Apple Lets Some of its Big Sur macOS Apps Bypass Firewall and VPNs

Apple is facing the heat for a new feature in macOS Big Sur that
allows many of its own apps to bypass firewalls and VPNs, thereby
potentially allowing malware to exploit the same shortcoming to
access sensitive data stored on users’ systems and transmit them to
remote servers.

The issue was first spotted last month by a Twitter user named
Maxwell in a beta version of the operating system.

“Some Apple apps bypass some network extensions and VPN Apps,”
Maxwell tweeted^[1]. “Maps for example can
directly access the internet bypassing any NEFilterDataProvider or
NEAppProxyProviders you have running.”

But now that the iPhone maker has released the latest version of
macOS to the public on November 12, the behavior has been left
unchanged, prompting concerns from security researchers, who say
the change is ripe for abuse.

Of particular note is the possibility that the bypass can leave
macOS systems open to attack, not to mention the inability to limit
or block network traffic at users’ discretion.

According to Jamf security researcher Patrick Wardle^[2], the company’s 50
Apple-specific apps and processes have been exempted from firewalls
like Little Snitch and Lulu.

The change in behavior comes as Apple deprecated support^[3]
for Network Kernel Extensions last year in favor of Network
Extensions Framework.

“Previously, a comprehensive macOS firewall could be implemented
via Network Kernel Extension (KEXTs),” Wardle noted in a tweet^[4]
back in October. “Apple deprecated kexts, giving us Network
Extensions… but apparently (many of their apps/ daemons bypass
this filtering mechanism.”

NEFilterDataProvider^[5]
makes it possible to monitor and control Mac’s network traffic
either by opting to “pass or block the data when it receives a new
flow, or it can ask the system to see more of the flow’s data in
either the outbound or inbound direction before making a pass or
block decision.”

Thus by circumventing NEFilterDataProvider, it makes it hard for
VPNs to block Apple applications.

Wardle also demonstrated^[6]
an instance of how malicious apps could exploit this firewall
bypass to exfiltrate sensitive data to an attacker-controlled
server using a simple Python script that piggybacked the traffic
onto an Apple exempted app despite setting Lulu and Little Snitch
to block all outgoing connections on a Mac running Big Sur.

Apple is yet to comment on the new changes.

While the company’s motivation to make its own apps exempt from
firewalls and VPNs is still unclear, it’s possible that they are
part of Apple’s “anti-malware (and perhaps anti-piracy)
efforts^[7]” to keep traffic from
its apps out of VPN servers and prevent geo-restricted content from
being accessed through VPNs.