Q: Unwanted network connections.
-
Feb 7, 2016 4:04 PMby OregonRebel,I know that Spotlight sends search data to apple, and disabling certain options was supposed to prevent that.
But I still see SpotlightNethelper connection attempts every day.
Evidently "every single keypress is sent to api.smoot.apple.com along with very accurate longitude and latitude and device information." http://goo.gl/HpB0MD
EVERY SINGLE KEYPRESS.
"In Yosemite, all Safari web searches are sent to not only the search engine you've selected (e.g., Google, DuckDuckGo), but also to Apple, even if you've disabled "Spotlight Suggestions" (System Preferences > Spotlight Suggestions, as per Apple's privacy documentation) and sharing of Usage and Diagnostics data." https://goo.gl/bTEjv8
Obviously this also applies to El Capitan.
I DON'T WANT APPLE SPYING ON ME! That sort of privacy intrusion is why we're so concerned about all the connections.
-
Feb 7, 2016 5:24 PMby Drew Reece,OregonRebel wrote:
It seems you too missed the point of this discussion.
I was responding to you directly, in an attempt to highlight why the process 'pops back up'. I have already added my thoughts on this topic.
If you don't want to know why they return that is fine but you will not manage to stop these processes unless you actually unload the job that is specifically keeping them alive. It helps to learn how something works before you use tools on it, but who can be bothered to read manuals?
OregonRebel wrote:
I DON'T WANT APPLE SPYING ON ME! That sort of privacy intrusion is why we're so concerned about all the connections.
This is not the OS for you, the good news is that a Mac can install Linux, Windows, BSD…
-
Feb 7, 2016 7:04 PMby OregonRebel,I'll bet there are millions of OS X users who don't want EVERY SINGLE KEYSTROKE being sent to Apple!
They should all continue using Apple hardware but find alternative OS's to protect their privacy?
I've been using Apple's OS's since Panther and have managed to become an advanced user despite never having read the manual pages. I can usually find commands online for what I want to do, if there is a command for it.
I have a lot of software installed and have never read even one page of the manuals for most of them. Others I refer to as necessary.
If you're happy letting Apple know where you are at all times, what websites you're viewing and everything else you do on your computer/device, that's your prerogative. But I don't recall signing away my privacy rights when I bought my Mac.
Maybe it's in the EULA (which I also haven't read).
Seems like Apple has become Big Brother and is monitoring our every move.
I thought that was Google's job.
-
Feb 8, 2016 8:07 AMby GreenMamba,Drew Reece, FishingAddict ; OregonRebel ; ....
I wish I was able to click "This Helped Me" for the 3 of you but for some reason i cannot.
I will start with Drew Reece. I was a windows user when I got my first computer which was a Gateway Destination not long after I began learning HTML and other old useless languages in 98-2002. After a few years of Windows, using AOL chatrooms to transfer files in order to compare notes with other users then moving to IRC in 99' to do almost the same thing; the people I spoke with on the web (IRC chat rooms) and myself started to figure out DOS was already using this "strange strings" of code embedded in applications like Office, and not only that but they were extremely vulnerable. By the time XP was released the outgoing and incoming data links were so many and so insecure i decided to buy Mandrake Linux (yes, buy it. at that time 56k wasn't fast enough to download OS's via the web, Mandrake was an open source free Linux OS but I had to buy the discs at a local Best Buy to install). Anyway once I started using Linux i very much preferred it. Now lets fast forward to my first Apple purchase. I bought a black Macbook in I believe 2003-04. I researched them and just like Linux it ran on a UNIX-like OS ( https://en.wikipedia.org/wiki/Unix-like ), however while researching it seemed as though the Macbook focused more on the UNIX bare bones protocols then mandrake or redhat (at the time), plus it had a pretty GUI. This is my opinion. Anyway I think I started on OS 9, although I am not sure.
As far as your Kali reference.. I use Kali from time to time but mainly for pen-testing. The only other OS I use because I want to (when I am not using OS X of course) is Arch and thats mainly for work.
As far as your comment on SIP. I have no reason to block it or not allow it to work. Enabling apps from communicating with each other especially on a root level can be a security issue. The entire reason this post started was mainly due to my issue with OS X's transparency as of late but also because of the new Sparkle.framework problem. Ive been told its not big issue well; I found a payload written in pencil on a napkin in a bar and tried it on myself with HTTP not HTTPS and it works as a MITM attack and you also get full RCE, contrary to popular belief. Using it with HTTPS makes it blow up. Also I understand sandbox is a good idea and can and should work well, I just need to research it more. It does much more than I can find on official Apple forums. I've been speaking with people who dev OS X apps to get a better handle on it. Sounds like a nice security feature /me thinks. I don't think an advanced mac user needs QRadar on their home nets (hehe). Err.. would be funny if you ever worked somewhere who uses it.
Now.. OregonRebel.. I don't wear a tinfoil hat but I've done some Red Team work in the past and just like to know how things work. Like you, I have never watched a video in iTunes and get the same results. And google commerce connecting makes me sick. But when you click "Accept" on that Facebook licensing agreement; well you agree to a lot of pretty wild stuff. You're even agreeing to things which will happen in the future before they even happen. Meaning they sell your photos and media to people like Google then collect royalties and marketing fees from your data, Maybe this is the reason for the googlecommerce connections? To sell you crap when your on the web. But I do not know.
Finally FishingAddict .. I'm a fishing addict as well. I bought a 17 foot bass boat last spring. Will be doing tournaments this year.
As far as your response. I liked it a lot . And one of those "System Preferences" command you had wasn't enabled correctly for me and helped me out. Thank you FishingAddict.
I want to finish by saying again I am not a programmer (anymore) I do not work in tech (anymore) and I don't do any kind of paid hacking aka pen-testing for any companies (anymore).... I am currently in sales. But I still like reverse engineering and technology in general as a hobby. I just want to be able to use my Macbook Pro with OS X (which i believe is the best product on the market) and not have 19 protocol's call home as soon as my system boots up. Unless they HAVE TO.
Anyway best regards to you all, and I am happy this thread is getting some attention.
Thanks,
-xochi.xo.e2xo.intercept.fx.mamba
-
Feb 8, 2016 11:00 AMby Drew Reece,GreenMamba wrote:
Drew Reece, FishingAddict ; OregonRebel ; ....
I wish I was able to click "This Helped Me" for the 3 of you but for some reason i cannot.
No problem the tokens here are worthless anyway, they don't pay my bills . I'm glad you got some value from it.
I think the Sparkle issue it is blocked by default via Gatekeeper if 'allow from anywhere' is not enabled unless I have read the wrong sources. Developers with Apple certs will get them pulled once it is seen in the wild. It's hardly Apple's fault that the Sparkle devs allowed http updates though.
QRadar looks like overkill but I think the network is where this needs to be blocked since iOS & other devices squirt out the same GPS data all the time. It is used for improving Apple's services (Diagnostics & usage in settings.app on iOS is supposed to disable it). You can disable Mac processes via launchctl if you really want to do so, but it is very unclear what else these jobs do - YMMV.
Good luck with it, give Charles a go to see what is in the http requests, it may help you see what is sent.
-
Feb 9, 2016 2:36 AMby OregonRebel,Whoa - I said I was advanced, but not that advanced.
I would prefer to enable SIP again, but Apple doesn't seem to be ashamed of their fugly Dock which needs a bag over it. So I'll continue using cDock for the foreseeable future despite the vulnerabilities that were introduced when SIP was disabled.
I've always wondered what the points here were good for - I thought maybe something actually useful like discounts toward Apple merchandise.
But I just read about the "privileges" granted for different levels and LMAO! What a worthless incentive! Like winning a cupie doll, only that's more tangible.
Way to go Apple - get people to spend countless hours helping others with their problems FOR FREE so you won't have to pay your AppleCare reps to do it.
I'll just revel in my 25 points and the knowledge that I haven't donated hundreds of hours to Apple in exchange for attending a conference call or to "access The Lounge and My Subscriptions for high level users."
Award points, level up, and earn new privileges
I've never seen another site where you had to work your way to some arbitrary level before you were given the "priviledge" of uploading a custom avatar.
-
Feb 9, 2016 3:39 PMby GreenMamba,OregonRebel:
When I referred to FB i was basically referring to every social media platform. FB posted there Q3 financial data and they made a billion dollars in earnings this last quarter. And somehow there stock is going down. Anyway point being OregonRebel; almost every social media platform uses FB's "user agreement" "licensing agreement" or whatever they call it today. So unless you use email on a server you pay for or have 0 social media accounts that previous comment applies. The reason they are copying Facebook's agreements(kind of) is due to the fact that they cant make **** and FB is killing it. I will include some citing. Videolan aka VLC media player isn't on the "Apple app store" but they are a certified application, and they are also open source. From what I have read hackers do not target open source developers. I have been in touch with VideoLan and they said at the time they were vulnerable but were updating that night. This was 3 nights ago.
In response to Grant Bennet-Alder valid certs don't matter. If the dev uses HTTP or plaintext ************** and don't use HTTPS they are vulnerable. I am not going to explain this on a forum. **** Javascript <3 , mitm, WebView atp/ftp... sigh
Anyways OregonRebel here is some data and why everyone else is using their strategy now.
"Third Quarter 2015 Other Financial Highlights
- Mobile advertising revenue - Mobile advertising revenue represented approximately 78% of advertising revenue for the third quarter of 2015, up from 66% of advertising revenue in the third quarter of 2014.
- Capital expenditures - Capital expenditures for the third quarter of 2015 were $780 million.
- Cash and cash equivalents and marketable securities - Cash and cash equivalents and marketable securities were $15.83 billionat the end of the third quarter of 2015.
- Free cash flow - Free cash flow for the third quarter of 2015 was $1.41 billion."
later,
sysreset.acidstorm.void. x0.no
<Edited by Host>
-
Feb 9, 2016 3:43 PMby GreenMamba,Qradar was a joke. If you ever worked as a sec analyst for a decent sized co. maybe you have used it (almost certainly). It's proprietary and very expensive. But yes I did enjoy your post, thanks. Also Drew it is Apple's protocol... so it is their fault. I mean yes the dev's should have used HTTPS but a lot of these programs have been around for ages. However if you're blocking almost everything from your gateway you'll have no issues. Unfortunately we are in the MINORITY. This post is just to open peoples eyes and let them know about all of the connections being made with or without their consent. I hope your continue to follow the post. I am a bit useless now because i went out for happy hour after work. But I needed to reply.
-
Feb 18, 2016 8:08 AMby GreenMamba,AssetCacheLocator.xps- all kinds of weird stuff
ocspd - youtube- don't use
AppleIDAuth - even though icloud is off
nsurlsessiond - another icloud thing
IMTransferAgents (multiple) -- even though I've turned these off too, THEY KEEP TURNING BACK ON!
Help with the last PLEASE. How can i STOP my iPhone from communicating with my macbook pro.
oh yeah the FaceTime protocols too always running.
-
Feb 18, 2016 10:16 AMby Drew Reece,GreenMamba wrote:
AssetCacheLocator.xps- all kinds of weird stuff
Block it with Little Snitch, then try downloading a software update from the App Store or iTunes store - let us know if you can download anything.
It appears* to be part of the 'Apple caching service' that can simply save internet bandwidth if you have a Mac OS caching server. OS X and iOS will look for many services on the local network - it is part of what makes Apple devices 'just work' (most of the time ).
http://help.apple.com/serverapp/mac/5.0/#/apd74DDE89F-08D2-4E0A-A5CD-155E345EFB8 3 (About Caching service)
From the Apple documentation:
Compare Caching service to Software Update service
… (2nd bullet point)
- The Software Update server requires you to manually configure clients to only use a specific software update server; the caching server requires no client configuration. OS X and iOS devices automatically access the available caching server on the network they’re currently connected to, making it mobile-client friendly. For example, when a user is using an OS X or iOS device at work, the device uses the caching server at work. When the same user uses the same device at home, it automatically uses another caching server.
Automatic connections on the local network - nothing to worry about. Your devices will look for local cache servers and then go to the stores via the internet if one is not available. OS X & the iTunes store will periodically look for app updates - harmless.
GreenMamba wrote:
ocspd - youtube- don't use
You are wrong, this is a daemon for OCSP nothing to do with YouTube…
https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
OCSPD updates certificates from the internet for use with secure (https) connections. It makes sure that your computer knows which certificates not to trust and which are valid, certificates can be revoked at any point in time (e.g. if they are compromised on the server).
You may actually be weakening your Mac's security by blocking OCSPD - your Mac may trust certificates that are in the hands of criminals. Using old certificates does open your Mac up to spoofing & man in the middle attacks.
You could turn off this process in 'Keychain Access, Certificates tab' preferences, if you do not value your security on the internet.
GreenMamba wrote:
nsurlsessiond - another icloud thing
Many people speculate* this is iCloud however Apple use a similar feature on iOS for all applications including ones made by third parties - it handles background downloads on iOS. I suspect it does similar things on Mac OS for any third party app, not just iCloud*.
GreenMamba wrote:
AppleIDAuth - even though icloud is off
IMTransferAgents (multiple) -- even though I've turned these off too, THEY KEEP TURNING BACK ON!
It seems like you still have not disabled all of iCloud on your iOS & OS X devices. Perhaps these are just local connections?
You may feel like I am picking on you but it is not my intention, I'm hoping that you can see that operating systems are a complex things. I'm willing to bet that you may not understand how every piece of a car works, however you probably allow yourself to be transported by one at speeds that are 'unnatural' for a human. Computers are no different, many peices working in lockstep doing things we don't understand. I doubt you would decide to disable parts of a vehicle based on similar suspicions. That would be reckless.
I truly understand the need to control your data but do you really think Apple would start a legal fight with the US government if they didn't care about your data privacy?
http://www.apple.com/customer-letter/
It doesn't add up.
* Apple do not document many OS processes, most of what you read outside of apple.com is speculation, amateur sleuthing or sometimes based on informed testing. Working out which one is accurate is half the battle.
-
Mar 2, 2016 4:02 PMby OregonRebel,Here's a link to another network-monitoring app. http://goo.gl/QpIayO
This is abandonware but still works, so download & use at will.
I installed it yesterday on OS X 10.11.3 and added it to my login items.
I think it works well in conjunction with Little Snitch, although its CPU usage runs high, keeping it at or near the top of the list in Activity Monitor.
Rubbernet provides a breakdown of per-app network usage, so you can quickly detect apps that phone home, connect to servers without your knowledge, or blame the app that's slowing down your network.
Macobserver article: http://goo.gl/ROLhQ2
"Rubbernet will show all of the application and services on your Mac that are using the network. Some of them are expected, such as Safari and Mail, but some of the other items listed may be ones you hadn’t thought about, such as Push Services or MobileMe. In the Summary view for each application that is found, you can see the name, status (active, inactive or idle) the user that owns the application, current download rate, current upload rate, total data in, total data out, and time of last activity. There is also a connections view, which will show the remote host, port, application, user, download rate, upload rate and last activity, so you can get very specific.
Clicking on a specific application will show the aforementioned connections items, but only for that application. You can also click on a user, and it will show the connection items that belong to that user. The preferences allow you to enable or disable IP address resolution."
-
Mar 2, 2016 5:40 PMby Drew Reece,OregonRebel wrote:
Here's a link to another network-monitoring app. http://goo.gl/QpIayO
This is abandonware but still works, so download & use at will.
That installer is bundling other junk.
- Yahoo search engine hijack
- Mackeeper
- Various other junk apps
Are you sure it is not doing other malicious things? Installers have become a prevalent way to attack Macs, see the many threads here detailing adware & other junk that is bundled with apps that are no longer maintained or stored on dubious servers.
Does it even install the app you want to use, nothing appeared in /Applications after 'installing' (on a throwaway installation)?!
I'm not sure that running code that is found randomly on the internet is going to help anyones privacy. Apple are the least of your worries.
