Source
r/macsysadmin•
Heteronymous

"Apple's tracking every app I launch !" No, no they aren't

There's been some lamentable hysteria about the app launch failures/delays macOS users were seeing the other night, corresponding (remembering that correlation ≠ causation) with the release of BigSur. (See https://arstechnica.com/gadgets/2020/11/macos-big-sur-launch-appears-to-cause-temporary-slowdown-in-even-non-big-sur-macs/ )
and what was happening and why, and the privacy concerns that raises - or, not.

Including a few posts claiming some pretty hyperbolic things about what Apple's OSCP service does and how.

Please see:

https://blog.jacopo.io/en/post/apple-ocsp/

"TL;DR

  • No, macOS does not send Apple a hash of your apps each time you run them.
  • You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text on your network.
  • You shouldn’t probably block ocsp.apple.comwith Little Snitch or in your hosts file."

"macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective." For example, the same cert is used for Mozilla Firefox and Thunderbird."

Posted Nov 17, 2020, 3:25 PM UTC · edited

3418
TronLightyearPublic Sector•

The same people making these claims have no idea how certificates work, can't wait for them to freak out when they figure out that anything that uses oscp or crl does the same damn thing

14
ctesibius•

I read one article saying in panicked terms that when your machine sends out this data, Apple gets your IP address!

No shit, Sherlock.

10
wpmEducation•

Wait till they hear that literally anything they connect to on the Internet is logging their public IP address.

7
chrisbeebops•

While I agree with your premise, I would qualify it by saying that not every certificate validation service works the same way. A downloadable CRL wouldn't reveal anything about what apps you have installed or opened on your device. And some other types of services can implement OCSP stapling to avoid clients needing to make OCSP requests themselves to validate a certificate.

4
TronLightyearPublic Sector•

You're absolutely right, everyone does things a bit differently depending on their needs and potentially compliance requirements

1
uptimefordays•

Just wait til they find out how many network services use their IP address!

2
neuroreaction•

The other day I was on my works vpn and in a meeting where someone was talking about a product they use in their home office since the work from home became a thing. I was on my work vpn when I clicked the link, later from my phone on WiFi no vpn that product popped up on my Facebook news feed. My work computer only shares my Internet address nothing with my personal phone. So this tells me they are now using IP addresses and not just cookies to get browsing habits and VPNs don’t matter (or we have this setup as a split tunnel thinking it’s a full)

Addendum: I know this isn’t specific to the group but seemed relevant to the threads topic.

1
uptimefordays•

I mean you could be on a split horizon VPN it’s tough to say but your IP address still belongs to your ISP and is shared by every device on your home network. They just aren’t as identifying as people think.

1
neuroreaction•

If it’s a full tunnel then the internet traffic should go out the internet in the office not my home connection? Anyway if anyone has a false sense of privacy without taking any precautions that’s on that user.

1
damienbarrettEducation•

While I agree with almost everything you've said here and agree that there are waaaaaay too many alarmists ignorantly crying about this, it still remains true and surprising that Apple would design something like this with a single point-of-failure. As large as Apple is, it's actually quite inexcusable.

(note: even while I agree with almost all of the security improvements they've been building into their Oses and App ecosystem).

8
YouMadeItDoWhat•

It fails-safe though...so long as there is NO connection. The problem arises when it doesn't fail, but is just slow (which is what happened the other night).

0†
damienbarrettEducation•

I guess you and I have different ideas about what "fail" means.

I bet virtually every one of my users, who don't understand this issue even in the slightest, would describe an App not launching (because: reasons: gobbledygook) as a failure.

2
YouMadeItDoWhat•

If OSCP cannot contact home at all, it will just allow the app to launch. That's fail-safe. It's when it CAN contact home but the answer is slow in coming that it has issues. There should have been a more aggressive timeout in this case than they have, I agree.

2
Hobadee•

It's when it CAN contact home but the answer is slow in coming that it has issues.

That's called a failure. (Or is a slow loris attack not a thing?)

1
Wartz•

Apps being slow to launch because of trustd being unable to connect to OSCP has been a very real (if extremely rare) potential issue for... 4-5 years? 100% of the time in normal cases it’s caused by wonky dns/routing issues on an individual computer.

I had this one setup in a org’s ceos home where they had a edge firewall/vpn device setup to tunnel back to business and resolving domains from internal DNS would take forever, which also meant their Mac app launches would slow to a crawl!

A tech noticed that flipping the network device off-on “fixed it” while running through a troubleshooting workflow so it was instantly obvious what was going on.

Any Mac admin that knew anything about code signing / notarizing and even a little bit of network knowledge could figure this out in a hurry.

It just took a perfect storm of variables to make it a problem for everyone.

The unfortunate side effect is that a lot of people with no real knowledge of how macs work are going to reduce security on their system in the name of misguided notions of data privacy. We’ll be finding first-google-result people doing this to themselves for the next half decade at least!!

5
Turtle_Online•

Yes, Apple is verifying every app you launch if you want to learn more research GateKeeper. Brief description from this link... https://www.apple.com/macos/security/.

"Gatekeeper on your Mac ensures that all apps from the internet have already been checked by Apple for known malicious code — before you run them the first time. If there’s ever a problem with an app, Apple can quickly stop new installations and even block the app from launching again."

Also, oscp.apple.com was having issues for a considerable amount of time last Thursday causing apps not to launch on internet connected machines. https://mobile.twitter.com/lapcatsoftware/status/1327025734171447302

1
HeteronymousOP•

Gatekeeper has some issues, if you want to learn more go read Patrick Wardle's superlative work on same, https://objective-see.com/blog/blog_0x15.html

But, IIRC and per your quote from Apple above the checkin with Apple is only on "the first time" you launch a newly installed app.

XProtect will/can do a scan each time, but don't believe that phones home, vs. updates from Apple with definitions stored locally.

-2
Turtle_Online•

I'm confident that the check happens everytime there's an app launch. I think the wording is really important in the quote, because it states "even block the app from launching again" which to me aligns with checking everytime.

My understanding was that XProtect is more like a typical anti-malware checking for signatures and doing heuristic analysis, while GateKeeper is the certificate validation service. I'll have to reread into this, it's been a while since I first learned about these features.

Thanks for the link, looks like a really interesting read.

3