Unwanted network connections.

GreenMamba wrote:

AssetCacheLocator.xps- all kinds of weird stuff

Block it with Little Snitch, then try downloading a software update from the App Store or iTunes store - let us know if you can download anything.

It appears* to be part of the 'Apple caching service' that can simply save internet bandwidth if you have a Mac OS caching server. OS X and iOS will look for many services on the local network - it is part of what makes Apple devices 'just work' (most of the time 🙂).

http://help.apple.com/serverapp/mac/5.0/#/apd74DDE89F-08D2-4E0A-A5CD-155E345EFB8 3 (About Caching service)

From the Apple documentation:

Compare Caching service to Software Update service

… (2nd bullet point)

The Software Update server requires you to manually configure clients to only use a specific software update server; the caching server requires no client configuration. OS X and iOS devices automatically access the available caching server on the network they’re currently connected to, making it mobile-client friendly. For example, when a user is using an OS X or iOS device at work, the device uses the caching server at work. When the same user uses the same device at home, it automatically uses another caching server.

Automatic connections on the local network - nothing to worry about. Your devices will look for local cache servers and then go to the stores via the internet if one is not available. OS X & the iTunes store will periodically look for app updates - harmless.

GreenMamba wrote:

ocspd - youtube- don't use

You are wrong, this is a daemon for OCSP nothing to do with YouTube…

https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol

OCSPD updates certificates from the internet for use with secure (https) connections. It makes sure that your computer knows which certificates not to trust and which are valid, certificates can be revoked at any point in time (e.g. if they are compromised on the server).

You may actually be weakening your Mac's security by blocking OCSPD - your Mac may trust certificates that are in the hands of criminals. Using old certificates does open your Mac up to spoofing & man in the middle attacks.

You could turn off this process in 'Keychain Access, Certificates tab' preferences, if you do not value your security on the internet.

GreenMamba wrote:

nsurlsessiond - another icloud thing

Many people speculate* this is iCloud however Apple use a similar feature on iOS for all applications including ones made by third parties - it handles background downloads on iOS. I suspect it does similar things on Mac OS for any third party app, not just iCloud*.

GreenMamba wrote:

AppleIDAuth - even though icloud is off

IMTransferAgents (multiple) -- even though I've turned these off too, THEY KEEP TURNING BACK ON!

It seems like you still have not disabled all of iCloud on your iOS & OS X devices. Perhaps these are just local connections?

You may feel like I am picking on you but it is not my intention, I'm hoping that you can see that operating systems are a complex things. I'm willing to bet that you may not understand how every piece of a car works, however you probably allow yourself to be transported by one at speeds that are 'unnatural' for a human. Computers are no different, many peices working in lockstep doing things we don't understand. I doubt you would decide to disable parts of a vehicle based on similar suspicions. That would be reckless.

I truly understand the need to control your data but do you really think Apple would start a legal fight with the US government if they didn't care about your data privacy?

http://www.apple.com/customer-letter/

It doesn't add up.

* Apple do not document many OS processes, most of what you read outside of apple.com is speculation, amateur sleuthing or sometimes based on informed testing. Working out which one is accurate is half the battle.

Here's a link to another network-monitoring app. http://goo.gl/QpIayO

This is abandonware but still works, so download & use at will.

I installed it yesterday on OS X 10.11.3 and added it to my login items.

I think it works well in conjunction with Little Snitch, although its CPU usage runs high, keeping it at or near the top of the list in Activity Monitor.

Rubbernet provides a breakdown of per-app network usage, so you can quickly detect apps that phone home, connect to servers without your knowledge, or blame the app that's slowing down your network.

Macobserver article: http://goo.gl/ROLhQ2

"Rubbernet will show all of the application and services on your Mac that are using the network. Some of them are expected, such as Safari and Mail, but some of the other items listed may be ones you hadn’t thought about, such as Push Services or MobileMe. In the Summary view for each application that is found, you can see the name, status (active, inactive or idle) the user that owns the application, current download rate, current upload rate, total data in, total data out, and time of last activity. There is also a connections view, which will show the remote host, port, application, user, download rate, upload rate and last activity, so you can get very specific.

Clicking on a specific application will show the aforementioned connections items, but only for that application. You can also click on a user, and it will show the connection items that belong to that user. The preferences allow you to enable or disable IP address resolution."

OregonRebel wrote:

Here's a link to another network-monitoring app. http://goo.gl/QpIayO

This is abandonware but still works, so download & use at will.

That installer is bundling other junk.

• Yahoo search engine hijack
• Mackeeper
• Various other junk apps

Are you sure it is not doing other malicious things? Installers have become a prevalent way to attack Macs, see the many threads here detailing adware & other junk that is bundled with apps that are no longer maintained or stored on dubious servers.

Does it even install the app you want to use, nothing appeared in /Applications after 'installing' (on a throwaway installation)?!

I'm not sure that running code that is found randomly on the internet is going to help anyones privacy. Apple are the least of your worries.

There is no installer, it's an app. Period.

Please provide proof of other junk inside Rubbernet.

EasyFind can't find any reference whatsoever to the words words yahoo or mackeeper inside the app, even when searching file contents and package contents.

It's running just fine on my computer although its daemon has disconnected from monitoring the network occasionally (it just happened again).

Looks like it's not stable enough to stay connected all the time.

When it disconnects you just have to hit the Connect button to reconnect.

Your short link http://goo.gl/QpIayOgoes to…

http://www.mac-torrents.com/torrents.php?mode=details&id=a603626b64d48040e9650e8 db5a8df0b630c023f

The huge download button pulls in an installer, try it.

DON'T CLICK THE GREEN BUTTON!

Click above it on the app's name to download a torrent file (you'll need a torrent client).

Sorry, didn't think about explaining how to download it since I've used that site before and know how it works.

I made it easier, here's a link to download the app directly from a hosting site where I uploaded it. http://s000.tinyupload.com/?file_id=67652173436658543657

The big green button that says Rubbernet Download!

Yep, I realise it is a scammy site & I was duped! You trust it, more than Apple?

I don't need to test Rubbernet I tried it a while ago. I was more concerned with the download link & the chance others would click through & get pwned

Good luck with it.

"The Sparkle.framework vulnerability gives "apps" which don't use HTTPS or the Mac protocol's a VERY easy way to run a MITM attack which than can allow you to run RCE. Try to always use "apps" you need to drag into your /Applications/ folder."

What has that got to do with the topic of this discussion, which is Unwanted network connections?

Rubbernet IS an app, I already said that - it has NO installer.

I don't know what the green button tries to give you because I don't use it.

People aren't going to stop using package installers like ALL of Adobe's apps just because of the Sparkle vulnerability (which has already been addressed in a lot of updated apps).

GreenMamba wrote:

"This helped me."

I can't click it, but it did.

Thanks, I wasn't sure it you'd take it how it was intended. 🙂

I think there is a limit to the 'this helped me' button.

An extraordinarily unhelpful response, Grant. Especially from what one assumes is an experienced user (Level 9).

The question -- how does one turn off unwanted and invisible processes that regularly reach out to the internet without specifically needing the access -- is a good question, and the concern is shared widely among Mac users.

I've owned Macs since 1985, and am increasingly frustrated with the OS, which sacrifices enormous control and privacy for the sake of convenience and marketing.

Is there an effective way to regain control of the Mac's interaction with the internet? I don't think so.