connected via Ethernet.

    But doing either of those will allow processes to start calling out again once the connection has been restored.

     

    There's no way to stop many of the system processes from trying to call out, so the only option is to block them.

  • by GreenMamba,

    GreenMamba GreenMamba Mar 10, 2016 6:15 AM in response to OregonRebel
    Level 1 (13 points)
    Desktops
    Mar 10, 2016 6:15 AM in response to OregonRebel

    You shouldn't need LS to disable bloat. BTW did you click that link i provided above? You should.

  • by OregonRebel,

    OregonRebel OregonRebel Mar 10, 2016 7:21 PM in response to GreenMamba
    Level 1 (37 points)
    Mac OS X
    Mar 10, 2016 7:21 PM in response to GreenMamba

    I read it but am not concerned - I'm not gonna stop using 1Password unless an exploit becomes known.

    I've got bigger things to worry about.

  • by Dr. Chet,

    Dr. Chet Dr. Chet Aug 3, 2016 8:18 AM in response to OregonRebel
    Level 1 (34 points)
    Aug 3, 2016 8:18 AM in response to OregonRebel

    THANK YOU GreenMamba and OregonRebel for bringing up this important topic! I realize I'm late joining the conversation but I just came across it. I use a Macbook Pro with Yosemite for recording music, and these unwanted connections became a real issue during a session where a great take by a client was ruined by a glitch that turned out to be gamed making thousands of connections. I turned off the Wi-Fi altogether but noticed that gamed kept trying to connect, although not as many times as before. Even after I blocked it with Little Snitch it kept trying. I was finally able to disable it entirely since I never use that machine for games, but when I heard that it was considered a part of the "core" of 10.11 I decided against upgrading.

     

    I also had to block photolibrary because I never use it, or anything on iCloud at all.

     

    I would just like simple options in, say, the Control Panel, to turn off games, iCloud, and anything else that wants to connect that is not strictly necessary without my consent (i.e. I have no problem with the system, anti-virus, or LS for example, auto-updating).

     

    I know a lot of my Mac-using friends feel the same way, and we figured what's the point in complaining, but maybe if enough of us do, things might change ... a bit. I can dream.

     

    Thanks for the thread.

first Previous Page 4 of 5 last Next