{"id":31325,"date":"2021-01-14T16:50:50","date_gmt":"2021-01-14T21:50:50","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=31325"},"modified":"2021-02-05T14:34:48","modified_gmt":"2021-02-05T19:34:48","slug":"contentfilterexclusionlist-gone-in-macos-11-2-beta-2","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/01\/14\/contentfilterexclusionlist-gone-in-macos-11-2-beta-2\/","title":{"rendered":"ContentFilterExclusionList Gone in macOS 11.2 Beta 2"},"content":{"rendered":"<p><a href=\"https:\/\/www.patreon.com\/posts\/46179028\">Patrick Wardle<\/a> (<a href=\"https:\/\/twitter.com\/patrickwardle\/status\/1349487256180908032\">tweet<\/a>, <a href=\"https:\/\/news.ycombinator.com\/item?id=25771022\">Hacker News<\/a>):<\/p>\n<blockquote cite=\"https:\/\/www.patreon.com\/posts\/46179028\"><p>Unfortunately, Apple (without telling anybody) decided to &ldquo;exclude&rdquo; or exempt over 50 of its own applications (such as the App Store) and daemons from being routed thru the Network Extension Framework.<\/p><p>[&#8230;]<\/p><p>Due to the ContentFilterExclusionList list any traffic generated from these &ldquo;excluded&rdquo; items could <strong>not<\/strong> be filtered or blocked by a socket filter firewall (such as LuLu). Many (rightfully) asked, &ldquo;<em>What good is a firewall if it can&rsquo;t block all traffic?&rdquo;  <\/em>I of course also wondered if malware could abuse these &ldquo;excluded&rdquo; items to generate network traffic that could surreptitiously bypass any socket filter firewall.  Unfortunately the answer was yes! It was (unsurprisingly) trivial to find a way to abuse these items, and generate undetected network traffic[&#8230;]<\/p><p>[&#8230;]<\/p><p>Well, after lots of bad press and lots of feedback\/bug reports to Apple from developers such as myself, it seems wiser (more security conscious) minds at Cupertino prevailed.<\/p><\/blockquote>\n\n<p><a href=\"https:\/\/blog.obdev.at\/a-wall-without-a-hole\/\">Norbert Heger<\/a>:<\/p>\n<blockquote cite=\"https:\/\/blog.obdev.at\/a-wall-without-a-hole\/\"><p>Thanks Apple for listening!<\/p><\/blockquote>\n\n<p><a href=\"https:\/\/news.ycombinator.com\/item?id=25778750\">sneak<\/a>:<\/p>\n<blockquote cite=\"https:\/\/news.ycombinator.com\/item?id=25778750\"><p>Big Sur on M1 (and possibly on Intel) maintains a persistent, hardware-serial-number linked TLS connection to Apple (for APNS, just like on iOS) at all times when you are logged in, even if you don&rsquo;t use iCloud, App Store, iMessage, or FaceTime, and have all analytics turned off.<\/p><p>There&rsquo;s no UI to disable this.<\/p><p>This means that Apple has the coarse location track log (due to GeoIP of the client IP) for every M1 serial number.<\/p><p>[&#8230;]<\/p><p>This change is essential for blocking such traffic, and I&rsquo;m glad for it, but there is a long way to go when it comes to pressuring the pro-privacy forces inside of Apple to do more.<\/p><\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/12\/17\/little-snitch-5-1-beta\/\">Little Snitch 5.1 Beta<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/11\/17\/a-hole-in-the-wall\/\">A Hole in the Wall<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/11\/13\/apple-server-outage-makes-mac-apps-hang-on-launch\/\">Apple Server Outage Makes Mac Apps Hang on Launch<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/11\/02\/little-snitch-5\/\">Little Snitch 5<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/10\/22\/apple-apps-exempt-from-network-filters-and-vpns\/\">Apple Apps Exempt From Network Filters and VPNs<\/a><\/li>\n<\/ul>\n\n<p id=\"contentfilterexclusionlist-gone-in-macos-11-2-beta-2-update-2021-02-05\">Update (2021-02-05): <a href=\"https:\/\/sneak.berlin\/20210202\/macos-11.2-network-privacy\/\">Jeffrey Paul<\/a>:<\/p>\n<blockquote cite=\"https:\/\/sneak.berlin\/20210202\/macos-11.2-network-privacy\/\">\n<p>There are several privacy\/usage leaks remaining in the OS, but now they can be effectively blocked without affecting the overall operation of the device.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Patrick Wardle (tweet, Hacker News): Unfortunately, Apple (without telling anybody) decided to &ldquo;exclude&rdquo; or exempt over 50 of its own applications (such as the App Store) and daemons from being routed thru the Network Extension Framework.[&#8230;]Due to the ContentFilterExclusionList list any traffic generated from these &ldquo;excluded&rdquo; items could not be filtered or blocked by a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2021-01-14T21:50:53Z","apple_news_api_id":"b3b4997f-8083-4e2b-bc56-79dcd7daa34d","apple_news_api_modified_at":"2021-02-05T19:34:52Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/As7SZf4CDTiu8Vnnc19qjTQ","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[139,2008,30,1891,476,355,1074],"class_list":["post-31325","post","type-post","status-publish","format-standard","hentry","category-technology","tag-littlesnitch","tag-lulu","tag-mac","tag-macos-11-0","tag-networking","tag-privacy","tag-push-notifications"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=31325"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31325\/revisions"}],"predecessor-version":[{"id":31557,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/31325\/revisions\/31557"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=31325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=31325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=31325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}