Unwanted network connections.

Question

Level 1

25 points

Unwanted network connections.

To start I am hoping this post will be put in Apple Support Communities > Mac OS & System Software > El Capitan...

I am currently using a 13" Macbook Pro late 2014 RETINA display SSD hard drive with an i5 intel. However I have been using mac's for the past 10 or so years and I love them. I am starting this discussion for the simple yet complex questions involved with network activity. What ever happened to booting up your mac/system and you "the user" is the person who makes all of these outside connections to the internet. I use Little Snitch, along with iStats. It seems kind of weird to need an app to watch all of your network connections. I was always under the impression only Windows (especially windows 10) was the OS that kept and sent all of your data back to Microsoft. Simply put for the lay mac user we don't even know what the majority of these daemons are trying to connect to the web for. A quick example is gamed. I have researched and looked up all of the Game Kit Frameworks which support this protocol, in total I believe there are 16. I have looked at each and decided I don't use any of them so why does this daemon need to connect to the outside world automatically? So I decided I would not allow it to connect to the web. Unfortunately i have recently read El Capitan has "System Integrity Protection" which prevents even root from modifying system files. So in short what does this mean? Again as a lay mac user (i am not a programmer or computer engineer) why must certain items run even if I don't use them? Geo-location is another example, probably better than gamed. I am under the assumption after researching a little bit, the com.apple.geod.xpc protocol basically is a location service. Well what if I don't want my location to be documented constantly while using my mac? Why can't i just turn it off. I believe it is mainly used for Maps. I started this thread with the intention of maybe getting an answer with a list of protocols/daemons/connections which need to be made and why. It seems like everyday I am googling to see what one of these Apple services are and why I need to be allowing it to connect to the web. Recently I had an unauthorized ovh.net server attached to my netstats and it was only receiving data from my laptop. I am not sure if i caught a virus on a website or something, but it spooked me enough to wipe my SSD and do a clean re-install. For me this process isn't very difficult because i keep all of my photos and data backed up on external hard drives and i just wanted to make sure that the server which was connecting to me was gone, and took whatever little code that allowed it to connect was gone with it. In short I would really appreciate some replies with Apple services which try to connect upon startup but you do not need. I am trying to run a system with as little bloat as possible. I do not want to use iCloud but it almost seems impossible because i own an iPhone, Macbook, and other Apple products which all want to communicate (even though i wish they were just single entities). If I can please get some help with things I can get rid of without disrupting the integrity of my UNIX-like OS aka OS X El Capitan I would be very happy. I would also like to see some replies to see if anyone feels the same way I do.

Thanks

MacBook Pro (Retina, 13-inch, Mid 2014), OS X El Capitan (10.11.3)

Posted on Feb 1, 2016 8:30 AM

Reply

Answer 1

Feb 7, 2016 3:20 AM in response to killhippie

You can always kill the process in Activity Monitor after booting.

I just checked and had two of them running, had to force quit to kill 'em.

You can probably make a script to kill 'em after startup if you're into that.

I didn't find a Terminal command to disable it.

You may be able to move, lock or dispose of it if you know you'll never need it.

It's in the System folder, so get an answer from someone more qualified before doing anything with it.

It's located at /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteUR LConnectionAgent.xpc.

Reply

Answer 2

Feb 7, 2016 6:31 AM in response to OregonRebel

OregonRebel wrote:

You can always kill the process in Activity Monitor after booting.

Maybe not - IMRemoteURLConnectionAgent keeps popping back up in Activity Monitor.

Reply

Answer 3

Drew Reece

Level 6

10,660 points

Feb 7, 2016 9:24 AM in response to OregonRebel

OregonRebel wrote:

OregonRebel wrote:

You can always kill the process in Activity Monitor after booting.

Maybe not - IMRemoteURLConnectionAgent keeps popping back up in Activity Monitor.

Have you even looked to see if it is a background task that the OS want active all the time? Killing processes that the OS is managing will never work.

In Terminal…

launchctl list

or since you don't use SIP check all the system jobs…

sudo launchctl list | grep IMRemote

There are right & wrong ways to achieve everything. Maybe you should learn about unloading processes correctly instead of 'failing to murder' things that scare you.

https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man8/launchd.8.html

Reply

Answer 4

Feb 7, 2016 3:37 PM in response to Drew Reece

It seems you too missed the point of this discussion.

I've used Terminal to change all sorts of things, but I'm not interested in reading any manuals for an in-depth training course.

It's not that any specific process is running that we're concerned about, it's that many of them make unwanted connections. There's no need for dozens/hundreds of call-home attempts daily for processes we aren't using.

THAT'S the point of this discussion - Unwanted network connections.

Not unwanted processes running.

BTW, there are kill and force quit functions in A.M. for a reason.

Whether it be WindowServer, mds, iconservicesagent, coreservicesd or another process, sometimes they need to be "murdered."

They may be runaway process or may be functioning as intended, but are just so annoying and unnecessary that they deserve to be executed.

Reply

Answer 5

Feb 7, 2016 4:04 PM in response to OregonRebel

I know that Spotlight sends search data to apple, and disabling certain options was supposed to prevent that.

But I still see SpotlightNethelper connection attempts every day.

Evidently "every single keypress is sent to api.smoot.apple.com along with very accurate longitude and latitude and device information." http://goo.gl/HpB0MD

EVERY SINGLE KEYPRESS.

"In Yosemite, all Safari web searches are sent to not only the search engine you've selected (e.g., Google, DuckDuckGo), but also to Apple, even if you've disabled "Spotlight Suggestions" (System Preferences > Spotlight Suggestions, as per Apple's privacy documentation) and sharing of Usage and Diagnostics data." https://goo.gl/bTEjv8

Obviously this also applies to El Capitan.

I DON'T WANT APPLE SPYING ON ME! That sort of privacy intrusion is why we're so concerned about all the connections.

Reply

Answer 6

Drew Reece

Level 6

10,660 points

Feb 7, 2016 5:24 PM in response to OregonRebel

OregonRebel wrote:

It seems you too missed the point of this discussion.

I was responding to you directly, in an attempt to highlight why the process 'pops back up'. I have already added my thoughts on this topic.

If you don't want to know why they return that is fine but you will not manage to stop these processes unless you actually unload the job that is specifically keeping them alive. It helps to learn how something works before you use tools on it, but who can be bothered to read manuals?

OregonRebel wrote:

I DON'T WANT APPLE SPYING ON ME! That sort of privacy intrusion is why we're so concerned about all the connections.

This is not the OS for you, the good news is that a Mac can install Linux, Windows, BSD…

Reply

Answer 7

Feb 7, 2016 7:04 PM in response to Drew Reece

I'll bet there are millions of OS X users who don't want EVERY SINGLE KEYSTROKE being sent to Apple!

They should all continue using Apple hardware but find alternative OS's to protect their privacy? 😕

I've been using Apple's OS's since Panther and have managed to become an advanced user despite never having read the manual pages. I can usually find commands online for what I want to do, if there is a command for it.

I have a lot of software installed and have never read even one page of the manuals for most of them. Others I refer to as necessary.

If you're happy letting Apple know where you are at all times, what websites you're viewing and everything else you do on your computer/device, that's your prerogative. But I don't recall signing away my privacy rights when I bought my Mac.

Maybe it's in the EULA (which I also haven't read).

Seems like Apple has become Big Brother and is monitoring our every move.

I thought that was Google's job. 👿

Reply

Answer 8

GreenMamba Author

Level 1

25 points

Feb 8, 2016 8:07 AM in response to Drew Reece

Drew Reece, FishingAddict ; OregonRebel ; ....

I wish I was able to click "This Helped Me" for the 3 of you but for some reason i cannot.

I will start with Drew Reece. I was a windows user when I got my first computer which was a Gateway Destination not long after I began learning HTML and other old useless languages in 98-2002. After a few years of Windows, using AOL chatrooms to transfer files in order to compare notes with other users then moving to IRC in 99' to do almost the same thing; the people I spoke with on the web (IRC chat rooms) and myself started to figure out DOS was already using this "strange strings" of code embedded in applications like Office, and not only that but they were extremely vulnerable. By the time XP was released the outgoing and incoming data links were so many and so insecure i decided to buy Mandrake Linux (yes, buy it. at that time 56k wasn't fast enough to download OS's via the web, Mandrake was an open source free Linux OS but I had to buy the discs at a local Best Buy to install). Anyway once I started using Linux i very much preferred it. Now lets fast forward to my first Apple purchase. I bought a black Macbook in I believe 2003-04. I researched them and just like Linux it ran on a UNIX-like OS ( https://en.wikipedia.org/wiki/Unix-like ), however while researching it seemed as though the Macbook focused more on the UNIX bare bones protocols then mandrake or redhat (at the time), plus it had a pretty GUI. This is my opinion. Anyway I think I started on OS 9, although I am not sure.

As far as your Kali reference.. I use Kali from time to time but mainly for pen-testing. The only other OS I use because I want to (when I am not using OS X of course) is Arch and thats mainly for work.

As far as your comment on SIP. I have no reason to block it or not allow it to work. Enabling apps from communicating with each other especially on a root level can be a security issue. The entire reason this post started was mainly due to my issue with OS X's transparency as of late but also because of the new Sparkle.framework problem. Ive been told its not big issue well; I found a payload written in pencil on a napkin in a bar and tried it on myself with HTTP not HTTPS and it works as a MITM attack and you also get full RCE, contrary to popular belief. Using it with HTTPS makes it blow up. Also I understand sandbox is a good idea and can and should work well, I just need to research it more. It does much more than I can find on official Apple forums. I've been speaking with people who dev OS X apps to get a better handle on it. Sounds like a nice security feature /me thinks. I don't think an advanced mac user needs QRadar on their home nets (hehe). Err.. would be funny if you ever worked somewhere who uses it.

Now.. OregonRebel.. I don't wear a tinfoil hat but I've done some Red Team work in the past and just like to know how things work. Like you, I have never watched a video in iTunes and get the same results. And google commerce connecting makes me sick. But when you click "Accept" on that Facebook licensing agreement; well you agree to a lot of pretty wild stuff. You're even agreeing to things which will happen in the future before they even happen. Meaning they sell your photos and media to people like Google then collect royalties and marketing fees from your data, Maybe this is the reason for the googlecommerce connections? To sell you crap when your on the web. But I do not know.

Finally FishingAddict .. I'm a fishing addict as well. I bought a 17 foot bass boat last spring. Will be doing tournaments this year.

As far as your response. I liked it a lot . And one of those "System Preferences" command you had wasn't enabled correctly for me and helped me out. Thank you FishingAddict.

I want to finish by saying again I am not a programmer (anymore) I do not work in tech (anymore) and I don't do any kind of paid hacking aka pen-testing for any companies (anymore).... I am currently in sales. But I still like reverse engineering and technology in general as a hobby. I just want to be able to use my Macbook Pro with OS X (which i believe is the best product on the market) and not have 19 protocol's call home as soon as my system boots up. Unless they HAVE TO.

Anyway best regards to you all, and I am happy this thread is getting some attention.

Thanks,

-xochi.xo.e2xo.intercept.fx.mamba

Reply

Answer 9

Drew Reece

Level 6

10,660 points

Feb 8, 2016 11:00 AM in response to GreenMamba

GreenMamba wrote:

Drew Reece, FishingAddict ; OregonRebel ; ....

I wish I was able to click "This Helped Me" for the 3 of you but for some reason i cannot.

No problem the tokens here are worthless anyway, they don't pay my bills 🙂. I'm glad you got some value from it.

I think the Sparkle issue it is blocked by default via Gatekeeper if 'allow from anywhere' is not enabled unless I have read the wrong sources. Developers with Apple certs will get them pulled once it is seen in the wild. It's hardly Apple's fault that the Sparkle devs allowed http updates though.

QRadar looks like overkill but I think the network is where this needs to be blocked since iOS & other devices squirt out the same GPS data all the time. It is used for improving Apple's services (Diagnostics & usage in settings.app on iOS is supposed to disable it). You can disable Mac processes via launchctl if you really want to do so, but it is very unclear what else these jobs do - YMMV.

Good luck with it, give Charles a go to see what is in the http requests, it may help you see what is sent.

http://charlesproxy.com/

Reply

Answer 10

Feb 9, 2016 2:36 AM in response to GreenMamba

Whoa - I said I was advanced, but not that advanced.

I would prefer to enable SIP again, but Apple doesn't seem to be ashamed of their fugly Dock which needs a bag over it. So I'll continue using cDock for the foreseeable future despite the vulnerabilities that were introduced when SIP was disabled.

I've always wondered what the points here were good for - I thought maybe something actually useful like discounts toward Apple merchandise.

But I just read about the "privileges" granted for different levels and LMAO! What a worthless incentive! Like winning a cupie doll, only that's more tangible.

Way to go Apple - get people to spend countless hours helping others with their problems FOR FREE so you won't have to pay your AppleCare reps to do it.

I'll just revel in my 25 points and the knowledge that I haven't donated hundreds of hours to Apple in exchange for attending a conference call or to "access The Lounge and My Subscriptions for high level users."

Award points, level up, and earn new privileges

I've never seen another site where you had to work your way to some arbitrary level before you were given the "priviledge" of uploading a custom avatar.

Reply

Answer 11

Feb 9, 2016 2:33 AM in response to GreenMamba

First post didn't show up even after logging out & back in, so I posted it again and then they both appeared.

So I changed one to this explanation.

Reply

Answer 12

Feb 9, 2016 2:57 AM in response to GreenMamba

Forgot to say I don't have a FB or Twitter account.

Reply

Answer 13

Feb 9, 2016 7:59 AM in response to OregonRebel

I would prefer to enable SIP again

Then buy your software from a developer who has a valid developer certificate from Apple. These do not require you to defeat SIP.

Reply

Answer 14

GreenMamba Author

Level 1

25 points

Feb 9, 2016 3:39 PM in response to OregonRebel

OregonRebel:

When I referred to FB i was basically referring to every social media platform. FB posted there Q3 financial data and they made a billion dollars in earnings this last quarter. And somehow there stock is going down. Anyway point being OregonRebel; almost every social media platform uses FB's "user agreement" "licensing agreement" or whatever they call it today. So unless you use email on a server you pay for or have 0 social media accounts that previous comment applies. The reason they are copying Facebook's agreements(kind of) is due to the fact that they cant make **** and FB is killing it. I will include some citing. Videolan aka VLC media player isn't on the "Apple app store" but they are a certified application, and they are also open source. From what I have read hackers do not target open source developers. I have been in touch with VideoLan and they said at the time they were vulnerable but were updating that night. This was 3 nights ago.

In response to Grant Bennet-Alder valid certs don't matter. If the dev uses HTTP or plaintext ************** and don't use HTTPS they are vulnerable. I am not going to explain this on a forum. **** Javascript <3 , mitm, WebView atp/ftp... sigh

Anyways OregonRebel here is some data and why everyone else is using their strategy now.

"Third Quarter 2015 Other Financial Highlights

Mobile advertising revenue - Mobile advertising revenue represented approximately 78% of advertising revenue for the third quarter of 2015, up from 66% of advertising revenue in the third quarter of 2014.
Capital expenditures - Capital expenditures for the third quarter of 2015 were $780 million.
Cash and cash equivalents and marketable securities - Cash and cash equivalents and marketable securities were $15.83 billionat the end of the third quarter of 2015.
Free cash flow - Free cash flow for the third quarter of 2015 was $1.41 billion."

later,

sysreset.acidstorm.void. x0.no

Reply

Answer 15

GreenMamba Author

Level 1

25 points

Feb 9, 2016 3:43 PM in response to Drew Reece

Qradar was a joke. If you ever worked as a sec analyst for a decent sized co. maybe you have used it (almost certainly). It's proprietary and very expensive. But yes I did enjoy your post, thanks. Also Drew it is Apple's protocol... so it is their fault. I mean yes the dev's should have used HTTPS but a lot of these programs have been around for ages. However if you're blocking almost everything from your gateway you'll have no issues. Unfortunately we are in the MINORITY. This post is just to open peoples eyes and let them know about all of the connections being made with or without their consent. I hope your continue to follow the post. I am a bit useless now because i went out for happy hour after work. But I needed to reply.

Reply