Apple drops controversial firewall-bypass feature on macOS

Researchers claim the ContentFilterExlusionList posed a huge cyber security risk

A mouse hovering over the Safari logo on a MacBook

Apple has removed a controversial feature in its macOS operating system that allowed more than 50 of its own apps to completely bypass third-party security tools like firewalls and virtual private networks (VPNs).

The ContentFilterExclusionList, introduced in macOS 11 Big Sur, was flagged by the security community and developers late last year as being a potential security risk. This list’s existence in macOS meant traffic generated from Apple software such as Maps and iCloud couldn’t be blocked by a socket filter firewall.

The developer of the Little Snitch firewall tool, Norbert Heger, described this behaviour as “a hole in the wall”.

Patrick Wardle, a security researcher with software firm Jamf, even demonstrated how it may be possible for malware to abuse “excluded” apps to generate web traffic to bypass firewalls. 

Those who initially sounded the alarm, including Heger, Wardle and others, have now welcomed Apple’s decision to remove ContentFilterExclusionList with the release macOS 11.2 beta 2.

The exclusion list fist emerged as part of Apple’s shift away from third-party kernel extensions, including network kernel extensions (NKEs), which allowed developers to load code directly into the macOS operating system. These NKEs, however, were used by a number of third-party security platforms, including firewalls such as LuLu and Little Snitch.

To continue to support such products on modern iterations of macOS, Apple introduced the user-mode Network Extension Framework (NEF), which developers could use instead to retain macOS compatibility for their firewalls and VPNs.

Apple then exempted more than 50 of its own applications and daemons from being routed through the NEF by introducing the ContentFilterExclusionList. This meant third-party firewalls that used this new framework weren’t able to block traffic from them.

“Many (rightfully) asked, "What good is a firewall if it can't block all traffic?",” Wardle said in a blog post. “Well, after lots of bad press and lots of feedback/bug reports to Apple from developers such as myself, it seems wiser (more security conscious) minds at Cupertino prevailed.”

“The ContentFilterExclusionList list has been removed (in macOS 11.2 beta 2). Which means, (socket filter) firewalls such as LuLu can now comprehensively filter/block all network traffic.”

Researchers have speculated that Apple excluded its own apps from the oversight of third-party firewalls in the name of overall security. For example, if excluded, these services may continue to receive updates when all web traffic is blocked.

Featured Resources

BCDR buyer's guide for MSPs

How to choose a business continuity and disaster recovery solution

Download now

The definitive guide to IT security

Protecting your MSP and your customers

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Recommended

New report highlights the need for diversity in cyber security recruitment
cyber security

New report highlights the need for diversity in cyber security recruitment

28 Apr 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

29 Apr 2021