Leopard fails firewall tests

gallery

The firewall in Leopard, the new operating system (OS) from Apple, has failed a series of security tests, according to Heise Security.

The company's researchers found the redesigned firewall interface - now part of the Security rather than Sharing system preferences - was unable to prevent incoming traffic in any of their tests. The firewall was tested in its default setting, where all incoming traffic is automatically managed by the system; in its most secure, blocking everything; and in its customisable configuration.

In all instances, the researchers reported that they could establish network connections to non-authorised services. And if they could, so can malware.

"It is conceivable that Apple intends that every process started by the user should be entered into the list of exceptions automatically," the researchers said. "This would, however, also apply to a trojan, covertly setting up a backdoor on the system. Only Apple can explain what precisely is going on here."

Heise's Jürgen Schmidt claimed that Apple was showing a casual attitude to security, similar to that of Microsoft four years ago. Like Windows XP, Leopard does not activate the firewall by default. But even when it was activated, it proved ineffective at stopping rampant malware, since system services representing potential access points for malware were accessible via the internet interface by default.

Schmidt noted that as things stand, the problems with Leopard's firewall do not expose Mac users to anything like that level of risk, but added that does not mean they cannot be ignored.

"The Mac OS X Leopard firewall failed every test," he said. "It is not activated by default and, even when activated, it does not behave as expected. Network connections to non-authorised services can still be established and even under the most restrictive setting, 'Block all incoming connections', it allows access to system services from the internet. Although the problems and peculiarities described here are not security vulnerabilities in the sense that they can be exploited to break into a Mac, Apple would be well advised to sort them out pronto."

Apple has been asked to respond to Heise's report.

Email to a friend

Print this page