Researcher: Leopard's Firewall is a Mess

The launch of Apple's newest OS, Leopard, has been, to say the least, tinged with negative press, what with reports of bluescreens due to third party applications and Java incompatibilities. On Friday, Rich Mogull, a security consultant and former Gartner analyst, added more fuel to the fire when he said "[Leopard's] firewall is a mess" after spending two days digging into the new firewall's capabilities. "It's a step back from Tiger's firewall. I was originally pretty bullish on Leopard's security, and I still am on the concepts, but the implementation makes most of its advances ineffective or unusable."The firewall in Mac OS X 10.5 Leopard uses a bare-bones interface -- earlier this week, Mogull called it "so simple as to be nearly useless" -- that offers users three options: allow all incoming connections, block all incoming connections, and set access for specific services and applications  Unfortunately, the implementation seems fraught with problems. "'Block all' does seem to block actual connections," said Mogull, "but any shared ports are detected as 'open/filtered' on a port scan." And unless users turn on stealth, some services -- Bonjour, Apple's network-device-locating technology, is one -- are seen as open by scans, no matter what firewall setting is selected. Only by using "Block all" with stealth enabled are shared services actually invisible.  Read full story...

 


http://feeds.feedburner.com/~r/neowin-main/~3/179614267/researcher-leopards-firewall-is-a-mess