Fire & Ice: Making and Breaking macOS Firewalls

The talk discusses the process of creating and breaking macOS firewalls.

• Firewalls play an important role in protecting against malware on macOS.
• Creating a firewall for macOS involves using Network Kernel Extensions (NKEs) and socket filters.
• The socket filter structure has various callbacks that allow the firewall to examine and either allow or block socket actions.
• Lulu is a free firewall for macOS that uses these techniques.
• Breaking or bypassing firewalls is also discussed, including various attacks against macOS firewalls.
• The talk aims to improve the existing status quo of firewall development.

The speaker describes how they decided to create a firewall for macOS and the process they went through to do so. They also discuss the importance of firewalls in protecting privacy and detecting cyberattacks.

In the ever raging battle between malicious code and anti-malware tools, firewalls play an essential role. Many a malware has been generically thwarted thanks to the watchful eye of these products. However on macOS, firewalls are rather poorly understood. Apple's documentation surrounding its network filter interfaces (used to create kernel-mode firewalls) is rather lacking and all commercial macOS firewalls are closed source.This talk aims to take a peek behind the proverbial curtain revealing how to both create and 'destroy' host-based macOS firewall products.In this talk, we'll first dive into what it takes to create an effective firewall for macOS. Yes we'll discuss core concepts such as kernel-level socket filtering, but also how to communicate with user-mode components, install privileged code in a secure manner, and simple ways to implement self-defense mechanisms (including protecting the UI from synthetic events). Of course any security tool, including firewalls, can be broken. After looking at various macOS malware specimens that proactively attempt to detect such firewalls, we'll don our 'gray' (black?) hats to discuss both security vulnerabilities and various generic attacks against these products. And while some attacks are well known, others are currently undisclosed and can generically bypass even today's most vigilant 3rd-party Mac firewalls. But all is not lost! By proactively discussing such attacks, combined with our newly-found understandings of firewall internals, we can improve the existing status quo, advancing firewall development. With a little luck, such advancements may foil, or at least complicate, the lives of tomorrow's sophisticated Mac malware!