GithubHelp home page GithubHelp logo

drduh / macos-security-and-privacy-guide Goto Github PK

View Code? Open in Web Editor NEW
20.9K 690.0 1.4K 1.94 MB

Guide to securing and improving privacy on macOS

Home Page: https://drduh.github.io/macOS-Security-and-Privacy-Guide/

License: MIT License

Python 100.00%
apple macos security privacy osx disk-encryption macos-setup macos-security macbook-security dnscrypt-proxy

macos-security-and-privacy-guide's Introduction

This guide is a collection of techniques for improving the security and privacy of Apple silicon Mac computers running a currently supported version of macOS. Using Macs with Intel CPUs leaves you open to security vulnerabilities on the hardware level that Apple can't patch. Apple silicon Macs are the minimum recommendation but as a general rule, newer chips are always more secure.

This guide is targeted to power users who wish to adopt enterprise-standard security, but is also suitable for novice users with an interest in improving their privacy and security on a Mac.

If you're securing computers for an organization, use the official NIST guidelines for macOS.

A system is only as secure as its administrator is capable of making it. There is no one single technology, software, nor technique to guarantee perfect computer security; a modern operating system and computer is very complex, and requires numerous incremental changes to meaningfully improve one's security and privacy posture.

This guide is provided on an 'as is' basis without any warranties of any kind. Only you are responsible if you break anything or get in any sort of trouble by following this guide.

To suggest an improvement, send a pull request or open an issue.

Basics

General security best practices apply:

  • Create a threat model

    • What are you trying to protect and from whom? Is your adversary a three letter agency, a nosy eavesdropper on the network, or a determined APT orchestrating a campaign against you?
    • Recognize threats and how to reduce attack surface against them.

  • Keep the system and software up to date

    • Patch the operating system and all installed software regularly.
    • macOS system updates can be completed in the settings and set to automatically install. You can also use the softwareupdate command-line utility - neither requires registering an Apple account.
    • Subscribe to announcement mailing lists like Apple security-announce.

  • Encrypt sensitive data

  • Assure data availability

  • Click carefully

    • Ultimately, the security of a system depends on the capabilities of its administrator.
    • Care should be taken when installing new software; only install from official sources that the developers indicate on their official website/github/etc.

Threat modeling

The first and most important step for security and privacy is to create a threat model. You need to understand your adversaries in order to defend against them. Each person will have their own needs so everyone's threat model will be different. Threat models tend to evolve over time as our situation changes, so be sure to periodically reassess your threat model.

Identify assets

This is probably a lot of things: your phone, your laptop, passwords stored on your devices, internet browsing history, etc. Make a list starting with the most important assets to protect. You can put them in categories based on how important they are: public, sensitive, or secret.

Identify adversaries

Define whom you are defending against. Start by defining the motivation they might have to attack your assets. Financial gain is a big motivator for many attackers, for example.

Identify capabilities

In order to counter your adversaries, you'll need to understand what they're capable of and what they're not capable of. Rank adversaries from totally unsophisticated to very advanced. For example, a common thief is not very sophisticated; they will likely be stopped by basic things like simply having a password and drive encryption on your device. A very advanced adversary like a state actor might require fully turning off your device when not in use to clear the keys from RAM and a long diceware password.

Identify mitigations

Now is when you decide the best way to counter each threat. You might avoid writing passwords down on paper so your roommate can't find them or you might encrypt the drive on your computer so a thief can't get data from it. It's important to balance security and usability; every mitigation should counter some capability of your adversaries, otherwise you might be making your life inconvenient for little to no gain. If you can't think of any more capabilities your adversaries might have and you've implemented mitigations for them all, your work is done.

Here's an example of the type of table you should make for each asset you want to protect:

Adversary Motivation Capabilities Mitigation
Roommate See private chats or browsing history Close proximity; can see screen or watch type in password Use biometrics, use privacy screen, keep phone locked when not using it
Thief Unlock phone and steal personal info and drain bank accounts, sell phone for money Shoulder surf to see password, steal device when not looking while it's logged in Keep phone in sight or on person at all times, keep locked when not in use, use biometrics to avoid typing password in public, use Find My or similar service to track/remotely disable stolen device
Criminal Financial Social engineering, readily-available malware, password reuse, exploiting vulnerabilities Use sandboxing, enable security features in OS, keep OS and all software updated and turn on automatic updates
Corporation User data marketing Telemetry and behavioral data collection Block network connections, reset unique identifiers, avoid adding payment data
Nation State/APT Targeted surveillance Passive surveillance of internet infrastructure, advanced computers for cracking encryption/analysis of packets Use open source e2ee, use strong diceware passwords for devices, use hardware with secure element for secure encryption, shut down devices when not using them, software tripwire/honeypot/canary tokens

Read more about threat modeling here.

Hardware

macOS is most secure running on Apple hardware with Apple silicon. The newer the Mac, the better. Avoid hackintoshes and Macs that don't support the latest macOS, as Apple doesn't patch all vulnerabilities in versions that aren't the most recent one.

When you purchase your Mac, you might want to avoid it being linked back to you. Depending on your threat model, you should pay for it in cash in person rather than ordering online or purchasing with a credit/debit card, that way no identifying information can be linked back to your purchase.

If you want to use a wireless keyboard, mouse, headphones or other accessory, the most secure option is Apple ones since they will automatically be updated by your system. They also support the latest Bluetooth features like BLE Privacy which randomizes your Bluetooth hardware address to prevent tracking. With third party accessories, this isn't a guarantee.

Installing macOS

There are several ways to install macOS. Choose your preferred method from the available options.

You should install the latest version of macOS that is compatible with your Mac. More recent versions have security patches and other improvements that older versions lack.

System activation

As part of Apple's theft prevention system, Apple silicon Macs will need to activate with Apple's servers every time you reinstall macOS to check against the database of stolen or activation-locked Macs.

You can read about exactly how this process works here.

Apple ID

Creating an Apple ID is not required to use macOS. Making an Apple ID requires a phone number and it will by default sync a lot of data to iCloud, Apple's cloud storage service. You can disable the syncing later if you want or enable end-to-end encryption for your iCloud data.

You can control the data associated with your Apple ID or completely delete it.

An Apple ID is required in order to access the App Store and use most Apple services like iCloud, Apple Music, etc.

App Store

The Mac App Store is a curated repository of software that is required to utilize the App Sandbox and Hardened Runtime, as well as offering automatic updates that integrate with your system.

The App Store offers the greatest security guarantees for software on macOS, but it requires you to log in with an Apple ID and Apple will be able to link your Apple ID to your downloaded apps.

Virtualization

You can easily run macOS natively in a virtual machine using UTM. It's free from their site but if you buy it from the App Store, you'll get automatic updates.

Follow their documentation to install a macOS VM with just a few clicks.

Another option is VMware Fusion, although it costs money. You can read their documentation to see how to install a macOS VM.

First boot

When macOS first starts, you'll be greeted by Setup Assistant.

When creating the first account, use a strong password without a hint.

If you enter your real name at the account setup process, be aware that your computer's name and local hostname will comprise that name (e.g., John Appleseed's MacBook) and thus will appear on local networks and in various preference files.

Both should be verified and updated as needed in System Settings > About or with the following commands after installation:

sudo scutil --set ComputerName MacBook
sudo scutil --set LocalHostName MacBook

Admin and user accounts

The first user account is always an admin account. Admin accounts are members of the admin group and have access to sudo, which allows them to usurp other accounts, in particular root, and gives them effective control over the system. Any program that the admin executes can potentially obtain the same access, making this a security risk.

Utilities like sudo have weaknesses that can be exploited by concurrently running programs and many panes in System Preferences are unlocked by default (pdf) (p. 61–62) for admin accounts.

It is considered a best practice by Apple and others (pdf) (p. 41–42) to use a separate standard account for day-to-day work and use the admin account for installations and system configuration.

It is not strictly required to ever log into the admin account via the macOS login screen. When a Terminal command requires administrator privileges, the system will prompt for authentication and Terminal then continues using those privileges. To that end, Apple provides some recommendations for hiding the admin account and its home directory. This can be an elegant solution to avoid having a visible 'ghost' account.

Caveats

  • Only administrators can install applications in /Applications (local directory). Finder and Installer will prompt a standard user with an authentication dialog. Many applications can be installed in ~/Applications instead (the directory can be created). As a rule of thumb: applications that do not require admin access – or do not complain about not being installed in /Applications – should be installed in the user directory, the rest in the local directory. Mac App Store applications are still installed in /Applications and require no additional authentication.
  • sudo is not available in shells of the standard user, which requires using su or login to enter a shell of the admin account. This can make some maneuvers trickier and requires some basic experience with command-line interfaces.
  • System Preferences and several system utilities (e.g. Wi-Fi Diagnostics) will require root privileges for full functionality. Many panels in System Preferences are locked and need to be unlocked separately by clicking on the lock icon. Some applications will simply prompt for authentication upon opening, others must be opened by an admin account directly to get access to all functions (e.g. Console).
  • There are third-party applications that will not work correctly because they assume that the user account is an admin. These programs may have to be executed by logging into the admin account, or by using the open utility.
  • See additional discussion in issue 167.

Setup

Accounts can be created and managed in System Preferences. On settled systems, it is generally easier to create a second admin account and then demote the first account. This avoids data migration. Newly installed systems can also just add a standard account.

Demoting an account can be done either from the the new admin account in System Preferences – the other account must be logged out – or by executing these commands (it may not be necessary to execute both, see issue 179):

sudo dscl . -delete /Groups/admin GroupMembership <username>
sudo dscl . -delete /Groups/admin GroupMembers <GeneratedUID>

To find the GeneratedUID of an account:

dscl . -read /Users/<username> GeneratedUID

See also this post for more information about how macOS determines group membership.

Firmware

You should check that firmware security settings are set to Full Security to prevent tampering with your OS. This is the default setting.

FileVault

All Mac models with Apple silicon are encrypted by default. Enabling FileVault makes it so that you need to enter a password in order to access the data on your drive. The EFF has a guide on generating strong but memorable passwords.

Your FileVault password also acts as a firmware password that will prevent people that don't know it from booting from anything other than the designated startup disk, accessing Recovery, and reviving it with DFU mode.

FileVault will ask you to set a recovery key in case you forget your password. Keep this key stored somewhere safe. You'll have the option use your iCloud account to unlock your disk; however, anyone with access to your iCloud account will be able to unlock it as well.

Lockdown Mode

macOS offers Lockdown Mode, a security feature that disables several features across the OS, significantly reducing attack surface for attackers while keeping the OS usable. You can read about exactly what is disabled and decide for yourself if it is acceptable to you.

When Lockdown Mode is on, you can disable it per site in Safari on trusted sites.

Firewall

There are several types of firewalls available for macOS.

Application layer firewall

Built-in, basic firewall which blocks incoming connections only. This firewall does not have the ability to monitor, nor block outgoing connections.

It can be controlled by the Firewall tab of Network in System Settings, or with the following commands.

Enable the firewall with logging and stealth mode:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Computer hackers scan networks so they can attempt to identify computers to attack. You can prevent your computer from responding to some of these scans by using stealth mode. When stealth mode is enabled, your computer does not respond to ICMP ping requests, and does not answer to connection attempts from a closed TCP or UDP port. This makes it more difficult for attackers to find your computer.

To prevent built-in software as well as code-signed, downloaded software from being whitelisted automatically:

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned off

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp off

Applications that are signed by a valid certificate authority are automatically added to the list of allowed apps, rather than prompting the user to authorize them. Apps included in macOS are signed by Apple and are allowed to receive incoming connections when this setting is enabled. For example, since iTunes is already signed by Apple, it is automatically allowed to receive incoming connections through the firewall.

If you run an unsigned app that is not listed in the firewall list, a dialog appears with options to Allow or Deny connections for the app. If you choose "Allow", macOS signs the application and automatically adds it to the firewall list. If you choose "Deny", macOS adds it to the list but denies incoming connections intended for this app.

After interacting with socketfilterfw, restart the process by sending a line hangup signal:

sudo pkill -HUP socketfilterfw

Third party firewalls

Programs such as Little Snitch, Radio Silence, and LuLu provide a good balance of usability and security.

These programs are capable of monitoring and blocking incoming and outgoing network connections. However, they may require the use of a closed source system extension.

If the number of choices of allowing/blocking network connections is overwhelming, use Silent Mode with connections allowed, then periodically check the configuration to gain understanding of applications and what they are doing.

It is worth noting that these firewalls can be bypassed by programs running as root or through OS vulnerabilities (pdf), but they are still worth having - just don't expect absolute protection. However, some malware actually deletes itself and doesn't execute if Little Snitch, or other security software, is installed.

Kernel level packet filtering

A highly customizable, powerful, but also most complicated firewall exists in the kernel. It can be controlled with pfctl and various configuration files.

pf can also be controlled with a GUI application such as Murus.

There are many books and articles on the subject of pf firewall. Here's is just one example of blocking traffic by IP address.

Add the following into a file called pf.rules:

wifi = "en0"
ether = "en7"
set block-policy drop
set fingerprints "/etc/pf.os"
set ruleset-optimization basic
set skip on lo0
scrub in all no-df
table <blocklist> persist
block in log
block in log quick from no-route to any
block log on $wifi from { <blocklist> } to any
block log on $wifi from any to { <blocklist> }
antispoof quick for { $wifi $ether }
pass out proto tcp from { $wifi $ether } to any keep state
pass out proto udp from { $wifi $ether } to any keep state
pass out proto icmp from $wifi to any keep state

Then use the following commands to manipulate the firewall:

  • sudo pfctl -e -f pf.rules to enable the firewall and load the configuration
  • sudo pfctl -d to disable the firewall
  • sudo pfctl -t blocklist -T add 1.2.3.4 to add an IP address to the blocklist
  • sudo pfctl -t blocklist -T show to view the blocklist
  • sudo ifconfig pflog0 create to create an interface for logging
  • sudo tcpdump -ni pflog0 to view filtered packets

Unless you're already familiar with packet filtering, spending too much time configuring pf is not recommended. It is also probably unnecessary if your Mac is behind a NAT on a private home network.

It is possible to use the pf firewall to block network access to entire ranges of network addresses, for example to a whole organization:

Query Merit RADb for the list of networks in use by an autonomous system, like Facebook:

whois -h whois.radb.net '!gAS32934'

Copy and paste the list of networks returned into the blocklist command:

sudo pfctl -t blocklist -T add 31.13.24.0/21 31.13.64.0/24 157.240.0.0/16

Confirm the addresses were added:

$ sudo pfctl -t blocklist -T show
No ALTQ support in kernel
ALTQ related functions disabled
   31.13.24.0/21
   31.13.64.0/24
   157.240.0.0/16

Confirm network traffic is blocked to those addresses (DNS requests will still work):

$ dig a +short facebook.com
157.240.2.35

$ curl --connect-timeout 5 -I http://facebook.com/
*   Trying 157.240.2.35...
* TCP_NODELAY set
* Connection timed out after 5002 milliseconds
* Closing connection 0
curl: (28) Connection timed out after 5002 milliseconds

$ sudo tcpdump -tqni pflog0 'host 157.240.2.35'
IP 192.168.1.1.62771 > 157.240.2.35.80: tcp 0
IP 192.168.1.1.62771 > 157.240.2.35.80: tcp 0
IP 192.168.1.1.62771 > 157.240.2.35.80: tcp 0
IP 192.168.1.1.62771 > 157.240.2.35.80: tcp 0
IP 192.168.1.1.162771 > 157.240.2.35.80: tcp 0

Outgoing TCP SYN packets are blocked, so a TCP connection is not established and thus a Web site is effectively blocked at the IP layer.

See drduh/config/scripts/pf-blocklist.sh for more inspiration.

Services

Services on macOS are managed by launchd. See launchd.info.

You can manage and see more information about software that runs at login in System Settings. You can see installed System, Quick Look, Finder, and other extensions in System Settings as well.

  • Use launchctl list to view running user agents
  • Use sudo launchctl list to view running system daemons
  • Specify the service name to examine it, e.g. launchctl list com.apple.Maps.mapspushd
  • Use defaults read to examine job plists in /System/Library/LaunchDaemons and /System/Library/LaunchAgents
  • Use man and strings to find out more about what an agent/daemon does

For example, to learn what a system launch daemon or agent does, start with:

defaults read /System/Library/LaunchDaemons/com.apple.apsd.plist

Look at the Program or ProgramArguments section to see which binary is run, in this case apsd. To find more information about that, look at the man page with man apsd

Note System services are protected by SIP, don't disable SIP just to tinker with system services as SIP is an integral part of security on macOS. Disabling system services could cause breakage and unstable behavior!

To view the status of services:

find /var/db/com.apple.xpc.launchd/ -type f -print -exec defaults read {} \; 2>/dev/null

Annotated lists of launch daemons and agents, the respective program executed, and the programs' hash sums are included in this repository.

Read more about launchd and where login items can be found on Apple's website.

Siri Suggestions & Spotlight

Apple is moving to on-device processing for a lot of Siri functions, but some info is still sent to Apple when you use Siri Suggestions or Spotlight. You can read Apple's Privacy Policy to see exactly what is sent and how to disable it.

Homebrew

Consider using Homebrew to make software installations easier and to update userland tools.

Note If you have not already installed Xcode or Command Line Tools, use xcode-select --install to download and install them, or check Apple's developer site.

Homebrew uses SSL/TLS to talk with GitHub and verifies integrity of downloaded packages, so it's fairly secure.

Remember to periodically run brew upgrade on trusted and secure networks to download and install software updates. To get information on a package before installation, run brew info <package> and check its formula online.

According to Homebrew's Anonymous Analytics, Homebrew gathers anonymous analytics and reports these to a self-hosted InfluxDB instance.

To opt out of Homebrew's analytics, you can set export HOMEBREW_NO_ANALYTICS=1 in your environment or shell rc file, or use brew analytics off

You may also wish to enable additional security options, such as HOMEBREW_NO_INSECURE_REDIRECT=1 and HOMEBREW_CASK_OPTS=--require-sha

DNS

DNS profiles

macOS 11 introduced "DNS configuration profiles" to configure encrypted DNS, filter domains and use DNSSEC.

DNS profiles can be created or obtained from providers such as Quad9, AdGuard and NextDNS.

Hosts file

Use the hosts file to block known malware, advertising or otherwise unwanted domains.

Edit the hosts file as root, for example with sudo vi /etc/hosts

To block a domain by A record, append any one of the following lines to /etc/hosts:

0 example.com
0.0.0.0 example.com
127.0.0.1 example.com

Note IPv6 uses the AAAA DNS record type, rather than A record type, so you may also want to block those connections by also including ::1 example.com entries, like shown here.

There are many lists of domains available online which you can paste in, just make sure each line starts with 0, 0.0.0.0, 127.0.0.1, and the line 127.0.0.1 localhost is included.

Here are some popular and useful hosts lists:

Append a list of hosts with tee:

curl https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sudo tee -a /etc/hosts

If you're using a firewall like Little Snitch, you could use the StevenBlack/hosts importing the rules from leohidalgo/little-snitch---rule-groups repository, these rules are updated every 12 hours from the StevenBlack/hosts repository.

DNSCrypt

To encrypt DNS traffic, consider using DNSCrypt/dnscrypt-proxy. Used in combination with dnsmasq and DNSSEC, the integrity of DNS traffic can be significantly improved.

Install DNSCrypt from Homebrew and follow the instructions to configure and start dnscrypt-proxy:

brew install dnscrypt-proxy

If using in combination with Dnsmasq, find the file homebrew.mxcl.dnscrypt-proxy.plist by running

brew info dnscrypt-proxy

which will show a location like /usr/local/etc/dnscrypt-proxy.toml

Open it in a text editor, find the line starting with listen_addresses = and edit that line to use DNScrypt on a port other than 53, like 5355:

listen_addresses = ['127.0.0.1:5355', '[::1]:5355']

Start DNSCrypt:

sudo brew services restart dnscrypt-proxy

Confirm DNSCrypt is running:

$ sudo lsof +c 15 -Pni UDP:5355
COMMAND          PID   USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
dnscrypt-proxy 15244 nobody    7u  IPv4 0x1337f85ff9f8beef      0t0  UDP 127.0.0.1:5355
dnscrypt-proxy 15244 nobody   10u  IPv6 0x1337f85ff9f8beef      0t0  UDP [::1]:5355
dnscrypt-proxy 15244 nobody   12u  IPv4 0x1337f85ff9f8beef      0t0  UDP 127.0.0.1:5355
dnscrypt-proxy 15244 nobody   14u  IPv6 0x1337f85ff9f8beef      0t0  UDP [::1]:5355

By default, dnscrypt-proxy runs on localhost (127.0.0.1), port 53, balancing traffic across a set of resolvers. If you would like to change these settings, you will have to edit the configuration file: $HOMEBREW_PREFIX/etc/dnscrypt-proxy.toml

Note Applications and programs may resolve DNS using their own provided servers. If dnscrypt-proxy is used, it is possible to disable all other, non-dnscrypt DNS traffic with the following pf rules:

block drop quick on !lo0 proto udp from any to any port = 53
block drop quick on !lo0 proto tcp from any to any port = 53

See also What is a DNS leak and ipv6-test.com

Dnsmasq

Among other features, dnsmasq is able to cache replies, prevent upstream queries for unqualified names, and block entire top-level domains.

Use in combination with DNSCrypt to additionally encrypt DNS traffic.

If you don't wish to use DNSCrypt, you should at least use DNS not provided by your ISP. Two popular alternatives are Google DNS and OpenDNS.

Optional DNSSEC is a set of extensions to DNS which provide to DNS clients (resolvers) origin authentication of DNS data, authenticated denial of existence, and data integrity. All answers from DNSSEC protected zones are digitally signed. The signed records are authenticated via a chain of trust, starting with a set of verified public keys for the DNS root-zone. The current root-zone trust anchors may be downloaded from IANA website. There are a number of resources on DNSSEC, but probably the best one is dnssec.net website.

Install Dnsmasq:

brew install dnsmasq --with-dnssec

Download and edit drduh/config/dnsmasq.conf or the default configuration file.

See drduh/config/domains for appendable examples on blocking services by domains.

Install and start the program (sudo is required to bind to privileged port 53):

sudo brew services start dnsmasq

To set dnsmasq as the local DNS server, open System Preferences > Network and select the active interface, then the DNS tab, select + and add 127.0.0.1, or use:

sudo networksetup -setdnsservers "Wi-Fi" 127.0.0.1

Confirm Dnsmasq is configured:

$ scutil --dns | head
DNS configuration

resolver #1
  search domain[0] : whatever
  nameserver[0] : 127.0.0.1
  flags    : Request A records, Request AAAA records
  reach    : 0x00030002 (Reachable,Local Address,Directly Reachable Address)

$ networksetup -getdnsservers "Wi-Fi"
127.0.0.1

Note Some VPN software overrides DNS settings on connect. See issue 24 and drduh/config/scripts/macos-dns.sh.

Optional Test DNSSEC validation for signed zones - the reply should have NOERROR status and contain ad flag:

$ dig +dnssec icann.org | head
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47039
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

Test DNSSEC validation fails for zones that are signed improperly - the reply should have SERVFAIL status:

$ dig www.dnssec-failed.org | head
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 15190
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

Certificate authorities

macOS comes with over 100 root authority certificates installed from corporations like Apple, Verisign, Thawte, Digicert and government agencies from China, Japan, Netherlands, U.S., and more! These Certificate Authorities (CAs) are capable of issuing TLS certificates for any domain, code signing certificates, etc. Apple blocks these certificates when a CA proves to be untrustworthy. They also have strict requirements that trusted CAs have to meet.

For more information, see the CA/Browser Forum's website.

Inspect system root certificates in Keychain Access, under the System Roots tab or by using the security command line tool and /System/Library/Keychains/SystemRootCertificates.keychain file.

You can manually disable certificate authorities through Keychain Access by marking them as Never Trust and closing the window:

A certificate authority certificate

Warning: This will cause your browser to give a warning when you visit a site using certificates signed by these CAs and may cause breakage in other software. Don't distrust Apple root certificates or it will cause lots of breakage in macOS!

The risk of a man in the middle attack in which a coerced or compromised certificate authority trusted by your system issues a fake/rogue TLS certificate is quite low, but still possible.

Privoxy

Consider using Privoxy as a local proxy to filter Web traffic.

Install and start privoxy using Homebrew:

brew install privoxy

brew services start privoxy

Alternatively, a signed installation package for Privoxy is available from silvester.org.uk or Sourceforge. The signed package is more secure than the Homebrew version and receives support from the Privoxy project.

By default, Privoxy listens on local TCP port 8118.

Set the system HTTP proxy for the active network interface 127.0.0.1 and 8118:

sudo networksetup -setwebproxy "Wi-Fi" 127.0.0.1 8118

Set the system HTTPS proxy:

sudo networksetup -setsecurewebproxy "Wi-Fi" 127.0.0.1 8118

This can also be done through System Preferences > Network > Advanced > Proxies

Confirm the proxy is set:

$ scutil --proxy
<dictionary> {
  ExceptionsList : <array> {
    0 : *.local
    1 : 169.254/16
  }
  FTPPassive : 1
  HTTPEnable : 1
  HTTPPort : 8118
  HTTPProxy : 127.0.0.1
}

Although most Web traffic today is encrypted, Privoxy is still useful for filtering by domain name patterns, and for upgrading insecure HTTP requests.

For example, the following rules block all traffic, except to .net and github.com and all apple domains:

{ +block{all} }
.

{ -block }
.apple.
.github.com
.net

Or to just block Facebook domains, for example:

{ +block{facebook} }
.facebook*.
.fb.
.fbcdn*.
.fbinfra.
.fbsbx.
.fbsv.
.fburl.
.tfbnw.
.thefacebook.
fb*.akamaihd.net

Wildcards are also supported.

See drduh/config/privoxy/config and drduh/config/privoxy/user.action for additional Privoxy examples. Privoxy does not need to be restarted after editing user.action filter rules.

To verify traffic is blocked or redirected, use curl or the Privoxy interface available at http://p.p in the browser:

ALL_PROXY=127.0.0.1:8118 curl example.com -IL | head

HTTP/1.1 403 Request blocked by Privoxy
Content-Length: 9001
Content-Type: text/html
Cache-Control: no-cache
Pragma: no-cache

ALL_PROXY=127.0.0.1:8118 curl github.com -IL | head
HTTP/1.1 302 Local Redirect from Privoxy
Location: https://github.com/
Content-Length: 0

HTTP/1.1 200 Connection established

HTTP/2 200
server: GitHub.com

Note macOS proxy settings are not universal; apps and services may not honor system proxy settings. Ensure the application you wish to proxy is correctly configured and verify connections don't leak. Additionally, pf can be configured to transparently proxy traffic on certain ports.

Browser

The Web browser likely poses the largest security and privacy risk, as its fundamental job is to download and execute untrusted code from the Internet.

An important property of modern browsers is the Same Origin Policy (SOP) which prevents a malicious script on one page from obtaining access to sensitive data on another web page through the Document Object Model (DOM). If SOP is compromised, the security of the entire browser is compromised.

Many browser exploits are based on social engineering as a means of gaining persistence. Always be mindful of opening untrusted sites and especially careful when downloading new software.

Another important consideration about browser security is extensions. This is an issue affecting Firefox and Chrome alike. The use of browser extensions should be limited to only critically necessary ones published by trustworthy developers.

Mozilla Firefox, Google Chrome, Safari, and Tor Browser are all recommended browsers for their own unique and individual purposes.

Firefox

Mozilla Firefox is a popular open source browser. Firefox replaced major parts of its infrastructure and code base under the projects Quantum and Photon. Part of the Quantum project is to replace C++ code with Rust. Rust is a systems programming language with a focus on security and thread safety. It is expected that Rust adoption will greatly improve the overall security posture of Firefox.

Firefox offers a similar security model to Chrome: it has a bug bounty program, although it is not as lucrative. Firefox follows a four-week release cycle similar to Chrome.

Firefox supports user-supplied configuration files. See drduh/config/firefox.user.js and arkenfox/user.js for recommended preferences and hardening measures. Also see NoScript, an extension which allows selective script blocking.

Firefox focuses on user privacy. It supports tracking protection in Private Browsing mode. The tracking protection can be enabled for the default account, although it may break the browsing experience on some websites. Firefox in Strict tracking protection mode will randomize your fingerprint to foil basic tracking scripts. Firefox offers separate user profiles. You can separate your browsing inside a profile with Multi-Account Containers.

Firefox only supports Web Extensions through the Web Extension Api, which is very similar to Chrome. Submission of Web Extensions in Firefox is free. Web Extensions in Firefox most of the time are open source, although certain Web Extensions are proprietary.

Chrome

Google Chrome is based on the open source Chromium project with certain proprietary components:

  • Automatic updates with GoogleSoftwareUpdateDaemon
  • Usage tracking and crash reporting, which can be disabled through Chrome's settings
  • Media Codec support for proprietary codecs
  • Chrome Web Store
  • PDF viewer
  • Non-optional tracking. Google Chrome installer includes a randomly generated token. The token is sent to Google after the installation completes in order to measure the success rate. The RLZ identifier stores information – in the form of encoded strings – like the source of chrome download and installation week. It doesn’t include any personal information and it’s used to measure the effectiveness of a promotional campaign. Chrome downloaded from Google’s website doesn’t have the RLZ identifier. The source code to decode the strings is made open by Google.

Chrome offers account sync between multiple devices. Part of the sync data includes credentials to Web sites. The data is encrypted with the account password.

Chrome's Web Store for extensions requires a 5 USD lifetime fee in order to submit extensions. The low cost allows the development of many quality Open Source Web Extensions that do not aim to monetize through usage.

Chrome has the largest share of global usage and is the preferred target platform for the majority of developers. Major technologies are based on Chrome's Open Source components, such as node.js which uses Chrome's V8 Engine and the Electron framework, which is based on Chromium and node.js. Chrome's vast user base makes it the most attractive target for threat actors and security researchers. Despite constant attacks, Chrome has retained an impressive security track record over the years. This is not a small feat.

Chrome offers separate profiles, robust sandboxing, frequent updates, and carries impressive credentials. In addition, Google offers a very lucrative bounty program for reporting vulnerabilities, along with its own Project Zero team. This means that a large number of highly talented and motivated people are constantly auditing and securing Chrome code.

Create separate Chrome profiles to reduce XSS risk and compartmentalize cookies/identities. In each profile, either disable Javascript in Chrome settings and configure allowed origins. You should also disable the V8 Optimizer for sites where you do use Javascript to further reduce attack surface. Go to Settings -> Privacy and security -> Security -> Manage v8 security -> Don't allow sites to use the V8 optimizer

Read more about the benefits of disabling this here.

You can block trackers with uBlock Origin Lite.

Change the default search engine from Google to reduce additional tracking.

Disable DNS prefetching (see also DNS Prefetching and Its Privacy Implications (pdf)). Note that Chrome may attempt to resolve DNS using Google's 8.8.8.8 and 8.8.4.4 public nameservers.

Read Chromium Security and Chromium Privacy for more information. Read Google's privacy policy to understand how personal information is collected and used.

Safari

Safari is the default browser on macOS. It is also the most optimized browser for reducing battery use. Safari, like Chrome, has both Open Source and proprietary components. Safari is based on the open source Web Engine WebKit, which is ubiquitous among the macOS ecosystem. WebKit is used by Apple apps such as Mail, iTunes, iBooks, and the App Store. Chrome's Blink engine is a fork of WebKit and both engines share a number of similarities.

Safari supports certain unique features that benefit user security and privacy. Content blockers enables the creation of content blocking rules without using Javascript. This rule based approach greatly improves memory use, security, and privacy. Safari 11 introduced Intelligent Tracking Prevention, which removes tracking data stored in Safari after a period of non-interaction by the user from the tracker's website. Safari can randomize your fingerprint to reduce tracking. Safari doesn't support certain features like WebUSB or the Battery API intentionally for security and privacy reasons. Private tabs in Safari have isolated cookies and cache that is destroyed when you close the tab. Safari also support Profiles which are equivalent to Firefox's Multi-Account Containers for separating cookies and browsing. Safari can be made significantly more secure with lockdown mode, which can be disabled per-site. Read more about tracking prevention in Safari.

Safari offers an invite-only bounty program for bug reporting to a select number of security researchers. The bounty program was announced during Apple's presentation at BlackHat 2016.

Web Extensions in Safari have an additional option to use native code in the Safari's sandbox environment, in addition to Web Extension APIs. Web Extensions in Safari are also distributed through Apple's App store. App store submission comes with the added benefit of Web Extension code being audited by Apple. On the other hand App store submission comes at a steep cost. Yearly developer subscription fee costs 100 USD (in contrast to Chrome's 5 USD fee and Firefox's free submission). The high cost is prohibitive for the majority of Open Source developers. As a result, Safari has very few extensions to choose from. However, you should keep the high cost in mind when installing extensions. It is expected that most Web Extensions will have some way of monetizing usage in order to cover developer costs. Be wary of Web Extensions whose source code is not open.

Safari syncs user preferences and passwords with iCloud Keychain. In order to be viewed in plain text, a user must input the account password of the current device. This means that users can sync data across devices with added security.

Safari follows a slower release cycle than Chrome and Firefox (3-4 minor releases, 1 major release, per year). Newer features are slower to be adopted to the stable channel. Security updates in Safari are handled independent of the stable release schedule and are installed through the App Store.

See also el1t/uBlock-Safari to disable hyperlink auditing beacons.

Other browsers

Many Chromium-derived browsers are not recommended. They are usually closed source, poorly maintained, have bugs, and make dubious claims to protect privacy. See The Private Life of Chromium Browsers.

Other miscellaneous browsers, such as Brave, are not evaluated in this guide, so are neither recommended nor actively discouraged from use.

Web browser privacy

Web browsers reveal information in several ways, for example through the Navigator interface, which may include information such as the browser version, operating system, site permissions, and the device's battery level. Many websites also use canvas fingerprinting to uniquely identify users across sessions.

For more information about security conscious browsing and what data is sent by your browser, see HowTo: Privacy & Security Conscious Browsing, browserleaks.com, Am I Unique? and EFF Cover Your Tracks resources.

To hinder third party trackers, it is recommended to disable third-party cookies altogether. Safari, Firefox, and Chrome all block third party cookies by default. A third party cookie is a cookie associated with a file requested by a different domain than the one the user is currently viewing. Most of the time third-party cookies are used to create browsing profiles by tracking a user's movement on the web. Disabling third-party cookies prevents HTTP responses and scripts from other domains from setting cookies. Moreover, cookies are removed from requests to domains that are not the document origin domain, so cookies are only sent to the current site that is being viewed.

Also be aware of WebRTC, which may reveal your local or public (if connected to VPN) IP address(es). In Firefox and Chrome/Chromium this can be disabled with extensions such as uBlock Origin. Lockdown mode disables WebRTC in Safari.

Tor

Tor is an anonymizing network which can be used for browsing the Web with additional privacy. Tor Browser is a modified version of Firefox with a proxy to access the Tor network.

Download Tor Browser from Tor Project.

Do not attempt to configure other browsers or applications to use Tor as you may make a mistake which will compromise anonymity.

Download both the dmg and asc signature files, then verify the disk image has been signed by Tor developers:

$ cd ~/Downloads

$ file Tor*
TorBrowser-8.0.4-osx64_en-US.dmg:     bzip2 compressed data, block size = 900k
TorBrowser-8.0.4-osx64_en-US.dmg.asc: PGP signature Signature (old)

$ gpg Tor*asc
[...]
gpg: Can't check signature: No public key

$ gpg --recv 0x4E2C6E8793298290
gpg: key 0x4E2C6E8793298290: public key "Tor Browser Developers (signing key) <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --verify Tor*asc
gpg: assuming signed data in 'TorBrowser-8.0.4-osx64_en-US.dmg'
gpg: Signature made Mon Dec 10 07:16:22 2018 PST
gpg:                using RSA key 0xEB774491D9FF06E2
gpg: Good signature from "Tor Browser Developers (signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
     Subkey fingerprint: 1107 75B5 D101 FB36 BC6C  911B EB77 4491 D9FF 06E2

Make sure Good signature from "Tor Browser Developers (signing key) <[email protected]>" appears in the output. The warning about the key not being certified is benign, as it has not yet been assigned trust.

See How can I verify Tor Browser's signature? for more information.

To finish installing Tor Browser, open the disk image and drag the it into the Applications folder, or with:

hdiutil mount TorBrowser-8.0.4-osx64_en-US.dmg

cp -r /Volumes/Tor\ Browser/Tor\ Browser.app/ ~/Applications/

Verify the Tor application's code signature was made by with The Tor Project's Apple developer ID MADPSAYN6T, using the spctl -a -v and/or pkgutil --check-signature commands:

$ spctl -a -vv ~/Applications/Tor\ Browser.app
/Users/drduh/Applications/Tor Browser.app: accepted
source=Developer ID
origin=Developer ID Application: The Tor Project, Inc (MADPSAYN6T)

$ pkgutil --check-signature ~/Applications/Tor\ Browser.app
Package "Tor Browser.app":
   Status: signed by a certificate trusted by Mac OS X
   Certificate Chain:
    1. Developer ID Application: The Tor Project, Inc (MADPSAYN6T)
       SHA1 fingerprint: 95 80 54 F1 54 66 F3 9C C2 D8 27 7A 29 21 D9 61 11 93 B3 E8
       -----------------------------------------------------------------------------
    2. Developer ID Certification Authority
       SHA1 fingerprint: 3B 16 6C 3B 7D C4 B7 51 C9 FE 2A FA B9 13 56 41 E3 88 E1 86
       -----------------------------------------------------------------------------
    3. Apple Root CA
       SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

You can also use the codesign command to examine an application's code signature:

$ codesign -dvv ~/Applications/Tor\ Browser.app
Executable=/Users/drduh/Applications/Tor Browser.app/Contents/MacOS/firefox
Identifier=org.torproject.torbrowser
Format=app bundle with Mach-O thin (x86_64)
CodeDirectory v=20200 size=229 flags=0x0(none) hashes=4+3 location=embedded
Library validation warning=OS X SDK version before 10.9 does not support Library Validation
Signature size=4247
Authority=Developer ID Application: The Tor Project, Inc (MADPSAYN6T)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Signed Time=Dec 10, 2018 at 12:18:45 AM
Info.plist entries=24
TeamIdentifier=MADPSAYN6T
Sealed Resources version=2 rules=12 files=128
Internal requirements count=1 size=188

To view full certificate details for a signed application, extract them with codesign and decode it with openssl:

$ codesign -d --extract-certificates ~/Applications/Tor\ Browser.app
Executable=/Users/drduh/Applications/Tor Browser.app/Contents/MacOS/firefox

$ file codesign*
codesign0: data
codesign1: data
codesign2: data

$ openssl x509 -inform der -in codesign0 -subject -issuer -startdate -enddate -noout
subject= /UID=MADPSAYN6T/CN=Developer ID Application: The Tor Project, Inc (MADPSAYN6T)/OU=MADPSAYN6T/O=The Tor Project, Inc/C=US
issuer= /CN=Developer ID Certification Authority/OU=Apple Certification Authority/O=Apple Inc./C=US
notBefore=Apr 12 22:40:13 2016 GMT
notAfter=Apr 13 22:40:13 2021 GMT

$ openssl x509 -inform der -in codesign0  -fingerprint -noout
SHA1 Fingerprint=95:80:54:F1:54:66:F3:9C:C2:D8:27:7A:29:21:D9:61:11:93:B3:E8

$ openssl x509 -inform der -in codesign0 -fingerprint -sha256 -noout
SHA256 Fingerprint=B5:0D:47:F0:3E:CB:42:B6:68:1C:6F:38:06:2B:C2:9F:41:FA:D6:54:F1:29:D3:E4:DD:9C:C7:49:35:FF:F5:D9

Tor traffic is encrypted to the exit node (i.e., cannot be read by a passive network eavesdropper), but Tor use can be identified - for example, TLS handshake "hostnames" will show up in plaintext:

$ sudo tcpdump -An "tcp" | grep "www"
listening on pktap, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes
.............". ...www.odezz26nvv7jeqz1xghzs.com.........
.............#.!...www.bxbko3qi7vacgwyk4ggulh.com.........
.6....m.....>...:.........|../*	Z....W....X=..6...C../....................................0...0..0.......'....F./0..	*.H........0%1#0!..U....www.b6zazzahl3h3faf4x2.com0...160402000000Z..170317000000Z0'1%0#..U....www.tm3ddrghe22wgqna5u8g.net0..0..

See Tor Protocol Specification and Tor/TLSHistory for more information.

You may wish to additionally obfuscate Tor traffic using a pluggable transport.

This can be done by setting up your own Tor relay or finding an existing private or public bridge to serve as an obfuscating entry node.

For extra security, use Tor inside a VirtualBox or VMware virtualized GNU/Linux or OpenBSD instance.

Finally, remember the Tor network provides anonymity, which is not necessarily synonymous with privacy. The Tor network does not guarantee protection against a global observer capable of traffic analysis and correlation. See also Seeking Anonymity in an Internet Panopticon (pdf) and Traffic Correlation on Tor by Realistic Adversaries (pdf).

Also see Invisible Internet Project (I2P) and its Tor comparison.

VPN

When choosing a VPN service or setting up your own, be sure to research the protocols, key exchange algorithms, authentication mechanisms, and type of encryption being used. Some protocols, such as PPTP, should be avoided in favor of OpenVPN or Linux-based Wireguard on a Linux VM or via a set of cross platform tools.

Some clients may send traffic over the next available interface when VPN is interrupted or disconnected. See scy/8122924 for an example on how to allow traffic only over VPN.

Another set of scripts to lock down your system so it will only access the internet via a VPN can be found as part of the Voodoo Privacy project - sarfata/voodooprivacy and there is an updated guide to setting up an IPSec VPN on a virtual machine (hwdsl2/setup-ipsec-vpn) or a docker container (hwdsl2/docker-ipsec-vpn-server).

It may be worthwhile to consider the geographical location of the VPN provider. See further discussion in issue 114.

Also see this technical overview of the macOS built-in VPN L2TP/IPSec and IKEv2 client.

PGP/GPG

PGP is a standard for signing and encrypting data (especially email) end-to-end, so only the sender and recipient can access it.

GPG, or GNU Privacy Guard, is a GPL-licensed open source program compliant with the PGP standard.

GPG is used to verify signatures of software you download and install, as well as symmetrically or asymmetrically encrypt files and text.

Install from Homebrew with brew install gnupg.

If you prefer a graphical application, download and install GPG Suite.

Download drduh/config/gpg.conf to use recommended settings:

curl -o ~/.gnupg/gpg.conf https://raw.githubusercontent.com/drduh/config/master/gpg.conf

See drduh/YubiKey-Guide to securely generate and store GPG keys.

Read online guides and practice encrypting and decrypting email to yourself and your friends. Get them interested in this stuff!

Messengers

XMPP

XMPP is an open standard developed by the IETF that allows for cross-platform federated messaging. There are many options for clients. Consider using one of the browser-based clients to take advantage of your browser's sandbox.

Depending on the provider, you might not need anything other than a username and password to set up your account.

XMPP isn't E2EE by default, you'll need to use OMEMO encryption, so make sure your client supports it.

Signal

Signal is an advanced E2EE messenger whose double-ratchet protocol is used by countless other messengers including WhatsApp, Google Messages, and Facebook Messenger.

Signal requires a phone number to sign up and you'll need to install it on your phone first before you can use it on desktop.

iMessage

iMessage is Apple's first party messenger. It requires an Apple ID in order to use it.

Make sure to enable Contact Key Verification and verify with anyone you message to ensure that you're messaging the right person.

You can use iMessage with either a phone number or an email, so pick one that you're comfortable with your contacts seeing.

Note: By default, iCloud backup is enabled which stores copies of your message encryption keys on Apple's servers without E2EE. Either disable iCloud backup or enable Advanced Data Protection to prevent this. Also remember to tell your messaging partner/s to do the same!

Viruses and malware

There is an ever-increasing amount of Mac malware in the wild. Macs aren't immune from viruses and malicious software!

Some malware comes bundled with both legitimate software, such as the Java bundling Ask Toolbar, and some with illegitimate software, such as Mac.BackDoor.iWorm bundled with pirated programs.

See Methods of malware persistence on Mac OS X (pdf) and Malware Persistence on OS X Yosemite to learn about how garden-variety malware functions.

Subscribe to updates at The Safe Mac and Malwarebytes Blog for current Mac security news.

Also check out Hacking Team malware for macOS: root installation for MacOS, Support driver for Mac Agent and RCS Agent for Mac, which is a good example of advanced malware with capabilities to hide from userland (e.g., ps, ls). For more, see A Brief Analysis of an RCS Implant Installer and reverse.put.as

Downloading Software

Only running programs from the App Store or that are Notarized by Apple will help mitigate malware. Apple performs an automated scan on notarized apps for malware. App Store apps undergo a review process to catch malware.

Otherwise, get programs from trusted sources like directly from the developer's website or GitHub. Always make sure that your browser/terminal is using HTTPS when downloading any program.

You should also avoid programs that ask for lots of permissions and third party closed source programs. Open source code allows anyone to audit and examine the code for security/privacy issues.

App Sandbox

Check if a program uses the App Sandbox before running it by running the following command:

codesign -dvvv --entitlements - <path to your app>

If the App Sandbox is enabled, you will see

    [Key] com.apple.security.app-sandbox
    [Value]
        [Bool] true

Alternatively, you can check while the app is running by opening Activity Monitor and adding the "Sandbox" column.

All App Store apps are required to use the App Sandbox.

Note: Browsers like Google Chrome use their own sandbox so they don't use the App Sandbox.

Hardened Runtime

Check if a program uses the Hardened Runtime before running it using the following command:

codesign --display --verbose /path/to/bundle.app

If Hardened Runtime is enabled, you will see flags=0x10000(runtime). The "runtime" means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.

You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's dynamic linker. Ideally, this should say "Yes".

Notarized apps are required to use the Hardened Runtime.

Antivirus

To scan an application with multiple AV products and examine its behavior, upload it to VirusTotal before running it.

macOS comes with a built-in AV program called XProtect. XProtect automatically runs in the background and updates its signatures that it uses to detect malware without you having to do anything. If it detects malware already running, it will work to remove and mitigate it just like any other AV program.

You could periodically run a tool like KnockKnock to examine persistent applications (e.g. scripts, binaries). But by then, it is probably too late. Applications such as BlockBlock or maclaunch.sh might help.

Locally installed Anti-virus programs are generally a double-edged sword: they may catch "garden variety" malware, but also may increase the attack surface for sophisticated adversaries due to their privileged operating mode. They also typically phone home to send samples in order to catch the newest malware. This can be a privacy concern.

See Sophail: Applied attacks against Antivirus (pdf), Analysis and Exploitation of an ESET Vulnerability, a trivial Avast RCE, Popular Security Software Came Under Relentless NSA and GCHQ Attacks, How Israel Caught Russian Hackers Scouring the World for U.S. Secrets and AVG: "Web TuneUP" extension multiple critical vulnerabilities.

Gatekeeper

Gatekeeper tries to prevent non-notarized apps from running.

If you try to run an app that isn't notarized, Gatekeeper will give you a warning. This can be easily bypassed if you open Finder to where the program is and right click/control click on it and select Open. Then Gatekeeper will allow you to run it.

Gatekeeper doesn't cover all binaries, only apps so be careful when running other file types.

System Integrity Protection

To verify SIP is enabled, use the command csrutil status, which should return: System Integrity Protection status: enabled. Otherwise, enable SIP through Recovery Mode.

Metadata and artifacts

macOS attaches metadata (HFS+ extended attributes) to downloaded files, which can be viewed with the mdls and xattr commands:

$ ls -l@ ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg
-rw-r--r--@ 1 drduh staff 63M Jan 1 12:00 TorBrowser-8.0.4-osx64_en-US.dmg
	com.apple.metadata:kMDItemWhereFroms	  46B
	com.apple.quarantine	  57B

$ mdls ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg
kMDItemContentCreationDate         = 2019-01-01 00:00:00 +0000
kMDItemContentCreationDate_Ranking = 2019-01-01 00:00:00 +0000
kMDItemContentModificationDate     = 2019-01-01 00:00:00 +0000
kMDItemContentType                 = "com.apple.disk-image-udif"
kMDItemContentTypeTree             = (
    "public.archive",
    "public.item",
    "public.data",
    "public.disk-image",
    "com.apple.disk-image",
    "com.apple.disk-image-udif"
)
kMDItemDateAdded                   = 2019-01-01 00:00:00 +0000
kMDItemDateAdded_Ranking           = 2019-01-01 00:00:00 +0000
kMDItemDisplayName                 = "TorBrowser-8.0.4-osx64_en-US.dmg"
kMDItemFSContentChangeDate         = 2019-01-01 00:00:00 +0000
kMDItemFSCreationDate              = 2019-01-01 00:00:00 +0000
kMDItemFSCreatorCode               = ""
kMDItemFSFinderFlags               = 0
kMDItemFSHasCustomIcon             = (null)
kMDItemFSInvisible                 = 0
kMDItemFSIsExtensionHidden         = 0
kMDItemFSIsStationery              = (null)
kMDItemFSLabel                     = 0
kMDItemFSName                      = "TorBrowser-8.0.4-osx64_en-US.dmg"
kMDItemFSNodeCount                 = (null)
kMDItemFSOwnerGroupID              = 5000
kMDItemFSOwnerUserID               = 501
kMDItemFSSize                      = 65840402
kMDItemFSTypeCode                  = ""
kMDItemInterestingDate_Ranking     = 2019-01-01 00:00:00 +0000
kMDItemKind                        = "Disk Image"
kMDItemWhereFroms                  = (
    "https://dist.torproject.org/torbrowser/8.0.4/TorBrowser-8.0.4-osx64_en-US.dmg",
    "https://www.torproject.org/projects/torbrowser.html.en"
)

$ xattr -l ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg
com.apple.metadata:kMDItemWhereFroms:
00000000  62 70 6C 69 73 74 30 30 A2 01 02 5F 10 4D 68 74  |bplist00..._.Mht|
00000010  74 70 73 3A 2F 2F 64 69 73 74 2E 74 6F 72 70 72  |tps://dist.torpr|
00000020  6F 6A 65 63 74 2E 6F 72 67 2F 74 6F 72 62 72 6F  |oject.org/torbro|
[...]
com.apple.quarantine: 0081;58519ffa;Google Chrome.app;1F032CAB-F5A1-4D92-84EB-CBECA971B7BC

Metadata attributes can also be removed with the -d flag:

xattr -d com.apple.metadata:kMDItemWhereFroms ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg

xattr -d com.apple.quarantine ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg

xattr -l ~/Downloads/TorBrowser-8.0.4-osx64_en-US.dmg

Other metadata and artifacts may be found in the directories including, but not limited to, ~/Library/Preferences/, ~/Library/Containers/<APP>/Data/Library/Preferences, /Library/Preferences, some of which is detailed below.

~/Library/Preferences/com.apple.sidebarlists.plist contains historical list of volumes attached. To clear it, use the command /usr/libexec/PlistBuddy -c "delete :systemitems:VolumesList" ~/Library/Preferences/com.apple.sidebarlists.plist

/Library/Preferences/com.apple.Bluetooth.plist contains Bluetooth metadata, including device history. If Bluetooth is not used, the metadata can be cleared with:

sudo defaults delete /Library/Preferences/com.apple.Bluetooth.plist DeviceCache
sudo defaults delete /Library/Preferences/com.apple.Bluetooth.plist IDSPairedDevices
sudo defaults delete /Library/Preferences/com.apple.Bluetooth.plist PANDevices
sudo defaults delete /Library/Preferences/com.apple.Bluetooth.plist PANInterfaces
sudo defaults delete /Library/Preferences/com.apple.Bluetooth.plist SCOAudioDevices

/var/spool/cups contains the CUPS printer job cache. To clear it, use the commands:

sudo rm -rfv /var/spool/cups/c0*
sudo rm -rfv /var/spool/cups/tmp/*
sudo rm -rfv /var/spool/cups/cache/job.cache*

To clear the list of iOS devices connected, use:

sudo defaults delete /Users/$USER/Library/Preferences/com.apple.iPod.plist "conn:128:Last Connect"
sudo defaults delete /Users/$USER/Library/Preferences/com.apple.iPod.plist Devices
sudo defaults delete /Library/Preferences/com.apple.iPod.plist "conn:128:Last Connect"
sudo defaults delete /Library/Preferences/com.apple.iPod.plist Devices
sudo rm -rfv /var/db/lockdown/*

Quicklook thumbnail data can be cleared using the qlmanage -r cache command, but this writes to the file resetreason in the Quicklook directories, and states that the Quicklook cache was manually cleared. Disable the thumbnail cache with qlmanage -r disablecache

It can also be cleared by getting the directory names with getconf DARWIN_USER_CACHE_DIR and sudo getconf DARWIN_USER_CACHE_DIR, then removing them:

rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/exclusive
rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite
rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite-shm
rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite-wal
rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/resetreason
rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/thumbnails.data

Similarly, for the root user:

sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/exclusive
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite-shm
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/index.sqlite-wal
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/resetreason
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/thumbnails.data
sudo rm -rfv $(getconf DARWIN_USER_CACHE_DIR)/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler

Also see 'quicklook' cache may leak encrypted data.

To clear Finder preferences:

defaults delete ~/Library/Preferences/com.apple.finder.plist FXDesktopVolumePositions
defaults delete ~/Library/Preferences/com.apple.finder.plist FXRecentFolders
defaults delete ~/Library/Preferences/com.apple.finder.plist RecentMoveAndCopyDestinations
defaults delete ~/Library/Preferences/com.apple.finder.plist RecentSearches
defaults delete ~/Library/Preferences/com.apple.finder.plist SGTRecentFileSearches

Additional diagnostic files may be found in the following directories - but caution should be taken before removing any, as it may break logging or cause other issues:

/var/db/CoreDuet/
/var/db/diagnostics/
/var/db/systemstats/
/var/db/uuidtext/
/var/log/DiagnosticMessages/

macOS stored preferred Wi-Fi data (including credentials) in NVRAM. To clear it, use the following commands:

sudo nvram -d 36C28AB5-6566-4C50-9EBD-CBB920F83843:current-network
sudo nvram -d 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-networks
sudo nvram -d 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-count

macOS may collect sensitive information about what you type, even if user dictionary and suggestions are off. To remove them, and prevent them from being created again, use the following commands:

rm -rfv "~/Library/LanguageModeling/*" "~/Library/Spelling/*" "~/Library/Suggestions/*"
chmod -R 000 ~/Library/LanguageModeling ~/Library/Spelling ~/Library/Suggestions
chflags -R uchg ~/Library/LanguageModeling ~/Library/Spelling ~/Library/Suggestions

QuickLook application support metadata can be cleared and locked with the following commands:

rm -rfv "~/Library/Application Support/Quick Look/*"
chmod -R 000 "~/Library/Application Support/Quick Look"
chflags -R uchg "~/Library/Application Support/Quick Look"

Document revision metadata is stored in /.DocumentRevisions-V100 and can be cleared and locked with the following commands - caution should be taken as this may break some core Apple applications:

sudo rm -rfv /.DocumentRevisions-V100/*
sudo chmod -R 000 /.DocumentRevisions-V100
sudo chflags -R uchg /.DocumentRevisions-V100

Saved application state metadata may be cleared and locked with the following commands:

rm -rfv "~/Library/Saved Application State/*"
rm -rfv "~/Library/Containers/<APPNAME>/Saved Application State"
chmod -R 000 "~/Library/Saved Application State/"
chmod -R 000 "~/Library/Containers/<APPNAME>/Saved Application State"
chflags -R uchg "~/Library/Saved Application State/"
chflags -R uchg "~/Library/Containers/<APPNAME>/Saved Application State"

Autosave metadata can be cleared and locked with the following commands:

rm -rfv "~/Library/Containers/<APP>/Data/Library/Autosave Information"
rm -rfv "~/Library/Autosave Information"
chmod -R 000 "~/Library/Containers/<APP>/Data/Library/Autosave Information"
chmod -R 000 "~/Library/Autosave Information"
chflags -R uchg "~/Library/Containers/<APP>/Data/Library/Autosave Information"
chflags -R uchg "~/Library/Autosave Information"

The Siri analytics database, which is created even if the Siri launch agent disabled, can be cleared and locked with the following commands:

rm -rfv ~/Library/Assistant/SiriAnalytics.db
chmod -R 000 ~/Library/Assistant/SiriAnalytics.db
chflags -R uchg ~/Library/Assistant/SiriAnalytics.db

~/Library/Preferences/com.apple.iTunes.plist contains iTunes metadata. Recent iTunes search data may be cleared with the following command:

defaults delete ~/Library/Preferences/com.apple.iTunes.plist recentSearches

If you do not use Apple ID-linked services, the following keys may be cleared, too, using the following commands:

defaults delete ~/Library/Preferences/com.apple.iTunes.plist StoreUserInfo
defaults delete ~/Library/Preferences/com.apple.iTunes.plist WirelessBuddyID

All media played in QuickTime Player can be found in:

~/Library/Containers/com.apple.QuickTimePlayerX/Data/Library/Preferences/com.apple.QuickTimePlayerX.plist

Additional metadata may exist in the following files:

~/Library/Containers/com.apple.appstore/Data/Library/Preferences/com.apple.commerce.knownclients.plist
~/Library/Preferences/com.apple.commerce.plist
~/Library/Preferences/com.apple.QuickTimePlayerX.plist

Passwords

Generate strong passwords using urandom and tr:

tr -dc '[:graph:]' < /dev/urandom | fold -w 20 | head -1

The password assistant in Keychain Access can also generate secure credentials.

Consider using Diceware for memorable passwords.

GnuPG can also be used to manage passwords and other encrypted files (see drduh/Purse and drduh/pwd.sh).

Ensure all eligible online accounts have multi-factor authentication enabled. The strongest form of multi-factor authentication is WebAuthN, followed by app-based authenticators, and SMS-based codes are weakest.

YubiKey is an affordable hardware token with WebAuthN support. It can also be used to store cryptographic keys for GnuPG encryption and SSH authentication - see drduh/YubiKey-Guide.

Backup

Encrypt files locally before backing them up to external media or online services.

If your threat model allows it, you should follow the 3-2-1 backup model as outlined by CISA. Keep 3 copies: the original and two backups. Keep backups on 2 different media types, e.g. on a local drive and cloud storage. Store 1 copy offsite.

Time Machine is the built-in tool for handling backups on macOS. Get an external drive or network drive to back up to and encrypt your backups.

GnuPG can be used with a static password or public key (with the private key stored on YubiKey).

Compress and encrypt a directory using with a password:

tar zcvf - ~/Downloads | gpg -c > ~/Desktop/backup-$(date +%F-%H%M).tar.gz.gpg

Decrypt and decompress the directory:

gpg -o ~/Desktop/decrypted-backup.tar.gz -d ~/Desktop/backup-*.tar.gz.gpg

tar zxvf ~/Desktop/decrypted-backup.tar.gz

Encrypted volumes can also be created using Disk Utility or hdiutil:

hdiutil create ~/Desktop/encrypted.dmg -encryption -size 50M -volname "secretStuff"

hdiutil mount ~/Desktop/encrypted.dmg

cp -v ~/Documents/passwords.txt /Volumes/secretStuff

hdiutil eject /Volumes/secretStuff

Additional applications and services which offer backups include:

Wi-Fi

macOS remembers access points it has connected to. Like all wireless devices, the Mac will broadcast all access point names it remembers (e.g., MyHomeNetwork) each time it looks for a network, such as when waking from sleep.

This is a privacy risk, so remove networks from the list in System Preferences > Network > Advanced when they are no longer needed.

Also see Signals from the Crowd: Uncovering Social Relationships through Smartphone Probes (pdf) and Wi-Fi told me everything about you (pdf).

Saved Wi-Fi information (SSID, last connection, etc.) can be found in /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist

You may want to spoof the MAC address of the network card before connecting to new and untrusted wireless networks to mitigate passive fingerprinting:

sudo ifconfig en0 ether $(openssl rand -hex 6 | sed 's%\(..\)%\1:%g; s%.$%%')

macOS stores Wi-Fi SSIDs and passwords in NVRAM in order for Recovery Mode to access the Internet. Be sure to either clear NVRAM or de-authenticate your Mac from your Apple account, which will clear the NVRAM, before passing a Mac along. Resetting the SMC will clear some of the NVRAM, but not all.

Note MAC addresses will reset to hardware defaults on each boot.

Finally, WEP protection on wireless networks is not secure and you should only connect to WPA2 protected networks when possible.

SSH

For outgoing SSH connections, use hardware or password-protected keys, set up remote hosts and consider hashing them for added privacy. See drduh/config/ssh_config for recommended client options.

You can also use ssh to create an encrypted tunnel to send traffic through, similar to a VPN.

For example, to use Privoxy running on a remote host port 8118:

ssh -C -L 5555:127.0.0.1:8118 [email protected]

sudo networksetup -setwebproxy "Wi-Fi" 127.0.0.1 5555

sudo networksetup -setsecurewebproxy "Wi-Fi" 127.0.0.1 5555

Or to use an ssh connection as a SOCKS proxy:

ssh -NCD 3000 [email protected]

By default, macOS does not have sshd or Remote Login enabled.

To enable sshd and allow incoming ssh connections:

sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist

Or use the System Preferences > Sharing menu.

If enabling sshd, be sure to disable password authentication and consider further hardening your configuration. See drduh/config/sshd_config for recommended options.

Confirm whether sshd is running:

sudo lsof -Pni TCP:22

Physical access

Keep your Mac physically secure at all times and do not leave it unattended in public.

A skilled attacker with unsupervised physical access could install a hardware keylogger to record all of your keystrokes. Using a Mac with a built-in keyboard or a bluetooth keyboard makes this more difficult as many off-the-shelf versions of this attack are designed to be plugged in between a USB keyboard and your computer.

To protect against physical theft during use, you can use an anti-forensic tool like BusKill or swiftGuard (updated usbkill, with graphical user interface). All respond to USB events and can immediately shutdown your computer if your device is physically separated from you or an unauthorized device is connected.

Consider purchasing a privacy screen/filter for use in public.

Nail polish and tamper-evidence seals can be applied to components to detect tampering.

System monitoring

OpenBSM audit

macOS has a powerful OpenBSM (Basic Security Module) auditing capability. You can use it to monitor process execution, network activity, and much more.

To tail audit logs, use the praudit utility:

$ sudo praudit -l /dev/auditpipe
header,201,11,execve(2),0,Thu Sep  1 12:00:00 2015, + 195 msec,exec arg,/Applications/.evilapp/rootkit,path,/Applications/.evilapp/rootkit,path,/Applications/.evilapp/rootkit,attribute,100755,root,wheel,16777220,986535,0,subject,drduh,root,wheel,root,wheel,412,100005,50511731,0.0.0.0,return,success,0,trailer,201,
header,88,11,connect(2),0,Thu Sep  1 12:00:00 2015, + 238 msec,argument,1,0x5,fd,socket-inet,2,443,173.194.74.104,subject,drduh,root,wheel,root,wheel,326,100005,50331650,0.0.0.0,return,failure : Operation now in progress,4354967105,trailer,88
header,111,11,OpenSSH login,0,Thu Sep  1 12:00:00 2015, + 16 msec,subject_ex,drduh,drduh,staff,drduh,staff,404,404,49271,::1,text,successful login drduh,return,success,0,trailer,111,

See the manual pages for audit, praudit, audit_control and other files in /etc/security

Note although man audit says the -s flag will synchronize the audit configuration, it appears necessary to reboot for changes to take effect.

See articles on ilostmynotes.blogspot.com and derflounder.wordpress.com for more information.

DTrace

Note System Integrity Protection interferes with DTrace, so it is not possible to use it in recent macOS versions without disabling SIP.

  • iosnoop monitors disk I/O
  • opensnoop monitors file opens
  • execsnoop monitors execution of processes
  • errinfo monitors failed system calls
  • dtruss monitors all system calls

See man -k dtrace for more information.

Execution

ps -ef lists information about all running processes.

You can also view processes with Activity Monitor.

launchctl list and sudo launchctl list list loaded and running user and system launch daemons and agents.

Network

List open network files:

sudo lsof -Pni

List contents of various network-related data structures:

sudo netstat -atln

Wireshark can be used from the command line with tshark.

Monitor DNS queries and replies:

tshark -Y "dns.flags.response == 1" -Tfields \
  -e frame.time_delta \
  -e dns.qry.name \
  -e dns.a \
  -Eseparator=,

Monitor HTTP requests and responses:

tshark -Y "http.request or http.response" -Tfields \
  -e ip.dst \
  -e http.request.full_uri \
  -e http.request.method \
  -e http.response.code \
  -e http.response.phrase \
  -Eseparator=/s

Monitor x509 (SSL/TLS) certificates:

tshark -Y "ssl.handshake.certificate" -Tfields \
  -e ip.src \
  -e x509sat.uTF8String \
  -e x509sat.printableString \
  -e x509sat.universalString \
  -e x509sat.IA5String \
  -e x509sat.teletexString \
  -Eseparator=/s -Equote=d

Also see the simple networking monitoring application BonzaiThePenguin/Loading.

Binary authorization

google/santa is a security software developed for Google's corporate Macintosh fleet and open sourced.

Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions, a daemon that makes execution decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision and a command-line utility for managing the system and synchronizing the database with a server.

Santa uses the Kernel Authorization API to monitor and allow/disallow binaries from executing in the kernel. Binaries can be white- or black-listed by unique hash or signing developer certificate. Santa can be used to only allow trusted code execution, or to blacklist known malware from executing on a Mac, similar to Bit9 software for Windows.

Note Santa does not currently have a graphical user interface for managing rules. The following instructions are for advanced users only!

To install Santa, visit the Releases page and download the latest disk image, the mount it and install the contained package:

hdiutil mount ~/Downloads/santa-0.9.20.dmg

sudo installer -pkg /Volumes/santa-0.9.20/santa-0.9.20.pkg -tgt /

By default, Santa installs in "Monitor" mode (meaning, nothing gets blocked, only logged) and comes with two rules: one for Apple binaries and another for Santa software itself.

Verify Santa is running and its kernel module is loaded:

$ santactl status
>>> Daemon Info
  Mode                   | Monitor
  File Logging           | No
  Watchdog CPU Events    | 0  (Peak: 0.00%)
  Watchdog RAM Events    | 0  (Peak: 0.00MB)
>>> Kernel Info
  Kernel cache count     | 0
>>> Database Info
  Binary Rules           | 0
  Certificate Rules      | 2
  Events Pending Upload  | 0

$ ps -ef | grep "[s]anta"
    0   786     1   0 10:01AM ??         0:00.39 /Library/Extensions/santa-driver.kext/Contents/MacOS/santad --syslog

$ kextstat | grep santa
  119    0 0xffffff7f822ff000 0x6000     0x6000     com.google.santa-driver (0.9.14) 693D8E4D-3161-30E0-B83D-66A273CAE026 <5 4 3 1>

Create a blacklist rule to prevent iTunes from executing:

$ sudo santactl rule --blacklist --path /Applications/iTunes.app/
Added rule for SHA-256: e1365b51d2cb2c8562e7f1de36bfb3d5248de586f40b23a2ed641af2072225b3.

Try to launch iTunes - it will be blocked.

$ open /Applications/iTunes.app/
LSOpenURLsWithRole() failed with error -10810 for the file /Applications/iTunes.app.

Santa block dialog when attempting to run a blacklisted program

To remove the rule:

$ sudo santactl rule --remove --path /Applications/iTunes.app/
Removed rule for SHA-256: e1365b51d2cb2c8562e7f1de36bfb3d5248de586f40b23a2ed641af2072225b3.

Open iTunes:

$ open /Applications/iTunes.app/
[iTunes will open successfully]

Create a new, example C program:

$ cat <<EOF > foo.c
> #include <stdio.h>
> main() { printf("Hello World\n”); }
> EOF

Compile the program with GCC (requires installation of Xcode or command-line tools):

$ gcc -o foo foo.c

$ file foo
foo: Mach-O 64-bit executable x86_64

$ codesign -d foo
foo: code object is not signed at all

Run it:

$ ./foo
Hello World

Toggle Santa into "Lockdown" mode, which only allows authorized binaries to run:

$ sudo defaults write /var/db/santa/config.plist ClientMode -int 2

Try to run the unsigned binary:

$ ./foo
bash: ./foo: Operation not permitted

Santa

The following application has been blocked from executing
because its trustworthiness cannot be determined.

Path:       /Users/demouser/foo
Identifier: 4e11da26feb48231d6e90b10c169b0f8ae1080f36c168ffe53b1616f7505baed
Parent:     bash (701)

To authorize a binary, determine its SHA-256 sum:

$ santactl fileinfo /Users/demouser/foo
Path                 : /Users/demouser/foo
SHA-256              : 4e11da26feb48231d6e90b10c169b0f8ae1080f36c168ffe53b1616f7505baed
SHA-1                : 4506f3a8c0a5abe4cacb98e6267549a4d8734d82
Type                 : Executable (x86-64)
Code-signed          : No
Rule                 : Blacklisted (Unknown)

Add a new rule:

$ sudo santactl rule --whitelist --sha256 4e11da26feb48231d6e90b10c169b0f8ae1080f36c168ffe53b1616f7505baed
Added rule for SHA-256: 4e11da26feb48231d6e90b10c169b0f8ae1080f36c168ffe53b1616f7505baed.

Run it:

$ ./foo
Hello World

It's allowed and works!

Applications can also be allowed by developer certificate. For example, download and run Google Chrome - it will be blocked by Santa in "Lockdown" mode:

$ curl -sO https://dl.google.com/chrome/mac/stable/GGRO/googlechrome.dmg

$ hdiutil mount googlechrome.dmg

$ cp -r /Volumes/Google\ Chrome/Google\ Chrome.app /Applications/

$ open /Applications/Google\ Chrome.app/
LSOpenURLsWithRole() failed with error -10810 for the file /Applications/Google Chrome.app.

Authorize the application by the developer certificate (first item in the Signing Chain):

$ santactl fileinfo /Applications/Google\ Chrome.app/
Path                 : /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
SHA-256              : 0eb08224d427fb1d87d2276d911bbb6c4326ec9f74448a4d9a3cfce0c3413810
SHA-1                : 9213cbc7dfaaf7580f3936a915faa56d40479f6a
Bundle Name          : Google Chrome
Bundle Version       : 2883.87
Bundle Version Str   : 55.0.2883.87
Type                 : Executable (x86-64)
Code-signed          : Yes
Rule                 : Blacklisted (Unknown)
Signing Chain:
     1. SHA-256             : 15b8ce88e10f04c88a5542234fbdfc1487e9c2f64058a05027c7c34fc4201153
        SHA-1               : 85cee8254216185620ddc8851c7a9fc4dfe120ef
        Common Name         : Developer ID Application: Google Inc.
        Organization        : Google Inc.
        Organizational Unit : EQHXZ8M8AV
        Valid From          : 2012/04/26 07:10:10 -0700
        Valid Until         : 2017/04/27 07:10:10 -0700

     2. SHA-256             : 7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f
        SHA-1               : 3b166c3b7dc4b751c9fe2afab9135641e388e186
        Common Name         : Developer ID Certification Authority
        Organization        : Apple Inc.
        Organizational Unit : Apple Certification Authority
        Valid From          : 2012/02/01 14:12:15 -0800
        Valid Until         : 2027/02/01 14:12:15 -0800

     3. SHA-256             : b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024
        SHA-1               : 611e5b662c593a08ff58d14ae22452d198df6c60
        Common Name         : Apple Root CA
        Organization        : Apple Inc.
        Organizational Unit : Apple Certification Authority
        Valid From          : 2006/04/25 14:40:36 -0700
        Valid Until         : 2035/02/09 13:40:36 -0800

In this case, 15b8ce88e10f04c88a5542234fbdfc1487e9c2f64058a05027c7c34fc4201153 is the SHA-256 of Google’s Apple developer certificate (team ID EQHXZ8M8AV) - authorize it:

$ sudo santactl rule --whitelist --certificate --sha256 15b8ce88e10f04c88a5542234fbdfc1487e9c2f64058a05027c7c34fc4201153
Added rule for SHA-256: 15b8ce88e10f04c88a5542234fbdfc1487e9c2f64058a05027c7c34fc4201153.

Google Chrome should now launch, and subsequent updates to the application will continue to work as long as the code signing certificate doesn’t change or expire.

To disable "Lockdown" mode:

sudo defaults delete /var/db/santa/config.plist ClientMode

See /var/log/santa.log to monitor ALLOW and DENY execution decisions.

A log and configuration server for Santa is available in Zentral, an open source event monitoring solution and TLS server for osquery and Santa.

Zentral will support Santa in both MONITORING and LOCKDOWN operation mode. Clients need to be enrolled with a TLS connection to sync Santa Rules, all Santa events from endpoints are aggregated and logged back in Zentral. Santa events can trigger actions and notifications from within the Zentral Framework.

Note Python, Bash and other interpreters are authorized (since they are signed by Apple's developer certificate), so Santa will not be able to block such scripts from executing. Thus, a potential non-binary program which disables Santa is a weakness (not vulnerability, since it is so by design) to take note of.

Miscellaneous

Disable Diagnostics & Usage Data.

If you want to play music or watch videos, use QuickTime Player, the built-in media player in macOS. It uses the App Sandbox, Hardened Runtime, and benefits from the Signed System Volume as part of the base system.

If you want to use torrents, use Transmission which is free and open source (note: like all software, even open source projects, malware may still find its way in). You may also wish to use a block list to avoid peering with known bad hosts - see Which is the best blocklist for Transmission and johntyree/3331662.

Manage default file handlers.

Monitor system logs with the Console application or syslog -w or /usr/bin/log stream commands.

Set your screen to lock as soon as the screensaver starts:

defaults write com.apple.screensaver askForPassword -int 1

defaults write com.apple.screensaver askForPasswordDelay -int 0

Expose hidden files and Library folder in Finder:

defaults write com.apple.finder AppleShowAllFiles -bool true

chflags nohidden ~/Library

Show all filename extensions (so that "Evil.jpg.app" cannot masquerade easily).

defaults write NSGlobalDomain AppleShowAllExtensions -bool true

Don't default to saving documents to iCloud:

defaults write NSGlobalDomain NSDocumentSaveNewDocumentsToCloud -bool false

Enable Secure Keyboard Entry in Terminal (unless you use YubiKey or applications such as TextExpander).

Disable crash reporter (the dialog which appears after an application crashes and prompts to report the problem to Apple):

defaults write com.apple.CrashReporter DialogType none

Disable Bonjour multicast advertisements:

Warning: This will cause problems with AirPlay and AirPrint!

sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool YES

Disable Handoff and Bluetooth features, if they aren't necessary.

Check that your apps are sandboxed in Activity Monitor.

macOS comes with this line in /etc/sudoers:

Defaults env_keep += "HOME MAIL"

Which stops sudo from changing the HOME variable when you elevate privileges. This means it will execute as root the zsh dotfiles in the non-root user's home directory when you run "sudo zsh". It is advisable to comment this line out to avoid a potentially easy way for malware or a local attacker to escalate privileges to root.

If you want to retain the convenience of the root user having a non-root user's home directory, you can append an export line to /var/root/.zshrc, e.g.:

export HOME=/Users/blah

Set a custom umask:

sudo launchctl config user umask 077

Reboot, create a file in Finder and verify its permissions (macOS default allows 'group/other' read access):

$ ls -ld umask*
drwx------  2 kevin  staff       64 Dec  4 12:27 umask_testing_dir
-rw-------@ 1 kevin  staff  2026566 Dec  4 12:28 umask_testing_file

Related software

  • CISOfy/lynis - Cross-platform security auditing tool and assists with compliance testing and system hardening.
  • Zentral - A log and configuration server for santa and osquery. Run audit and probes on inventory, events, logfiles, combine with point-in-time alerting. A full Framework and Django web server build on top of the elastic stack (formerly known as ELK stack).
  • osquery - Can be used to retrieve low level system information. Users can write SQL queries to retrieve system information.

Additional resources

macos-security-and-privacy-guide's People

Contributors

alichtman avatar ansell avatar beerisgood avatar drduh avatar eitot avatar elaine-jackson avatar fulldecent avatar hazcod avatar homebysix avatar jaredledvina avatar jbmagination avatar jboekesteijn avatar juanjonol avatar kimg45 avatar kristovatlas avatar lebensterben avatar linhe0x0 avatar m4rkw avatar majr avatar marcus-cr avatar mayday1993 avatar ondronr avatar or3stis avatar phduck avatar stop-playing avatar tetov avatar traderstf avatar yifili09 avatar zelahi avatar zupo avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

antonini olifante michaelbernstein daveh-me justizin adamgwinn dot-sean mirkodziadzka maheshbabu nvk johnmcdowall m4chinations nkwood lxsndl jpf klauskdk jevgen jdstemmler mapennell gferrin wavelets shopbrika saadatqadri kindlyops acdha atopuzov negativo akshatpradhan prabinamatya martindale chrisswk cmosetick hoojaoh saitodaniel alvinlai junglhilt retval ifa6 stefania11 osaatcioglu noscripter fred1234 sightforbacq littlecho lambder excoriate jamesoram tomac rakhmad lu-chi marcelaraujo andersos dmreiland sg-s rbo7nik drooids mikelittman yangwao m-2k willk venj johnjohnsp1 ii0 companyontheworld langelee iarnaud jeperez sa7bi agtlucas techraf pikiel usertm ado-ua yi-tseng psxchotic f3aristheheartoflov3 ecolog lucasallan alexzhang2015 ncoelle colemancda dennisdegreef emory lmcculley christy1955 atwong01 cykustcc burinov changwu-tw alvinchiou mtlwplaya89 balduran jondowdle hippolin esshka guidealexis beermix naterd gnclmorais pandazheng

macos-security-and-privacy-guide's Issues

Path to dnscrypt-resolvers.csv changes when the version number increments.

The last dnscrypt upgrade through homebrew changed the path to the dnscrypt-resolvers.csv file from /usr/local/Cellar/dnscrypt-proxy/1.6.0/share/dnscrypt-proxy/dnscrypt-resolvers.csv to /usr/local/Cellar/dnscrypt-proxy/1.6.0_1/share/dnscrypt-proxy/dnscrypt-resolvers.csv
Is there any way to automatically correct those changes, so it doesn't break the homebrew.mxcl.dnscrypt-proxy.plist on each upgrade?

increase dnsmasq cache size and disable resolv.conf lookup

not related to security as such, but if people are running the dnsmasq.conf from this guide as-is, it might make sense to include cache-size for tuning local caching of replies

# Set the size of the dnsmasq cache. The default is to keep 150 hostnames
cache-size=8192

similarly, as we only want to perform lookups via the config's server= directives we should explicitly disable use of the resolv.conf for determining available nameservers

# forces dnsmasq to queries strictly  in  the  order  they   appear
strict-order

# prevent dnsmasq from reading /etc/resolv.conf or any other file
no-resolv

Add section about hardening SSH access?

Obviously no-SSHd running is the most secure option, but as it is a typical service that people might run for secure access, particularly in the non-laptop case, then recommending some hardening options might be sensible:

sudo tee /etc/sshd_config <<EOF
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
EOF

The options are taken from travis-ci's osx slave config. Essentially these would only permit ssh login using public key authentication against an entry in the given $USER's authorized_keys file, all other forms of password-based auth are disabled. If the suggestion in #9 gets added, then you probably also want to add the 'Administrator' username to DenyUsers in sshd_config as well. Running brew install fail2ban could be a recommended hardening step as well.

There are probably further restrictions that could be added, such as choosing a random unassigned port to open for SSHd access via the Port xxxx directive in sshd_config. Similarly, enforcing only the most secure ciphers are used via the Ciphers and MACs options.

Script?

Hello,

Thank you for this guide! I totally understand what I'm doing with this. However i got 2 things. The first is that you actually don't have to download the updates 10.10.4 and 10.10.5 anymore. Apple updated Yosemite to 10.10.5 for download in the app store.

Now the second one. On the subject Services you wrote a script:
function disable_agent {
echo "Disabling ${1}"
launchctl unload -w /System/Library/LaunchAgents/${1}.plist
}

What language is that? is that applescript? because I'm not really much into programming yet and don't know how to run it.

prov3it

MIDAS

Hi I use this once in awhile but its a great framework developed by the security folks at Facebook and Etsy. If possible we could do a small write up regarding MIDAS. Let me know what you think

Send diagnostic to Apple and Third Parties, a risk?

Is there any risk by allowing these options in Syst. Prefs - Security - Confidential: ~
o send diagnostic data to Apple
o share with third party app developers

What's your opinion?
Data are sent, some might be giving a lot of details, are they even encrypted?

Miscellaneous nov.2

Hi DrDuh,

Up to you to evaluate and see what to do with these sites, remarks, questions or explanations collected from....., some are above my ItQ 👀

Sorry for my usual mess.

Thank you,

  • Perhaps add for some chapters, also how to uninstall software (e.g. dnsmasq, dnscrypt...)
  • OS X VPN settings - Option tab ~"send all trafic on the VPN"
    what's not going on the VPN if this option is disabled?
  • OS X Network - Proxy ~"ignore proxy for hosts and domains"?
    I think this "*.local, 169.254/16" is by "default".
    What to do?
  • OS X Firewall - Advanced tab: set a small delay and require pw.
  • OS X - Users & Groups - ~Open/launch !
    You can remove an application that launch at startup, even without unlocking the dialog (orange locker bottom left)!!
    Is it possible to avoid that stupid possibility... Already report that several times to Apple years ago...
  • Should we disable IP6, as it seems that in some cases using both IP4 and IP6, this might leaks information?

https://letsencrypt.org
https://github.com/okTurtles/dnschain

http://thehackernews.com/2015/10/nsa-crack-encryption.html

http://www.cisco.com/web/about/security/intelligence/nextgen_crypto.html

FOR FASTER VPN

  • router with UPnP ON (security risk, probably not needed if NAT maps automatically
    FOR BETTER PRIVACY
  • random port and NAT auto-open/map
  • block bad/dangerous/snooping peers
  • add a proxy
  • use non-proprietary DNS servers

VPN for privacy... but VPN are always starting after other programs which might already have accessed internet...

Paranoia
Who is behind these testing websites.
Nice places to collect data, browser fingerprints... especially when you are testing your 'uncompleted/unsafe' configuration.

whoer, browserleaks, ipleak and similar, why so many 'secret/domain-by-proxy...' whois?

We use Google Public DNS server, which we consider unproblematic. It is not only the biggest public server with over 130 billion requests per day and works fast, but also does not store personally identifiable information nor IP-addresses permanently and all temporary logs are deleted after 48 hours at the latest. (from a VPN provider... don't remember)

Though Google DNS Resolvers are censuring several kinds of sites and are among companies providing data to bigbro...

2FA
Don't forget to have a 'backup', e.g. like printed code for Google Authenticator, in case your phone is down.

OSXAuditor

I found another interesting computer forensic tool that could he useful to people. Its called OSXAuditor and its a great tool to extract information from a mac. And best of all, its open source!! =)

Here is the github link: https://github.com/jipegit/OSXAuditor

I can do a small write and submit a pull request on it as well

privoxy - why LaunchAgents, not LaunchDaemons?

I have a machine w/ a few different users. In order to make privoxy work for all users, I need to put the privoxy *plist in LaunchDaemons, not LaunchAgents. Is there a reason I should not do this? Both dnsmasq and dnscrypt are setup through LaunchDaemons.

Can we maintain a list of hashes for OS X disk images?

A problem with downloading OS disk images (as opposed to receiving them on mass-produced physical media like CDs) is the threat that you receive a "special" version that is somehow compromised.

The threat model here is both Apple trying to slip you with a special version of OS X if it wants to spy on you, or a third party messing with your copy.

While there is no way for us to know the "true copy", it might be useful to include a hash of a disk image of OS X that we believe to be un-tampered. This way, if you come across a disk image with a different hash, you know something is fishy.

HTTP section - Privoxy install instructions

Hi,

I'm the OS X maintainer for Privoxy. The Homebrew recipe for Privoxy installation is weak in a number of regards, chief among which is that it leaves Privoxy running as root which is of course an unnecessary security risk. The supported installer (available at http://sourceforge.net/projects/ijbswa/files/Macintosh%20%28OS%20X%29/) does not suffer the weaknesses of the Homebrew recipe (it is also as easy to uninstall and includes complete instructions for configuration and obtaining support). Please could you consider altering the HTTP section of your instructions to point readers to this installer instead of using Homebrew?

Separately, many thanks for creating this guide - I've been reading through it with great interest!

Regards,

Ian Silvester

dnscrypt and VPN

I've been a long time user of the streisand project.
I'm also an user of dnsmasq for development purposes (to redirect all *.dev domains to localhost)
So, reading about dnscrypt on your guide, it seemed like an easy addiction to get some extra level of privacy.

Your instructions were crystal clear, and after the setup, everything worked fine... Until the moment that I connected to my VPN using tunnelblick.

Most VPNs override the DNS settings, and therefore they break with dnscrypt.
Has something like this happened to you before? If so, how did you fix it?

Request: Disable Bonjour Multicast 10.11

Can I ask if it i possible for someone to provide friendly instructions on how to disable the bonjour multicast in OSX El Capitan 10.11 ? (btw discoveryd is out and mDNSrespoder... is back)

Image creation

Hi,
I just started reading the guide and since imaging is my day job I was happy to see that you started with a solid introduction to deploying OS X. However I'd like to propose some changes to the first section:

  • It's best to build the image using a full installer of the latest version of OS X downloaded from the App Store (currently 10.10.5 14F27). Do not build a 10.10 14A389 image and apply the combo update to it as updates are meant to be installed on live systems and occasionally causes headaches.
  • Avoid including extra packages on the image, it'll only make it a pain to maintain and update. Also many packages are badly written and don't install correctly (see https://github.com/MagerValp/AutoDMG/wiki/Packages-Suitable-for-Deployment).
  • Rather than installing packages into the image you can include them but install them on first boot, e.g. with Outset: https://github.com/chilcote/outset
  • Even better, it's easy to set up Munki for software management, this way you can keep your machines updated too: https://github.com/munki/munki
  • If you build your image with AutoDMG a recovery partition should be included in the image and created automatically when you restore with asr. If for some reason it's missing you can create a package that will create it for you (again using the latest OS X installer): https://github.com/MagerValp/Create-Recovery-Partition-Installer

Now on to reading the rest of the guide... :)

Hash for 10.11.1 installer

Hi,

Can someone verify these hashes for the InstallESD.dmg file are what I have here for the 10.11.1 installer I downloaded from the Mac App Store yesterday? The guide needs to be updated with the new ones.

InstallESD.dmg

SHA-256: 6275929722c35674fce90d2272d383d49696096e8626ee7f7900dd0334167a9a
SHA-1: 306a080c07e293b6765ba950bab213572704acec

Also, what's the new build number? That info needs changing too I guess.

Cheers.

New Section: Linux Commands

So I know this isn't fully just for OS-X but knowing some linux commands I think would be really helpful. What do you think of adding a small section labeled linux commands and we can add some common ones which would be helpful. An example is: netstat, or ifconfig/ipconfig

Let me know and I can start working on this and submit a pull request

opswatgears.com - Security Monitoring

Not an anti-virus/malware, more a security monitoring and reporting tool for desktop computers, laptop, virtual machines and servers!

Really great, just installed it on our 5 devices.

What advantage I see with gears: if one of 'your' devices is 'compromised' you can warn its owner to avoid to connect to others and take action to restore it.

Free for 25 devices.
https://www.opswatgears.com/

chromium confusion

Hi!

this line:

Don't use any of those Chromium-derived browsers. They are usually closed source, poorly maintained and make dubious claims to protect your privacy.

seems to contradict your earlier recommendation of Chrome (which is Chromium-derived). Perhaps clarify what you mean by "those Chromium-derived browsers"?

thanks.

qrator bot using netbios

Hello,

littlesnitch just block a netbios outgoing link while I was modifying the firewall.

action: deny
direction: outgoing
process: /usr/sbin/netbiosd
owner: system
destination: 185.94.111.1
port: 56198
protocol: 17

IP from qRator, Russia which collects lot of network data and provides interesting results.

Are the weaknesses of your ISP or Web Hosting Services could have a direct impact?

Thanks,

185.94.108.0 - 185.94.111.255
netname: RU-QRATOR-20150331
% Information related to '185.94.111.0/24AS197068'

route: 185.94.111.0/24
descr: radar.qrator.net scan network

SIP protection and dumping ALL the services.

I noticed the SIP section included in the guide but it doesn't have much on disabling it and since SIP is enabled by default. Obviously, it is super trivial to just type:

# csrutil disable

At the bash prompt, however if you do not do it you can't follow the guide. None of the changes will hold, if they are even possible.

  • All of the luanchctl commands fail and can not find any services running
  • All of the roots can not be removed without disabling
  • No applications that are "essential" can be removed without disabling it.
  • Root directory access is limited and read only for many directories including /etc

After removing it the following programs can be deleted:

  1. messages.app
  • may need to rm -rf chatdb by force as it runs recursively and prevented trash to delete it.
    1. game center.app
    2. chess.app
    3. photo booth.app

If you dump too many programs or services the OS WILL destabilize. I unloaded many services as well. I unloaded all of the ones in the guide without too many issues.

Stability Other services and daemons (and possibly some of the below) can cripple and destabilize the OS. It seems to rely a lot more heavily on the core services and CPU spikes seem to occur due to persistant connection attempts or program requirements.

FirmwareYou can not dump ram with this PW enabled, which is a bitch. This has always been the case, but it isn't mentioned. If there is a way to do it, would love to know.

Dump unused Languages You CAN NOT dump unused languages with monolingual unless you are running rootless.

tl;dr please include csrutil disable in the guide as running does not seem possible without doing that first.

replace InstallESD with createinstallmedia

Since Mavericks, every OS X installer has included a tool to make installation media automatically. It's called createinstallmedia and it can be found in /Applications/Install OS X Yosemite.app/Contents/Resources/createinstallmedia. Run it in terminal with no arguments and it should explain how it's used. Faster and more reliable than flashing InstallESD.

New Section: Security and Privacy News

Stay informed to react asap to new threads and security issues as updates and patches are always appearing several days afterwards... sometime even never.

http://www.scmagazine.com/apple-patches-zero-day-to-no-avail/article/436512/?DCMP=EMC-SCUS_Newswire&spMailingID=12305959&spUserID=MTU3ODkzNDMwODgxS0&spJobID=620208846&spReportId=NjIwMjA4ODQ2S0

http://www.securemac.com

http://arstechnica.com/security

https://www.exploit-db.com

https://securelist.com

http://www.greycoder.com

https://www.sans.org/security-resources

https://www.qualys.com/company/newsroom/media-coverage

http://mobilesecurityreport.com
http://www.hotforsecurity.com

http://www.esecurityplanet.com/news
https://www.f-secure.com/en/web/labs_global/from-the-labs

Sophos UTM Home Edition and UTM Essential Firewall

Don't know where to add this two free applications...

UTM Home Edition
https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx
Free Home Use Firewall is a fully equipped software version of the Sophos UTM firewall, available at no cost for home users – no strings attached. It features full Network, Web, Mail and Web Application Security with VPN functionality and protects up to 50 IP addresses.

Requires a dedicated newly formatted PC, not a Mac.
I like this feature: can use multiple Internet connections at the same time, giving you more bandwidth.

UTM Essential Firewall
https://www.sophos.com/en-us/products/free-tools/sophos-utm-essential-firewall.aspx
Free version of the Sophos UTM software and offers fundamental security functions to help protect any business network. Start today and implement a firewall into your company’s IT environment—without charge and no strings attached.

VPNs

I've noticed if you use OS X's VPN client (I have not tried openvpn) that if for some reason the VPN disconnects OS X will then start sending traffic over the next interface available. I'm not sure if there are any easy workarounds (I've seen posts where people setup the firewall to drop most traffic on the non-VPN interfaces) or if using openvpn can solve this problem (in which case, perhaps that should be made note of).

El Capitan OpenSSL

In El Capitan OpenSSL's libraries are still provided but headers have been removed from the OS X SDKs. As a result, you should no longer encourage the use of brew link openssl --force as clang's default link and library paths mean that you may end up using newer Homebrew OpenSSL headers but link against the older, system version.

For a reproduction example see https://gist.github.com/tdsmith/4b502c5cc6e7d358acdf

dnsmasq config for directing only *required* dns lookups to vpn/company's dns server

I know that you already have a comment warning people that "VPN software [typically] overrides DNS settings on connect". However, I wonder if we can do better than that? By adding a pf rule to redirect all udp 53 traffic to the local dnsmasq (to prevent the network config nameserver setting having any effect) and only permit dnscrypt to perform the outgoing lookups (either trivially, using a non-53 port for the public server, or with a more advanced pf rule). Then we can add a small entry under the DNS section to explain how people may add additional server entries to their dnsmasq config to direct DNS queries for certain domains to specific upstream nameservers and hence only use the companies nameserver for looking up private domains within the company, and not sending all their DNS traffic that way.

e.g., server=/internal.example.com/192.168.100.1 will direct all queries in the internal domain to the correct nameserver. You can specify more than one domain in each server option. If there is more than one internal domain, you just include as many server options as is needed to specify them all.

Firewall and signed software

Hi,

In the advanced settings of the firewall in OS X, there's a checkbox named "Automatically allow signed software to receive incoming connections". This checkbox is enabled by default on a new install of 10.11.1.

While one should be in control of what software is running and listens on ports, perhaps we should encourage setting this to off? Just because a software is signed doesn't mean we want incoming connections to it to be allowed by default.

Admin accounts and home folders

Hi,

Thanks for the guide. Do you think setting up a non-admin and running under that along with an admin account for other things should be added, after the installation section? Running anything with elevated permissions is asking for trouble, especially a user account.

It might be worth noting that there are ~/Applications and ~/Library/LaunchAgents and ~/Library/Frameworks folders that can all be used instead of installing things system wide.

I'm happy to put these in pull requests if you agree they're worth it.

Regards,
iain

For El Capitan

Open this thread to add resources and info about El Capitan.
Some might be obsolete.

https://en.wikipedia.org/wiki/Sparse_image

http://osxdaily.com/2015/09/29/prepare-mac-os-x-el-capitan/
http://osxdaily.com/2015/09/30/create-os-x-el-capitan-boot-install-drive/
http://osxdaily.com/2015/10/01/clean-install-os-x-el-capitan-mac/
http://osxdaily.com/2015/10/09/howto-downgrade-os-x-el-capitan-mac/

http://osxdaily.com/2015/10/05/disable-rootless-system-integrity-protection-mac-os-x/
http://osxdaily.com/2015/05/04/disable-gatekeeper-command-line-mac-osx/
http://osxdaily.com/2015/10/12/secure-empty-trash-equivalent-mac-os-x/

Misc. items

Hello,
Sorry, don't have time to write it 'correctly' for a merge, I make a copy/paste from my ugly site ;-)

First, may I suggest to add a table of contents/index on top for main subjects.

I have no link with the following, I am using several of them.

Thanks,

Stf

For your VPN chapter and other tools/services you can find very great deal (sometimes free for life) at

Concerning VPN, I have bought 3 for-life deals (ipnator, vpnunlimited and tigervpn), I will try to make a small report about them, how they are on a mac (and android).

StackSocial.com
Giveaways and deals available for just few days of normally paying software, hardware, tutorials, bundles, gadgets... Some discount are up to 99%, some are free or you give your own price.
Pay attention, some offers can be cheaper on other shopping sites

If you want to thanks me for sparing you hundreds of dollars you can click on my affiliate link
https://stacksocial.com/?rid=1465893

StartSSL.com
Free 256-bit SSL Certificate (Class 1) including Web server certificates (SSL/TLS), Client and Email Certificates (S/MIME).
With a 128 bits and 256 bits encryption, 10000 $USD insurance guaranteed.
Valid one year and can be renewed for free.

https://www.comodo.com/home/email-security/free-email-certificate.php
Free for personal/home users and 12 USD/year for business users.
Comodo free email certificate provides digital signature for confidentiality, secure encryption, protect against identity theft, integrates with MS Office and usual applications, trusted by most email clients.
Check their free products page: antivirus, security tools, total uninstaller, firewall, rescue disk, backup...

SSLlabs.com
Free online security testing tools: SSL Server Test checks the configuration of SSL web server, SSL Client Test lists all SSL/TLS capabilities of your browser and SSL Fingerprint test.

Abine.com
Free temporary masked emails. Also encrypted passwords, protect credit card and phone numbers, block hidden trackers, auto-fill, sync...

SpamFence.net
Free spamfilter services, 99% accuracy and no false-positive!

Objective-see.com
(1. KnockKnock UI - list persistently installed programs to reveal potential malware.)
2. Dylib Hijack Scanner - list apps which can or have been hijacked by malicious dynamic libraries.
3. BlockBlock - prevent installation of any persistent programs without your authorization.

Bleep.pm
Highly secure, p2p, encrypted and native messaging application.

Fruux.com
Manage and synchronize contacts, calendars and tasks.
A very good backup.

Chrome?

Using Chome as a recommended browser is a bit confusing.

Why would anyone go through all of the trouble to secure an OS X system, but then use a closed-source browser that has a history of consumer privacy issues?

dnsmasq doesn't resolve 127.0.0.1

I followed the instructions to set up dnsmasq. As soon as I reach this step, I lose access to the internet:

sudo networksetup -setdnsservers "Wi-Fi" 127.0.0.1

I tried clearing my DNS cache but that did not work. I'm running OS X El Capitan.

Implementaiton of functions() in "Services"

I really appreciate the work you've done in the Security and Privacy Guide.

I'm interested in how you implement the "Services" section.

Do you incorporate the functions there via a login script (.profile, .bashrc, etc.)

Or do you run them manually?

When I run them manually, I'm required to authenticate some of the services, which would make login script implementation cumbersome.

Just wondering how you do it, and perhaps adding those instructions to the README.MD.

Thanks again for a great guide!

Firmware password

Regarding the firmware password.
It is possible (and rather easy) to remove it with physical access to the machine via a SPI flasher.
It is good enough against lame thieves that have no info on how to do this but there are specialised flashers for this purpose being sold on the Internet so it's a protection on a limited threat scenario. Still it is recommended to have one anyway.

Best,
fG!

Same issue like here dnsmasq doesn't resolve 127.0.0.1 #67

Hi drduh, hi rishadafc,

I do have the same problem like rishadafc, but I have not found an solution yet.

If I run "defaults read /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist" the following appears
{
KeepAlive = 1;
Label = "homebrew.mxcl.dnsmasq";
ProgramArguments = (
"/usr/local/opt/dnsmasq/sbin/dnsmasq",
"--keep-in-foreground",
"-C",
"/usr/local/etc/dnsmasq.conf"
);
RunAtLoad = 1;
}

If I run "sudo /usr/local/opt/dnsmasq/sbin/dnsmasq --keep-in-foreground -C /usr/local/etc/dnsmasq.conf" the following appears
dnsmasq: failed to create listening socket for 127.0.0.1: Address already in use

Do you know a solution for my problem? Thanks a lot and best regards, Jonas

FileVault

Protip: Use your Mac a little before turning on the fileVault encription. Install Programms, Setup First and click around to make your system Generated Random key stronger.

New Section: testing checking tools and services

What about adding a new section, testing checking tools and services.

Check Browser Vulnerabilities
https://browsercheck.qualys.com
https://www.browserleaks.com
https://www.browserleaks.com/webrtc
https://www.browserleaks.com/firefox
https://www.poodletest.com - Check if browser is vulnerable due to SSLv3 via block ciphers support.
http://browserspy.dk - Show all the information a browser releases.

Check DNS Leak
https://dnsleaktest.com - Test if your defined DNS servers are leaking information, even when using a secure anonymity or privacy services.

Check Network Vulnerabilities
http://www.speedguide.net/scan.php - Scan Ports for vulnerabilities
http://www.speedguide.net/ports.php - Ports Database of known vulnerabilities
http://www.acunetix.com/free-network-security-scan

Check SSL of a Web Server
https://www.ssllabs.com/ssltest - Deep analysis of the configuration of an SSL web server

Informations
http://whoer.net - Information about the DNS you are using, not just a simple show IP tool.
http://lg.sdv.fr - IP4/6 Looking Glass and BGP map tools.
http://www.team-cymru.org/IP-ASN-mapping.html - map IP numbers to BGP prefixes and ASN for WHOIS, DNS and HTTP(S).
http://speedtest.net - Test you internet speed, useful to know the impact of using a VPN,...

Device Finger Printing
http://noc.to - Device Finger Printing test and reports. Source Code
https://panopticlick.eff.org - Raw DFP results
https://amiunique.org - Detailed DFP results and ressources.

Anti-Virus Comparatives
http://www.av-comparatives.org
https://www.av-test.org

Miscellaneous
https://geti2p.net - I2P is anonymous overlay network for privacy protection.
https://www.wireshark.org - WireShark is a network protocol analyzer.
https://nmap.org - "Network Mapper" for network discovery and security auditing.
http://sectools.org - Extensive list of 'all' security tools.
https://nordvpn.com/chat - Online secure encrypted chat.
https://nordvpn.com/secret-notes - Create a message that will be destroyed after first reading.
http://contagiodump.blogspot.be - Collection of latest malware samples, threats, observations and analyses.

Useless and/or holes in protections

May I suggest a section, of few additions to mention useless/weak and/or holes in protections/tools/settings and if the available alternatives.
Sorry no time to do it.
Thanks for your great work.

VPN - PPTP, useless unsecure, better than nothing
VPN but still use ISP DNS, not all exchange through VPN and VPN with DNSLeak-browser involved
VPN disconnect without killswitch (block all communication if vpn stops)
VPN and accessing your usual accounts, eg gmail, webmail, contacts...
WIFI - WEP
Mobile phone/Computer with Location activated
Browser Finger Print, uses one only for secure works, another for whatever
HTTP with MiTM, move to HTTPS

You get the idea...
Forgot this one, still used by so many, not by the audience here of coz :-) Zip passwords !

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.