Apple Removes macOS Feature That Allowed Apps to Bypass Firewall Security

Apple has removed a controversial
feature^[1] from its macOS operating
system that allowed the company’s own first-party apps to bypass
content filters, VPNs, and third-party firewalls.

Called “ContentFilterExclusionList^[2],” it included a list of
as many as 50 Apple apps like iCloud, Maps, Music, FaceTime,
HomeKit, the App Store, and its software update service that were
routed through Network Extension Framework, effectively
circumventing firewall protections.

This exclusion list has been scrubbed now from macOS 11.2 beta
2.

The issue first came to light last October following the release
of macOS Big Sur, prompting concerns from security researchers who
said the feature was ripe for abuse, adding it could be leveraged
by an attacker to exfiltrate sensitive data by piggybacking it on
to legitimate Apple apps included on the list and then bypass
firewalls and security software.

“After lots of bad press and lots of feedback/bug reports to
Apple from developers such as myself, it seems wiser (more security
conscious) minds at Cupertino prevailed,” said^[3] Patrick Wardle, a
principal security researcher with Jamf, last week.

Researchers, including Wardle, found last year that Apple’s apps
were being excluded from NEFilterDataProvider^[4], a network content
filter that makes it possible for firewall and VPN apps such as
LuLu and Little Snitch to monitor and control data traffic from
installed apps on the system.

Wardle demonstrated an instance of how malicious apps could
exploit this firewall bypass to transmit data to an
attacker-controlled server using a simple Python script that
latched the traffic onto an Apple exempted app despite setting LuLu
and Little Snitch to block all outgoing connections on a Mac
running Big Sur.

With this new change, socket filter firewalls such as LuLu can
now comprehensively filter/block all network traffic, including
those from Apple apps.

The updates come as Apple deprecated support^[5]
for Network Kernel Extensions in 2019 in favor of Network
Extensions Framework.

We have reached out to Apple, and we’ll update the story if we
hear back.