Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #72393 > unrolled thread

how hardened is a macbook laptop default

Back to article view | Back to comp.sys.mac.system

Contents

  how hardened is a macbook laptop default Electric Comet <electric-comet@mail.invalid> - 2015-03-30 12:10 -0700
    Re: how hardened is a macbook laptop default nospam <nospam@nospam.invalid> - 2015-03-30 15:13 -0400
    Re: how hardened is a macbook laptop default Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-03-30 15:35 -0400
      Re: how hardened is a macbook laptop default JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-03-30 17:12 -0400
        Re: how hardened is a macbook laptop default Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-03-30 18:25 -0400
          Re: how hardened is a macbook laptop default Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-03-30 23:14 +0000
        Re: how hardened is a macbook laptop default Warren Oates <warren.oates@gmail.com> - 2015-03-30 18:49 -0400
      Re: how hardened is a macbook laptop default Electric Comet <electric-comet@mail.invalid> - 2015-04-03 20:54 -0700
        Re: how hardened is a macbook laptop default Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-04 09:08 -0400
          Re: how hardened is a macbook laptop default Electric Comet <electric-comet@mail.invalid> - 2015-04-05 11:11 -0700
            Re: how hardened is a macbook laptop default Jolly Roger <jollyroger@pobox.com> - 2015-04-05 18:33 +0000
              Re: how hardened is a macbook laptop default Michelle Steiner <michelle@michelle.org> - 2015-04-05 12:08 -0700
                Re: how hardened is a macbook laptop default Jolly Roger <jollyroger@pobox.com> - 2015-04-05 19:25 +0000
            Re: how hardened is a macbook laptop default JF Mezei <jfmezei.spamnot@vaxination.ca> - 2015-04-05 15:04 -0400
            Re: how hardened is a macbook laptop default Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-05 15:30 -0400
              Re: how hardened is a macbook laptop default Joanna Shuttleworth <js@example.com> - 2015-04-06 08:31 +0000
                Re: how hardened is a macbook laptop default Huge <Huge@nowhere.much.invalid> - 2015-04-06 09:28 +0000
                Re: how hardened is a macbook laptop default Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-06 10:11 -0400
    Re: how hardened is a macbook laptop default Warren Oates <warren.oates@gmail.com> - 2015-03-30 15:41 -0400

#72393 — how hardened is a macbook laptop default

if one was to take a macbook to a cafe or some public wifi what steps
would one take to make sure no one can attack the laptop?

Is it pretty hardened by default

I know that accessing sites via https is important but only want to
know if things need to be enabled or disabled to be fully protected

I assume public wifi is a free for all










 

[toc] | [next] | [standalone]

#72394

In article <mfc73l$pc8$1@dont-email.me>, Electric Comet
<electric-comet@mail.invalid> wrote:

> if one was to take a macbook to a cafe or some public wifi what steps
> would one take to make sure no one can attack the laptop?

bring a large vicious dog.

[toc] | [prev] | [next] | [standalone]

#72400

On 2015-03-30 15:10, Electric Comet wrote:
> if one was to take a macbook to a cafe or some public wifi what steps
> would one take to make sure no one can attack the laptop?

Turn on the firewall in Preferences|Security & Privacy to prevent your 
public folders from being read or written to when traveling.

> Is it pretty hardened by default

I don't recall if the firewall is on by default.  Worth checking.

>
> I know that accessing sites via https is important but only want to
> know if things need to be enabled or disabled to be fully protected
>
> I assume public wifi is a free for all

Usually.

[toc] | [prev] | [next] | [standalone]

#72421

On 15-03-30 15:35, Alan Browne wrote:

> Turn on the firewall in Preferences|Security & Privacy to prevent your 
> public folders from being read or written to when traveling.

Opposite.  Leave that public folder accessible and put a document in
there that has such a good joke in it that people die when they read it.

Just watch for someone to die in the café and you'll know who tried to
access your laptop :-)

When at home, do a port scan of your laptop to see which ports are open.
 /etc/services contains a good mapping of port to service name. And then
decide which services should remain and which should be turned off.

you can also do from command line;

sudo lsof -i4

if you grep the output for LISTEN you also get a list of ports that your
laptop is listening to.

[toc] | [prev] | [next] | [standalone]

#72428

On 2015-03-30 17:12, JF Mezei wrote:
> On 15-03-30 15:35, Alan Browne wrote:
>
>> Turn on the firewall in Preferences|Security & Privacy to prevent your
>> public folders from being read or written to when traveling.
>
> Opposite.  Leave that public folder accessible and put a document in
> there that has such a good joke in it that people die when they read it.

Which doesn't prevent a "better joke" from being left on your own public 
folder.  That would include malware or data that one doesn't want on 
ones computer.

[toc] | [prev] | [next] | [standalone]

#72437

In message <jOGdnZwFk5DQUITInZ2dnUU7-cOdnZ2d@giganews.com> 
  Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
> On 2015-03-30 17:12, JF Mezei wrote:
>> On 15-03-30 15:35, Alan Browne wrote:
>>
>>> Turn on the firewall in Preferences|Security & Privacy to prevent your
>>> public folders from being read or written to when traveling.
>>
>> Opposite.  Leave that public folder accessible and put a document in
>> there that has such a good joke in it that people die when they read it.

> Which doesn't prevent a "better joke" from being left on your own public 
> folder.  That would include malware or data that one doesn't want on 
> ones computer.

Your public folder is not writable. There is a Drop folder inside that folder
that is writable, but it is not readable.

-- 
In my world there are people in chains and you can ride them like ponies

[toc] | [prev] | [next] | [standalone]

#72431

In article <5519bc2a$0$29503$c3e8da3$e074e489@news.astraweb.com>,
 JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:

> Opposite.  Leave that public folder accessible and put a document in
> there that has such a good joke in it that people die when they read it.

That's from the very first Monty Python episode.
-- 
Where's the Vangelis music?
Pris' tongue is sticking out in in the wide shot after Batty has kissed her.
They have put back more tits into the Zhora dressing  room scene.
  -- notes for Blade Runner

[toc] | [prev] | [next] | [standalone]

#72630

On Mon, 30 Mar 2015 15:35:46 -0400
Alan Browne <alan.browne@freelunchvideotron.ca> wrote:

> I don't recall if the firewall is on by default.  Worth checking.

I don't recall either but that's why I asked this question

I will have them check if its on if its not on that would leave the
system very vulnerable

Why wouldn't it be on by default











 

[toc] | [prev] | [next] | [standalone]

#72638

On 2015-04-03 23:54, Electric Comet wrote:
> On Mon, 30 Mar 2015 15:35:46 -0400
> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>
>> I don't recall if the firewall is on by default.  Worth checking.
>
> I don't recall either but that's why I asked this question
>
> I will have them check if its on if its not on that would leave the
> system very vulnerable
>
> Why wouldn't it be on by default

If you're setting up a Mac on a network behind a private router/WiFi 
there is no need for a firewall against unknown threats so a default of 
off is not (generally) an issue.

[toc] | [prev] | [next] | [standalone]

#72678

On Sat, 04 Apr 2015 09:08:29 -0400
Alan Browne <alan.browne@freelunchvideotron.ca> wrote:

> If you're setting up a Mac on a network behind a private router/WiFi 
> there is no need for a firewall against unknown threats so a default
> of off is not (generally) an issue.

That's bad advice
I won't be taking that doubt any sane person would

Did you ever see the results and methods for the scan of all ipv4
space

"they" utilized known backdoors, uh of course I mean, vulnerabilities
in "private" router/wifi



BTW results were very interesting















 

[toc] | [prev] | [next] | [standalone]

#72680

On 2015-04-05, Electric Comet <electric-comet@mail.invalid> wrote:
> On Sat, 04 Apr 2015 09:08:29 -0400
> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>
>> If you're setting up a Mac on a network behind a private router/WiFi 
>> there is no need for a firewall against unknown threats so a default
>> of off is not (generally) an issue.
>
> That's bad advice

No it's not. There's absolutely no need  to run the OS X firewall on a
Mac that is already sitting behind a router with its own firewall.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#72682

In article <coddf8Fehl6U10@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> >> If you're setting up a Mac on a network behind a private router/WiFi 
> >> there is no need for a firewall against unknown threats so a default
> >> of off is not (generally) an issue.
> >
> > That's bad advice
> 
> No it's not. There's absolutely no need  to run the OS X firewall on a
> Mac that is already sitting behind a router with its own firewall.

There's no need not to.

[toc] | [prev] | [next] | [standalone]

#72684

On 2015-04-05, Michelle Steiner <michelle@michelle.org> wrote:
> In article <coddf8Fehl6U10@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>> >> If you're setting up a Mac on a network behind a private router/WiFi 
>> >> there is no need for a firewall against unknown threats so a default
>> >> of off is not (generally) an issue.
>> >
>> > That's bad advice
>> 
>> No it's not. There's absolutely no need  to run the OS X firewall on a
>> Mac that is already sitting behind a router with its own firewall.
>
> There's no need not to.

Well it certainly won't *hurt*, although it can present obstacles if you
want to share information between machines that are already behind a
router firewall.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#72681

> If you're setting up a Mac on a network behind a private router/WiFi 
>> there is no need for a firewall against unknown threats 

> That's bad advice
> I won't be taking that doubt any sane person would

You can't generalize.

If your laptop normally lives in an active LAN where machines talk to
each other in both directions, then the in-computer firewall becomes a
pain because you need to manage every machine,s firewall to enable
specific connections from specific machines to specific ports. (on top
of enabling the service that listens to that port.

In such cases, having a proper firewall at the gateway between your LAN
and internet (aka router)  allows your LAN node to frolic in a save
subnet on your LAN with the router protecting all machines from the
internet (but not from each other).

However, if you travel a lot and your laptop uses train/plane/coffee
shop wi-fi a lot, then it is sitting on the internet unprotected at
which point the firewall becomes interesting.

Another thing which is important is to turn off services you don't use.
If your laptop doesn't need a web server, then you tur it off. All of a
sudden, you no oonger need a forewall to protect port 80 since there is
nothing listening at port 80.

In other words, it is better to turn off the services you don't use
rather than putting up an in-computer firewall to block access to
services that are running but which you don't use.

This is why auditing your machine with

 sudo lsof -i4 | grep LISTEN

(you can add -n if you want port numbers instead of service names)

gives you a good idea of the services running on your machine and
whether some should/could be turned off.

[toc] | [prev] | [next] | [standalone]

#72685

On 2015-04-05 14:11, Electric Comet wrote:
> On Sat, 04 Apr 2015 09:08:29 -0400
> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>
>> If you're setting up a Mac on a network behind a private router/WiFi
>> there is no need for a firewall against unknown threats so a default
>> of off is not (generally) an issue.
>
> That's bad advice

It wasn't advice.

> I won't be taking that doubt any sane person would
>
> Did you ever see the results and methods for the scan of all ipv4
> space

A properly configured router makes everything behind it invisible.

>
> "they" utilized known backdoors, uh of course I mean, vulnerabilities
> in "private" router/wifi

See above.  Keyword search for you is:    "Properly configured"

[toc] | [prev] | [next] | [standalone]

#72715

On 2015-04-05, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
> On 2015-04-05 14:11, Electric Comet wrote:
>> On Sat, 04 Apr 2015 09:08:29 -0400
>> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>>
>>> If you're setting up a Mac on a network behind a private router/WiFi
>>> there is no need for a firewall against unknown threats so a default
>>> of off is not (generally) an issue.
>>
>> That's bad advice
>
> It wasn't advice.
>
>> I won't be taking that doubt any sane person would
>>
>> Did you ever see the results and methods for the scan of all ipv4
>> space
>
> A properly configured router makes everything behind it invisible.
>
>>
>> "they" utilized known backdoors, uh of course I mean, vulnerabilities
>> in "private" router/wifi
>
> See above.  Keyword search for you is:    "Properly configured"
>

'properly configured' routers can be subverted. 

Router firmware is often poorly written and rarely updated.

[toc] | [prev] | [next] | [standalone]

#72716

On 2015-04-06, Joanna Shuttleworth <js@example.com> wrote:
> On 2015-04-05, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>> On 2015-04-05 14:11, Electric Comet wrote:
>>> On Sat, 04 Apr 2015 09:08:29 -0400
>>> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>>>
>>>> If you're setting up a Mac on a network behind a private router/WiFi
>>>> there is no need for a firewall against unknown threats so a default
>>>> of off is not (generally) an issue.
>>>
>>> That's bad advice
>>
>> It wasn't advice.
>>
>>> I won't be taking that doubt any sane person would
>>>
>>> Did you ever see the results and methods for the scan of all ipv4
>>> space
>>
>> A properly configured router makes everything behind it invisible.
>>
>>>
>>> "they" utilized known backdoors, uh of course I mean, vulnerabilities
>>> in "private" router/wifi
>>
>> See above.  Keyword search for you is:    "Properly configured"
>>
>
> 'properly configured' routers can be subverted. 
>
> Router firmware is often poorly written and rarely updated.

Which is why anyone bothered about security runs a proper firewall inside
their router.


-- 
Today is Sweetmorn, the 23rd day of Discord in the YOLD 3181
                  I don't have an attitude problem.
    If you have a problem with my attitude, that's your problem.

[toc] | [prev] | [next] | [standalone]

#72725

On 2015-04-06 04:31, Joanna Shuttleworth wrote:
> On 2015-04-05, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>> On 2015-04-05 14:11, Electric Comet wrote:
>>> On Sat, 04 Apr 2015 09:08:29 -0400
>>> Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>>>
>>>> If you're setting up a Mac on a network behind a private router/WiFi
>>>> there is no need for a firewall against unknown threats so a default
>>>> of off is not (generally) an issue.
>>>
>>> That's bad advice
>>
>> It wasn't advice.
>>
>>> I won't be taking that doubt any sane person would
>>>
>>> Did you ever see the results and methods for the scan of all ipv4
>>> space
>>
>> A properly configured router makes everything behind it invisible.
>>
>>>
>>> "they" utilized known backdoors, uh of course I mean, vulnerabilities
>>> in "private" router/wifi
>>
>> See above.  Keyword search for you is:    "Properly configured"
>>
>
> 'properly configured' routers can be subverted.

Only if the person configuring it doesn't know is arse from his toenails.

[toc] | [prev] | [next] | [standalone]

#72401

In article <mfc73l$pc8$1@dont-email.me>,
 Electric Comet <electric-comet@mail.invalid> wrote:

> if one was to take a macbook to a cafe or some public wifi what steps
> would one take to make sure no one can attack the laptop?
> 
> Is it pretty hardened by default
> 
> I know that accessing sites via https is important but only want to
> know if things need to be enabled or disabled to be fully protected
> 
> I assume public wifi is a free for all
> 
>

One thing you can do is boot from a secure stick. The DOD even provide 
one (yesss yesss it's full of backdoors and sends your data to teh 
Trilateralite Commission and to the First Dog (and to Bo too) and so 
forth, but if you wear your tinfoil hat y'all should be okay.

http://spi.dod.mil/liposeFAQ.htm

They claim it works with Intel-based Macs, but it doesn't come with with 
an EFI boot file, so I dunno. I know it works with Linux, because I've 
used it. There are others like this.
-- 
Where's the Vangelis music?
Pris' tongue is sticking out in in the wide shot after Batty has kissed her.
They have put back more tits into the Zhora dressing  room scene.
  -- notes for Blade Runner

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web