mirror of
https://github.com/privacyguides/i18n.git
synced 2025-06-18 16:54:21 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warnung</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warnung</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Los nuevos dispositivos de Apple Silicon pueden configurarse sin una conexión a
|
||||
|
||||
macOS realiza comprobaciones en línea al abrir una aplicación para verificar si contiene malware conocido y si el certificado de firma del desarrollador es revocado.
|
||||
|
||||
Anteriormente, estas comprobaciones se realizaban a través de un protocolo OCSP no cifrado que podía filtrar información sobre las aplicaciones que ejecutaba en tu red. Apple actualizó su servicio OCSP para utilizar el cifrado HTTPS en 2021, y [publicó información](https://support.apple.com/HT202491) sobre su política de registro para este servicio. Además, prometieron añadir un mecanismo para que las personas pudieran optar por no participar en esta comprobación en línea, pero esto no se ha añadido a macOS todavía (julio de 2023).
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
Aunque [puedes](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) excluirte manualmente de esta comprobación con relativa facilidad, recomendamos no hacerlo a menos que las comprobaciones de revocación realizadas por macOS te pongan en grave peligro, ya que desempeñan un papel importante a la hora de garantizar que se bloquee la ejecución de aplicaciones comprometidas.
|
||||
|
||||
@ -32,14 +32,14 @@ Sin embargo, en utilidades de protección como `sudo`, [en el pasado](https://bo
|
||||
|
||||
Si utilizas una segunda cuenta, no es estrictamente necesario que inicies sesión en tu cuenta de Administrador original desde la pantalla de inicio de sesión de macOS. Cuando estés haciendo algo como usuario Estándar que requiera permisos de Administrador, el sistema debería pedirte autenticación, donde puedes introducir tus credenciales de Administrador como usuario Estándar una sola vez. Apple proporciona [orientación](https://support.apple.com/HT203998) sobre cómo ocultar tu cuenta de Administrador si prefieres ver sólo una cuenta en tu pantalla de inicio de sesión.
|
||||
|
||||
Alternativamente, puedes utilizar una utilidad como [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) para escalar a derechos de Administrador bajo demanda, pero esto puede ser vulnerable a algún exploit no descubierto, como todas las protecciones basadas en software.
|
||||
|
||||
### iCloud
|
||||
|
||||
La mayoría de los problemas de privacidad y seguridad de los productos Apple están relacionados con sus *servicios en la nube*, no con su hardware o software. Cuando utilizas servicios de Apple como iCloud, la mayor parte de tu información se almacena en sus servidores y se protege con claves *a las que Apple tiene acceso* por defecto. En ocasiones, las fuerzas de seguridad han abusado de este nivel de acceso para eludir el hecho de que tus datos están cifrados de forma segura en tu dispositivo y, por supuesto, Apple es vulnerable a las filtraciones de datos como cualquier otra empresa.
|
||||
Cuando utilizas servicios de Apple como iCloud, la mayor parte de tu información se almacena en sus servidores y se protege con claves *a las que Apple tiene acceso* por defecto. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Por lo tanto, si utilizas iCloud, deberías activar la [ **Protección de Datos Avanzada**](https://support.apple.com/HT212520). Esto encripta casi todos tus datos de iCloud con claves almacenadas en tus dispositivos (encriptación de extremo a extremo), en lugar de en los servidores de Apple, de modo que tus datos de iCloud están protegidos en caso de violación de datos y, por lo demás, ocultos a Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### Ajustes del Sistema
|
||||
|
||||
Hay una serie de configuraciones integradas que deberías confirmar o cambiar para reforzar tu sistema. Abre la aplicación **Ajustes**:
|
||||
@ -54,7 +54,9 @@ Dependiendo de si estás utilizando **Wi-Fi** o **Ethernet** (indicado con un pu
|
||||
|
||||
Haz clic en el botón "Detalles" junto al nombre de tu red:
|
||||
|
||||
- [x] Selecciona **Limitar rastreo de dirección IP**
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
|
||||
@ -134,21 +136,13 @@ El [modo hermético](https://blog.privacyguides.org/2022/10/27/macos-ventura-pri
|
||||
|
||||
### Aleatorización de direcciones Mac
|
||||
|
||||
macOS utiliza una dirección MAC aleatoria cuando realiza escaneos Wi-FI mientras está desconectado de una red. Sin embargo, cuando se conecta a una red Wi-Fi preferida, la dirección MAC utilizada nunca es aleatoria. La aleatorización completa de direcciones MAC es un tema avanzado y la mayoría de las personas no necesita preocuparse sobre realizar los siguientes pasos.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
A diferencia de iOS, macOS no proporciona una opción para aleatorizar la dirección MAC en los ajustes, por lo que si deseas modificar este identificador, necesitas hacerlo con un comando o un script. Para establecer una dirección MAC aleatoria, primero debe desconectarse de la red si ya está conectado, luego debe abrir la **Terminal** e ingresar este comando para aleatorizar la dirección MAC:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` es el nombre de la interfaz a la que le está cambiando la dirección MAC. Puede que esto no sea correcto en todos los Mac, así que para comprobarlo puedes mantener presionada la tecla Opción y seleccionar el símbolo de Wi-Fi en la parte superior derecha de la pantalla. El "nombre de la interfaz" debe aparecer en la parte superior del menú desplegable.
|
||||
|
||||
Este comando establece la dirección MAC en una aleatoria "administrada localmente", coincidiendo con las características de aleatorización de dirección MAC presentes en iOS, Windows y Android. Esto significa que cada carácter en la dirección MAC está completamente aleatorizado, a excepción del segundo carácted, que denota la dirección MAC como *localmente administrada* y no está en conflicto con algún hardware real. Este método presenta mejor compatibilidad con redes modernas. Un método alternativo es establecer los seis primeros caracteres de la dirección MAC en uno de los *Identificadores Únicos Organizacionales* de Apple, que dejaremos como un ejercicio para el lector. Este método es más probable que genere problemas con algunas redes, pero puede ser menos reconocible. Debido a la prevalencia de las direcciones MAC aleatorias y localmente administradas en otros sistemas operativos modernos, no consideramos que alguno de los métodos presente mejoras significativas para la privacidad, a comparación de los otros.
|
||||
|
||||
Cuando se conecta a la red nuevamente, se conectará con una dirección MAC aleatoria. Esto se restablecerá al reiniciar.
|
||||
|
||||
Su dirección MAC no es el único identificador sobre su dispositivo que es transmitido por la red, su nombre de host es otra pieza de información que puede identificarlo. Es posible que desee establecer su nombre de host en algo genérico como "MacBook Air", "Laptop", "John's MacBook Pro", o "iPhone" en **Configuración del sistema** > **General** > **Compartir**. Algunos [scripts de privacidad](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) le permiten generar fácilmente nombres de host aleatorios.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Algunos [scripts de privacidad](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) le permiten generar fácilmente nombres de host aleatorios.
|
||||
|
||||
## Protecciones de seguridad
|
||||
|
||||
@ -179,20 +173,61 @@ La Protección de la integridad del sistema hace que las ubicaciones de los arch
|
||||
|
||||
##### Sandbox de aplicaciones
|
||||
|
||||
Las aplicaciones macOS enviadas a la App Store después del 1 de junio de 2012 deben estar aisladas mediante [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Advertencia</p>
|
||||
|
||||
El software descargado desde fuera de la App Store oficial no necesita ser virtualizado. Debes evitar en la medida de lo posible el software que no se encuentre en la App Store.
|
||||
El software descargado desde fuera de la App Store oficial no necesita ser virtualizado. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Advertencia</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS incluye dos formas de defensa ante el malware:
|
||||
|
||||
1. La protección ante la ejecución del malware es proporcionada por el proceso de revisión de aplicaciones de la App Store, o la *Notarización* (parte de *Gatekeeper*), proceso donde las aplicaciones de terceros son escaneadas por Apple para buscar algún malware conocido, antes de que se le permita ser ejecutada.
|
||||
1. La protección ante la ejecución del malware es proporcionada por el proceso de revisión de aplicaciones de la App Store, o la *Notarización* (parte de *Gatekeeper*), proceso donde las aplicaciones de terceros son escaneadas por Apple para buscar algún malware conocido, antes de que se le permita ser ejecutada. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. La protección contra otros malware y la remediación contra malware existente en el sistema, es proporcionada por *XProtect*, un antivirus tradicional incluido en macOS.
|
||||
|
||||
Recomendamos evitar la instalación de antivirus desarrollados por terceras personas porque, generalmente, estos no cuentan con acceso al nivel del sistema, requerido para funcionar correctamente. Esto se debe a las limitaciones de Apple en las aplicaciones de terceros, además de que garantizar altos niveles de acceso puede afectar la seguridad y la privacidad de la computadora.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Les nouveaux appareils Apple silicium peuvent être configurés sans connexion i
|
||||
|
||||
macOS effectue des contrôles en ligne lorsque vous ouvrez une application afin de vérifier si elle contient des logiciels malveillants connus et si le certificat de signature du développeur a été révoqué.
|
||||
|
||||
Auparavant, ces vérifications étaient effectuées via un protocole OCSP non chiffré, ce qui pouvait entraîner une fuite d'informations sur les applications que vous exécutez sur votre réseau. Apple a mis à jour son service OCSP pour utiliser le chiffrement HTTPS en 2021, et [a publié des informations](https://support.apple.com/HT202491) sur sa politique de journalisation pour ce service. Ils ont également promis d'ajouter un mécanisme permettant aux personnes de se retirer de cette vérification en ligne, mais cela n'a pas été ajouté à macOS en date de juillet 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
Bien que vous [puissiez](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) désactiver manuellement cette vérification assez facilement, nous vous déconseillons de le faire à moins que les vérifications de révocation effectuées par macOS ne vous compromettent gravement, car elles jouent un rôle important en empêchant l'exécution d'applications compromises.
|
||||
|
||||
@ -32,14 +32,14 @@ Cependant, des exploits dans des utilitaires de protection tels que `sudo` ont
|
||||
|
||||
Si vous utilisez un deuxième compte, il n'est pas strictement nécessaire de vous connecter à votre compte administrateur d'origine à partir de l'écran de connexion de macOS. Lorsque vous effectuez, en tant qu'utilisateur standard, une opération nécessitant des autorisations d'administrateur, le système vous invite à vous authentifier, ce qui vous permet d'entrer une seule fois vos informations d'identification d'administrateur en tant qu'utilisateur standard. Apple fournit des [conseils](https://support.apple.com/HT203998) sur la façon de masquer votre compte administrateur si vous préférez ne voir qu'un seul compte sur votre écran de connexion.
|
||||
|
||||
Vous pouvez également utiliser un utilitaire tel que [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) pour obtenir les droits d'administrateur à la demande, mais cette solution peut être vulnérable à un exploit non découvert, comme toutes les protections basées sur des logiciels.
|
||||
|
||||
### iCloud
|
||||
|
||||
La majorité des préoccupations relatives à la protection de la vie privée et à la sécurité des produits Apple sont liées à leurs *services cloud*, et non à leurs matériels ou à leurs logiciels. Lorsque vous utilisez des services Apple comme iCloud, la plupart de vos informations sont stockées sur leurs serveurs et sécurisées par des clés *auxquelles Apple a accès* par défaut. Ce niveau d'accès a parfois été utilisé de manière abusive par les forces de l'ordre pour contourner le fait que vos données sont par ailleurs chiffrées de manière sécurisée sur votre appareil, et bien sûr Apple est vulnérable aux fuites de données comme toute autre entreprise.
|
||||
Lorsque vous utilisez des services Apple comme iCloud, la plupart de vos informations sont stockées sur leurs serveurs et sécurisées par des clés *auxquelles Apple a accès* par défaut. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Par conséquent, si vous utilisez iCloud, vous devriez [activer la**Protection avancée des données**](https://support.apple.com/HT212520). Cela permet de chiffrer la quasi-totalité de vos données iCloud à l'aide de clés stockées sur vos appareils (chiffrement de bout en bout), plutôt que sur les serveurs d'Apple, de sorte que vos données iCloud sont sécurisées en cas de fuite de données, et qu'elles sont par ailleurs cachées à Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### Paramètres systèmes
|
||||
|
||||
Il y a un certain nombre de paramètres intégrés que vous devriez confirmer ou modifier pour renforcer votre système. Ouvrez l'application **Paramètres** :
|
||||
@ -54,7 +54,9 @@ Selon que vous utilisez **Wi-Fi** ou **Ethernet** (indiqué par un point vert et
|
||||
|
||||
Cliquez sur le bouton "Détails" à côté du nom de votre réseau :
|
||||
|
||||
- [x] Cochez **Limiter le pistage des adresses IP**
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Pare-feu
|
||||
|
||||
@ -134,21 +136,13 @@ Le [mode Isolement](https://blog.privacyguides.org/2022/10/27/macos-ventura-priv
|
||||
|
||||
### Adresse MAC aléatoire
|
||||
|
||||
macOS utilise une adresse MAC aléatoire lorsqu'il effectue des analyses Wi-Fi alors qu'il est déconnecté d'un réseau. Toutefois, lorsque vous vous connectez à un réseau Wi-Fi préféré, l'adresse MAC utilisée n'est jamais aléatoire. La randomisation complète des adresses MAC est un sujet avancé, et la plupart des gens n'ont pas besoin de se préoccuper des étapes suivantes.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Contrairement à iOS, macOS ne propose pas d'option de randomisation de l'adresse MAC dans les paramètres, de sorte que si vous souhaitez modifier cet identifiant, vous devrez le faire à l'aide d'une commande ou d'un script. Pour définir une adresse MAC aléatoire, déconnectez-vous d'abord du réseau si vous êtes déjà connecté, puis ouvrez **Terminal** et entrez cette commande pour randomiser votre adresse MAC :
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` est le nom de l'interface dont vous modifiez l'adresse MAC. Il se peut que ce ne soit pas la bonne sur tous les Mac, donc pour vérifier, vous pouvez maintenir la touche option et cliquer sur le symbole Wi-Fi en haut à droite de votre écran. Le "nom de l'interface" doit être affiché en haut du menu déroulant.
|
||||
|
||||
Cette commande définit votre adresse MAC comme une adresse aléatoire "administrée localement", ce qui correspond au comportement des fonctions de randomisation des adresses MAC d'iOS, de Windows et d'Android. Cela signifie que chaque caractère de l'adresse MAC est entièrement aléatoire, à l'exception du deuxième caractère, qui indique que l'adresse MAC est *administrée localement*, et qu'elle n'est en conflit avec aucun matériel réel. Cette méthode est la plus compatible avec les réseaux modernes. Une autre méthode consiste à attribuer aux six premiers caractères de l'adresse MAC l'un des *identificateurs organisationnels uniques* d'Apple, que nous laisserons à l'appréciation du lecteur. Cette méthode est plus susceptible d'entrer en conflit avec certains réseaux, mais peut être moins visible. Étant donné la prévalence des adresses MAC randomisées et administrées localement dans d'autres systèmes d'exploitation modernes, nous ne pensons pas qu'une méthode présente des avantages significatifs en matière de protection de la vie privée par rapport à l'autre.
|
||||
|
||||
Lorsque vous vous connecterez à nouveau au réseau, vous le ferez avec une adresse MAC aléatoire. Cela sera réinitialisé lors du redémarrage.
|
||||
|
||||
Votre adresse MAC n'est pas la seule information unique concernant votre appareil qui est diffusée sur le réseau, votre nom d'hôte est un autre élément d'information qui pourrait vous identifier de manière unique. Vous pouvez définir votre nom d'hôte avec quelque chose de générique comme "MacBook Air", "Laptop", "MacBook Pro de John", ou "iPhone" dans **Réglages système** > **Général** > **Partage**. Certains [scripts de confidentialité](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) vous permettent de générer facilement des noms d'hôtes avec des noms aléatoires.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Certains [scripts de confidentialité](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) vous permettent de générer facilement des noms d'hôtes avec des noms aléatoires.
|
||||
|
||||
## Protections de sécurité
|
||||
|
||||
@ -179,20 +173,61 @@ La protection de l'intégrité du système met en lecture seule les emplacements
|
||||
|
||||
##### Sandbox des applications
|
||||
|
||||
Les applications macOS soumises à l'App Store après le 1er juin 2012 doivent être sanboxées à l'aide de l'[App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avertissement</p>
|
||||
|
||||
Les logiciels téléchargés en dehors de l'App Store officiel n'ont pas besoin d'être placés en sandbox. Vous devriez éviter autant que possible les logiciels qui ne font pas partie de l'App Store.
|
||||
Les logiciels téléchargés en dehors de l'App Store officiel n'ont pas besoin d'être placés en sandbox. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avertissement</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS est doté de deux formes de défense contre les logiciels malveillants :
|
||||
|
||||
1. La protection contre le lancement de logiciels malveillants est assurée par le processus d'examen des applications de l'App Store, ou *Notarization* (fait partie de *Gatekeeper*), un processus au cours duquel les applications tierces sont analysées par Apple à la recherche de logiciels malveillants connus avant d'être autorisées à s'exécuter.
|
||||
1. La protection contre le lancement de logiciels malveillants est assurée par le processus d'examen des applications de l'App Store, ou *Notarization* (fait partie de *Gatekeeper*), un processus au cours duquel les applications tierces sont analysées par Apple à la recherche de logiciels malveillants connus avant d'être autorisées à s'exécuter. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. La protection contre les autres logiciels malveillants et la remédiation des logiciels malveillants existants sur votre système sont assurées par *XProtect*, un logiciel antivirus plus traditionnel intégré à macOS.
|
||||
|
||||
Nous vous déconseillons d'installer des logiciels antivirus tiers, car ils n'ont généralement pas l'accès au niveau du système nécessaire pour fonctionner correctement, en raison des limitations imposées par Apple aux applications tierces, et parce que l'octroi des niveaux d'accès élevés qu'ils demandent pose souvent un risque encore plus grand pour la sécurité et la vie privée de votre ordinateur.
|
||||
|
||||
@ -20,7 +20,7 @@ description: macOS is Apple's desktop operating system that works with their har
|
||||
|
||||
macOS מבצעת בדיקות מקוונות כאשר אתה פותח אפליקציה כדי לוודא אם אפליקציה מכילה תוכנה זדונית ידועה, והאם אישור החתימה של המפתח נשלל.
|
||||
|
||||
בעבר, בדיקות אלו בוצעו באמצעות פרוטוקול OCSP לא מוצפן שיכול היה להדליף מידע על האפליקציות שהרצת לרשת שלך. אפל שדרגה את שירות ה-OCSP שלה לשימוש בהצפנת HTTPS בשנת 2021, ו[פרסמה מידע](https://support.apple.com/HT202491) על מדיניות הרישום שלהם עבור שירות זה. בנוסף, הם הבטיחו להוסיף מנגנון שיאפשר לאנשים לבטל את הסכמתם לבדיקה המקוונת הזו, אך זה לא התווסף ל-macOS נכון ליולי 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
אם אתה משתמש בחשבון שני, אין צורך בהחלט להיכנס לחשבון המנהל המקורי שלך ממסך הכניסה של macOS. כאשר אתה עושה משהו כמשתמש רגיל הדורש הרשאות מנהל מערכת, המערכת אמורה לבקש ממך אימות, שם תוכל להזין את אישורי המנהל שלך כמשתמש הרגיל שלך באופן חד פעמי. אפל מספקת [הנחיות](https://support.apple.com/HT203998) להסתרת חשבון המנהל שלך אם אתה מעדיף לראות רק חשבון בודד במסך ההתחברות שלך.
|
||||
|
||||
לחלופין, אתה יכול להשתמש בכלי שירות כמו [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) כדי להסלים לזכויות מנהל על פי דרישה, אבל זה עשוי להיות פגיע לניצול שלא התגלה, כמו כל הגנות מבוססות תוכנה.
|
||||
|
||||
### iCloud
|
||||
|
||||
רוב דאגות הפרטיות והאבטחה של מוצרי אפל קשורות ל*שירותי הענן* שלהם, לא לחומרה או לתוכנה שלהם. כאשר אתה משתמש בשירותי אפל כמו iCloud, רוב המידע שלך מאוחסן בשרתים שלהם ומאובטח באמצעות מפתחות *שאלם יש לאפל גישה* כברירת מחדל. רמת הגישה הזו נוצלה מדי פעם על ידי רשויות אכיפת החוק כדי לעקוף את העובדה שהנתונים שלך מוצפנים בצורה מאובטחת במכשיר שלך, וכמובן שאפל חשופה לפרצות מידע כמו כל חברה אחרת.
|
||||
כאשר אתה משתמש בשירותי אפל כמו iCloud, רוב המידע שלך מאוחסן בשרתים שלהם ומאובטח באמצעות מפתחות *שאלם יש לאפל גישה* כברירת מחדל. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
לכן, אם אתה משתמש ב-iCloud, עליך [להפעיל את **הגנת נתונים מתקדמת**](https://support.apple.com/HT212520). זה מצפין כמעט את כל נתוני ה-iCloud שלך עם מפתחות המאוחסנים במכשירים שלך (הצפנה מקצה לקצה), ולא בשרתים של אפל, כך שנתוני ה-iCloud שלך מאובטחים במקרה של הפרת נתונים, ומוסתרים אחרת מאפל.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### הגדרות מערכת
|
||||
|
||||
ישנן מספר הגדרות מובנות שאתה צריך לאשר או לשנות כדי להקשיח את המערכת שלך. פתח את אפליקציית **הגדרות**:
|
||||
@ -54,7 +54,9 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
לחץ על כפתור "פרטים" לפי שם הרשת שלך:
|
||||
|
||||
- [x] סמן את **הגבלת מעקב אחר כתובות IP**
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### חומת-אש
|
||||
|
||||
@ -134,21 +136,13 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
### כתובת MAC אקראית
|
||||
|
||||
macOS משתמש בכתובת MAC אקראית בעת ביצוע סריקות Wi-Fi בזמן ניתוק מרשת. עם זאת, כאשר אתה מתחבר לרשת Wi-Fi מועדפת, כתובת ה-MAC המשמשת לעולם אינה אקראית. אקראיות מלאה של כתובות MAC היא נושא מתקדם, ורוב האנשים לא צריכים לדאוג לגבי ביצוע השלבים הבאים.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
בניגוד ל-iOS, macOS לא נותן לך אפשרות לעשות אקראי את כתובת ה-MAC שלך בהגדרות, כך שאם תרצה לשנות מזהה זה, תצטרך לעשות זאת עם פקודה או סקריפט. כדי להגדיר כתובת MAC אקראית, ראשית התנתק מהרשת אם אתה כבר מחובר, ואז פתח את **Terminal** והזן פקודה זו כדי להפוך את כתובת ה-MAC שלך באקראי:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` הוא שם הממשק שעבורו אתה משנה את כתובת ה-MAC. ייתכן שזה לא המתאים בכל Mac, אז כדי לבדוק אתה יכול להחזיק את מקש האפשרות וללחוץ על סמל ה- Wi-Fi בפינה השמאלית העליונה של המסך. "שם ממשק" אמור להיות מוצג בחלק העליון של התפריט הנפתח.
|
||||
|
||||
פקודה זו מגדירה את כתובת ה-MAC שלך לכתובת אקראית, "מנוהלת מקומית", התואמת את ההתנהגות של תכונות האקראיות של כתובות MAC של iOS, Windows ו-Android. משמעות הדבר היא שכל תו בכתובת ה-MAC הוא אקראי לחלוטין מלבד התו השני, המציין את כתובת ה-MAC כ*מנוהלת מקומית* ואינה מתנגשת עם חומרה ממשית כלשהי. שיטה זו מתאימה ביותר לרשתות מודרניות. שיטה חלופית היא להגדיר את ששת התווים הראשונים של כתובת ה-MAC לאחד מ*מזהים ייחודיים ארגוניים* הקיימים של אפל, אותם נשאיר כתרגיל לקורא. סביר יותר ששיטה זו תתנגש עם רשתות מסוימות, אך עשויה להיות פחות בולטת. בהתחשב בשכיחותן של כתובות MAC אקראיות המנוהלות מקומית במערכות הפעלה מודרניות אחרות, איננו חושבים שלכל אחת מהשיטות יש יתרונות פרטיות משמעותיים על פני האחרת.
|
||||
|
||||
כאשר תתחבר שוב לרשת, תתחבר עם כתובת MAC אקראית. זה יאופס עם אתחול מחדש.
|
||||
|
||||
כתובת ה-MAC שלך היא לא המידע הייחודי היחיד על המכשיר שלך המשודר ברשת, שם המארח שלך הוא עוד פיסת מידע שיכולה לזהות אותך באופן ייחודי. ייתכן שתרצה להגדיר את שם המארח שלך למשהו כללי כמו "MacBook Air", "Laptop", "John's MacBook Pro" או "iPhone" ב**הגדרות מערכת** > **כללי** > **שיתוף**. כמה [סקריפטים של פרטיות](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) מאפשרים לך ליצור בקלות שמות מארח עם שמות אקראיים.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. כמה [סקריפטים של פרטיות](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) מאפשרים לך ליצור בקלות שמות מארח עם שמות אקראיים.
|
||||
|
||||
## הגנות אבטחה
|
||||
|
||||
@ -179,20 +173,61 @@ macOS מגדיר מגבלות אבטחה מסוימות שלא ניתן לעקו
|
||||
|
||||
##### ארגז חול לאפליקציה
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
תוכנה שהורדה מחוץ לחנות האפליקציות הרשמית אינה חייבת להיות בארגז חול. עליך להימנע ככל האפשר מתוכנות שאינן ב-App Store.
|
||||
תוכנה שהורדה מחוץ לחנות האפליקציות הרשמית אינה חייבת להיות בארגז חול. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### אנטי וירוס
|
||||
|
||||
macOS מגיע עם שתי צורות של הגנה מפני תוכנות זדוניות:
|
||||
|
||||
1. הגנה מפני הפעלת תוכנות זדוניות מלכתחילה מסופקת על ידי תהליך הבדיקה של App Store עבור יישומי App Store, או *אישור נוטריוני* (חלק מ* Gatekeeper*), תהליך שבו יישומי צד שלישי נסרקים לאיתור תוכנות זדוניות ידועות על ידי אפל לפני שהם מורשים לפעול.
|
||||
1. הגנה מפני הפעלת תוכנות זדוניות מלכתחילה מסופקת על ידי תהליך הבדיקה של App Store עבור יישומי App Store, או *אישור נוטריוני* (חלק מ* Gatekeeper*), תהליך שבו יישומי צד שלישי נסרקים לאיתור תוכנות זדוניות ידועות על ידי אפל לפני שהם מורשים לפעול. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. הגנה מפני תוכנות זדוניות אחרות ותיקון מתוכנות זדוניות קיימות במערכת שלך מסופקת על ידי *XProtect*, תוכנת אנטי-וירוס מסורתית יותר המובנית ב-macOS.
|
||||
|
||||
אנו ממליצים לא להתקין תוכנת אנטי-וירוס של צד שלישי מכיוון שבדרך כלל אין להם את הגישה ברמת המערכת הנדרשת לתפקוד תקין בכל מקרה, בגלל המגבלות של אפל על אפליקציות של צד שלישי, ומכיוון שהענקת רמות הגישה הגבוהות שהם מבקשים מייצגת לעתים קרובות סיכון אבטחה ופרטיות גדול עוד יותר למחשב שלך.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Figyelmeztetés</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Figyelmeztetés</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS menggunakan alamat MAC secara acak saat melakukan pemindaian Wi-Fi ketika terputus dari jaringan. Namun, apabila Anda tersambung ke jaringan Wi-Fi pilihan, alamat MAC yang digunakan tidak pernah diacak. Pengacakan alamat MAC penuh adalah topik tingkat lanjut, dan kebanyakan orang tidak perlu khawatir untuk melakukan langkah-langkah berikut ini.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Tidak seperti iOS, macOS tidak memberi Anda opsi untuk mengacak alamat MAC Anda dalam pengaturan, jadi jika Anda ingin mengubah pengenal ini, Anda harus melakukannya dengan perintah atau skrip. Untuk mengatur alamat MAC acak, pertama-tama putuskan sambungan dari jaringan jika Anda sedang tersambung, lalu buka **Terminal** dan masukkan perintah ini untuk mengacak alamat MAC Anda:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. Metode ini paling kompatibel dengan jaringan modern. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ I nuovissimi dispositivi di Apple silicon sono configurabili senza una connessio
|
||||
|
||||
macOS esegue controlli online quando apri un'app, per verificare che questa non contenga malware noti e se il certificato di firma dello sviluppatore è stato revocato.
|
||||
|
||||
Precedentemente, questi controlli erano eseguiti tramite un protocollo crittografato OCSP, le cui informazioni sulle app che esegui sulla tua rete, sarebbero potute trapelare. Apple ha aggiornato il proprio servizio OCSP per utilizzare la crittografia HTTPS nel 2021 e ha [pubblicato le informazioni](https://support.apple.com/HT202491) sulla propria politica di registrazione per questo servizio. Inoltre, hanno promesso di aggiungere un meccanismo per consentire alle persone di disattivare questo controllo online, sebbene questo non sia stato aggiunto a macOS fino a luglio 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
Se utilizzi un secondo profilo, non è rigorosamente necessario connettersi al tuo profilo da Amministratore originale, dalla schermata d'accesso di macOS. Quando stai facendo qualcosa da utente Standard che richieda le autorizzazioni da Amministratore, il sistema dovrebbe richiederti l'autenticazione, dove puoi inserire le tue credenziali da Amministratore, pur essendo un utente Standard, una tantum. Apple fornisce [supporto](https://support.apple.com/HT203998) per nascondere il tuo profilo da Amministratore, se preferisci visualizzare un singolo profilo sulla tua schermata di accesso.
|
||||
|
||||
Altrimenti, puoi utilizzare un'utility come [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) per intensificare su richiesta i diritti da Amministratore, ma ciò potrebbe essere vulnerabile ad alcuni exploit non ancora scoperti, come tutte le protezioni basate su software.
|
||||
|
||||
### iCloud
|
||||
|
||||
Gran parte delle preoccupazioni su privacy e sicurezza con i prodotti di Apple sono relative ai loro *servizi su cloud*, non al loro hardware o software. Quando utilizzi i servizi di Apple come iCloud, gran parte delle tue informazioni sono memorizzate sui loro server e protetti dalle chiavi *cui Apple ha accesso* di default. Questo livello d'accesso è stato occasionalmente abusato dalle autorità per aggirare il fatto che i tuoi dati sono altrimenti crittografati in sicurezza sul tuo dispositivo e, ovviamente, Apple è vulnerabile alle violazioni di dati, come ogni altra azienda.
|
||||
Quando utilizzi i servizi di Apple come iCloud, gran parte delle tue informazioni sono memorizzate sui loro server e protetti dalle chiavi *cui Apple ha accesso* di default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Dunque, se utilizzi iCloud, dovresti [abilitare la **Protezione Avanzata dei Dati**](https://support.apple.com/HT212520). Questa, crittografa praticamente tutti i tuoi dati di iCloud con chiavi memorizzate sui tuoi dispositivi (crittografia end-to-end), piuttosto che sui server di Apple, così che i tuoi dati di iCloud siano protetti nel caso di una violazione di dati, e altrimenti nascosti da Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### Impostazioni di Sistema
|
||||
|
||||
Esistono numerose impostazioni integrate che dovresti confermare o modificare per proteggere il tuo sistema. Apri l'app delle **Impostazioni**:
|
||||
@ -54,7 +54,9 @@ A seconda del fatto che tu stia utilizzando la **Wi-Fi** o il cavo **Ethernet**
|
||||
|
||||
Clicca sul pulsante dei "Dettagli" affianco al nome della tua rete:
|
||||
|
||||
- [x] Spunta **Limita monitoraggio indirizzo IP**
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
|
||||
@ -134,21 +136,13 @@ La [Modalità Lockdown](https://blog.privacyguides.org/2022/10/27/macos-ventura-
|
||||
|
||||
### Randomizzazione dell'indirizzo MAC
|
||||
|
||||
macOS utilizza un indirizzo MAC randomizzato durante la scansione di reti Wi-Fi mentre è disconnesso da una rete. Tuttavia, quando ti connetti a una rete Wi-Fi preferita, l'indirizzo MAC utilizzato non viene mai randomizzato. La randomizzazione completa dell'indirizzo MAC è un argomento avanzato e la maggior parte delle persone non deve preoccuparsi di eseguire i seguenti passaggi.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
A differenza di iOS, macOS non ti offre un'opzione per randomizzare il tuo indirizzo MAC nelle impostazioni, quindi se desideri modificare questo identificatore, dovrai farlo con un comando o uno script. Per impostare un indirizzo MAC casuale, prima disconnettiti dalla rete se sei già connesso, poi apri il **Terminale** e inserisci questo comando per randomizzare il tuo indirizzo MAC:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` è il nome dell'interfaccia di cui stai modificando l'indirizzo MAC. Questo potrebbe non essere quello corretto su ogni Mac, quindi, per verificare, puoi tenere premuto il tasto opzioni e cliccare sul simbolo della Wi-Fi nella parte superiore destra della tua schermata. "Nome dell'interfaccia" dovrebbe essere visualizzato nella parte superiore del menu a tendina.
|
||||
|
||||
Questo comando imposta l'indirizzo MAC su un indirizzo randomizzato, "amministrato localmente", che corrisponde al comportamento delle funzioni di randomizzazione degli indirizzi MAC di iOS, Windows e Android. Ciò significa che ogni carattere dell'indirizzo MAC è completamente randomizzato, tranne il secondo carattere, che indica l'indirizzo MAC come *amministrato localmente* e non in conflitto con alcun hardware reale. Questo metodo è più compatibile con le reti moderne. Un metodo alternativo consiste nell'impostare i primi sei caratteri dell'indirizzo MAC su uno degli *Organizational Unique Identifiers* di Apple già esistenti, che lasceremo come esercizio al lettore. È più probabile che questo metodo entri in conflitto con alcune reti, ma potrebbe essere meno evidente. Data la prevalenza di indirizzi MAC randomizzati e amministrati localmente in altri sistemi operativi moderni, non riteniamo che uno dei due metodi offra vantaggi significativi in termini di privacy rispetto all'altro.
|
||||
|
||||
Quando ti connetti nuovamente alla rete, ti connetterai con un indirizzo MAC casuale. Questo sarà ripristinato al riavvio.
|
||||
|
||||
Il tuo indirizzo MAC non è l'unica informazione univoca sul tuo dispositivo che viene trasmessa sulla rete; il tuo hostname è un'altra informazione che potrebbe identificarti in modo univoco. Potresti voler impostare il tuo nome host su qualcosa di generico come "MacBook Air", "Laptop", "MacBook Pro di John" o "iPhone" in **Impostazioni del sistema** > **Generali** > **Condivisione**. Alcuni [script per la privacy](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) consentono di generare facilmente hostname con nomi casuali.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Alcuni [script per la privacy](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) consentono di generare facilmente hostname con nomi casuali.
|
||||
|
||||
## Protezioni di Sicurezza
|
||||
|
||||
@ -179,20 +173,61 @@ La Protezione dell'Integrità di Sistema rende le posizioni dei file di sola let
|
||||
|
||||
##### Sandbox delle App
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avviso</p>
|
||||
|
||||
I software scaricati al di fuori dell'App Store ufficiale non devono essere testate. Dovresti evitare i software non provenienti dall'App Store, il più possibile.
|
||||
I software scaricati al di fuori dell'App Store ufficiale non devono essere testate. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Avviso</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS presenta due forme di difesa dai malware:
|
||||
|
||||
1. In primo luogo, la protezione dal lancio di malware è fornita dal processo di revisione dell'App Store per le applicazioni presenti su di esso, o *Notarizzazione* (parte di *Gatekeeper*), un procedimento in cui le app di terze parti sono scansionate in cerca di malware noti da Apple, prima di poter essere eseguite.
|
||||
1. In primo luogo, la protezione dal lancio di malware è fornita dal processo di revisione dell'App Store per le applicazioni presenti su di esso, o *Notarizzazione* (parte di *Gatekeeper*), un procedimento in cui le app di terze parti sono scansionate in cerca di malware noti da Apple, prima di poter essere eseguite. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. La protezione da altri malware e rimedi da malware esistenti sul tuo sistema è fornita da *XProtect*, un software antivirus più tradizionale, integrato su macOS.
|
||||
|
||||
Sconsigliamo di installare software antivirus di terze parti, poiché, tipicamente, non hanno accesso a livello di sistema, necessario per funzionare propriamente, a causa di limitazioni di Apple sulle app di terze parti, e poiché garantire gli alti livelli d'accesso da essi richiesti, causa spesso un rischio sulla sicurezza e privacy maggiore al tuo computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### システムの設定
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### ファイアウォール
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MACアドレスのランダム化
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. この方法は、現代のネットワークと最も互換性があります。 An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## セキュリティーの保護
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### アプリのサンドボックス
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### アンチウィルス
|
||||
|
||||
macOSには、2種類のマルウェア防御機能が付属しています。
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### 시스템 설정
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Gloednieuwe Apple-siliconen kunnen zonder internetverbinding worden ingesteld. M
|
||||
|
||||
macOS voert online controles uit wanneer u een app opent om te controleren of een app bekende malware bevat en of het ondertekeningscertificaat van de ontwikkelaar is ingetrokken.
|
||||
|
||||
Vroeger werden deze controles uitgevoerd via een niet-versleuteld OCSP-protocol, dat informatie kon lekken over de apps die je gebruikt naar het netwerk waarmee je verbonden was. Apple heeft hun OCSP-service geüpgraded om HTTPS encryptie te gebruiken in 2021, en [plaatste informatie](https://support.apple.com/HT202491) over hun logboekbeleid voor deze service. Ze beloofden bovendien een mechanisme toe te voegen voor de opt-out van deze onlinecontrole, maar dit is niet toegevoegd aan macOS op het moment van schrijven (juli 2023).
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC-adres randomisatie
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### Рандомизация MAC-адресов
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Предупреждение</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Предупреждение</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### Systeminställningar
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Brandvägg
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### Randomisering av MAC-adresser
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Varning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC Address Randomization
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">Warning</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
@ -20,7 +20,7 @@ description: macOS 是蘋果電腦的桌面作業系統，搭配其自家硬體
|
||||
|
||||
當開啟應用程式時，macOS 會執行連線檢查，驗證應用程式是否包含已知惡意軟體，以及開發人員的簽名證書是否被撤銷。
|
||||
|
||||
過去這些檢查是通過未加密的 OCSP 協議執行，因此可能會將您運行的應用程式資料洩露到網路上。 Apple 在 2021 年將其 OCSP 服務升級為 HTTPS 加密，並[發布了該服務的日誌記錄政策資訊](https://support.apple.com/HT202491)。 他們還承諾添加一種機制，讓用戶可選擇退出此連線檢查，但截至 2023 年 7 月，該機制尚未添加到 macOS 。
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
雖然[可以](https://electiclight.co/2021/02/23/how-to-run-apps-in-private/)相對輕鬆地手動選擇退出此檢查，但除非您會受到 macOS 執行撤銷檢查的嚴重損害，不建議這樣做，它們在確保阻止受感染的應用程式運行上發揮著重要作用。
|
||||
|
||||
@ -32,14 +32,14 @@ description: macOS 是蘋果電腦的桌面作業系統，搭配其自家硬體
|
||||
|
||||
如果您使用第二個帳戶，則不會嚴格要求在 macOS 登入畫面需登錄到原始管理員帳戶。 當以標準用戶身份執行需要管理員權限的操作時，系統會提示進行身份驗證，這時可以作為標準用戶單次性輸入管理員憑據。 如果希望在登錄畫面中只有一個帳戶，Apple 提供了[隱藏管理員帳戶的指南](https://support.apple.com/HT203998)。
|
||||
|
||||
或者，您可以使用 [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) 之類的實用程式按需升級到管理員權限，但這可能容易受到一些未被發現弪點的利用，一如所有基於軟體的保護。
|
||||
|
||||
### iCloud
|
||||
|
||||
Apple 產品的大多數隱私和安全問題與其*雲服務*有關，而不是其硬體或軟體。 當使用 iCloud 等 Apple 服務時，大部分資訊都存儲在他們的伺服器上以密鑰保護，且預設情況下 Apple 可以取用該密鑰。 這種訪問級別偶爾會被執法部門濫用，儘管您的資料在設備上還是安全加密的狀態。當然，Apple 與任何其他公司一樣容易遭受資料洩露。
|
||||
當使用 iCloud 等 Apple 服務時，大部分資訊都存儲在他們的伺服器上以密鑰保護，且預設情況下 Apple 可以取用該密鑰。 This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
因此，如果使用 iCloud，則應[啟用**進階資料保護**](https://support.apple.com/HT212520)。 它利用存在設備上的密鑰對您的iCloud 數據（端到端）加密，此密鑰並不在Apple 伺服器，因此發生數據洩露時您的 iCloud 數據可得到保護與隱匿。
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### 系統設定
|
||||
|
||||
您應該確認或更改許多內建設置以強化系統。 開啟**設定** 應用程式：
|
||||
@ -54,7 +54,9 @@ Apple 產品的大多數隱私和安全問題與其*雲服務*有關，而不是
|
||||
|
||||
單擊網路名稱旁邊的“詳細資訊”按鈕：
|
||||
|
||||
- [x] 勾選**限制 IP 地址跟踪**
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### 防火牆
|
||||
|
||||
@ -134,21 +136,13 @@ Apple 產品的大多數隱私和安全問題與其*雲服務*有關，而不是
|
||||
|
||||
### MAC 地址隨機化
|
||||
|
||||
網路斷開時執行 Wi-Fi 掃描，macOS 使用隨機 MAC 位址。 但是，當連接到首選 Wi-Fi 網路時，所用的 MAC 位址不會隨機化。 完整 MAC 位址隨機化是一個進階課題，大多數人不需要擔心執行以下步驟。
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
不同於iOS，macOS 設定中不提供隨機化 MAC 位址選項，因此如想變更此標識符，則需要使用命令或腳本來完成。 若要設定隨機 MAC 位址，如已連線請先中斷網路連線，然後開啟**終端機**並輸入下列指令以隨機化 MAC 位址：
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` 為變更其 MAC 位址的介面名稱。 這可能並不適合每台 Mac，因此要進行檢查，可以按住 option 鍵並單擊螢幕右上角的 Wi-Fi 符號。 “介面名稱”應顯示在下拉式選單的頂部。
|
||||
|
||||
這個指令會將 MAC 位址設定為隨機的「本機管理」位址，與 iOS、Windows 和 Android 的 MAC 位址隨機化功能的行為相符。 這意味著MAC 位址中的每個字符都是完全隨機的，除了第二個字符，它表示MAC 位址是*本地管理的*並且不與任何實際硬體衝突。 此方法與現代網路最相容。 另一種方法是將 MAC 位址的前六個字元設定為 Apple 現有的*組織唯一識別碼*之一，我們將其留給讀者練習。 該方法可能更容易與某些網路發生衝突，但較不被注意。 鑑於其他現代作業系統中隨機、本地管理的 MAC 位址已普遍存在，我們認為這兩種方法都不具有顯著的隱私優勢。
|
||||
|
||||
再次連接到網路時，將使用隨機 MAC 位址來連線。 這將在重新開機時重置。
|
||||
|
||||
網路上廣播的 MAC 位址並不是唯一透露裝置身份的訊息，主機名稱是另一個可識別身份的訊息。 您可能想要在**系統設定**中將主機名稱設定為通用名稱，例如「MacBook Air」、「Laptop」、「John's MacBook Pro」或「iPhone」&# 062 ; **常規** > **分享**。 某些[隱私權腳本](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide)可輕鬆產生隨機的主機名稱。
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. 某些[隱私權腳本](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide)可輕鬆產生隨機的主機名稱。
|
||||
|
||||
## 安全保護
|
||||
|
||||
@ -179,20 +173,61 @@ macOS 設置了某些無法覆蓋的安全限制。 這些稱為強制取用控
|
||||
|
||||
##### App 沙盒
|
||||
|
||||
2012年6月之後，從 App Store 下載的 macOS 應用需要使用[應用沙箱](https://developer.apple.com/documentation/security/app_sandbox)進行沙箱處理。
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
從官方 App Store 之外下載的軟體不需要沙盒。 應盡可能避免使用非 App Store 軟體。
|
||||
從官方 App Store 之外下載的軟體不需要沙盒。 If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### 防毒軟體
|
||||
|
||||
macOS 提供兩種惡意軟體防禦形式：
|
||||
|
||||
1. 首先，防止啟動惡意軟體是由 App Store 對 App Store 應用程式的審核流程或*公證*（*Gatekeeper* 的一部份），這是 Apple 允許運行之前掃描第三方應用程式是否存在已知惡意軟體的程序。
|
||||
1. 首先，防止啟動惡意軟體是由 App Store 對 App Store 應用程式的審核流程或*公證*（*Gatekeeper* 的一部份），這是 Apple 允許運行之前掃描第三方應用程式是否存在已知惡意軟體的程序。 Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. *XProtect* 提供針對其他惡意軟體的防護以及修復系統上現有惡意軟體，XProtect 是 macOS 內建較傳統的防病毒軟體。
|
||||
|
||||
建議不要安裝第三方防毒軟體，它們通常不具備正常運行所需的系統取用權限，因為Apple 對第三方應用程序的限制，授予它們要求的高級別取用權限常會帶來麻煩。對電腦造成更大的安全和隱私風險。
|
||||
|
||||
@ -20,7 +20,7 @@ Brand new Apple silicon devices can be set up without an internet connection. Ho
|
||||
|
||||
macOS performs online checks when you open an app to verify whether an app contains known malware, and whether the developer’s signing certificate is revoked.
|
||||
|
||||
Previously, these checks were performed via an unencrypted OCSP protocol which could leak information about the apps you ran to your network. Apple upgraded their OCSP service to use HTTPS encryption in 2021, and [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally promised to add a mechanism for people to opt-out of this online check, but this has not been added to macOS as of July 2023.
|
||||
Apple's OCSP service uses HTTPS encryption, so only they are able to see which apps you open. They've [posted information](https://support.apple.com/HT202491) about their logging policy for this service. They additionally [promised](http://lapcatsoftware.com/articles/2024/8/3.html) to add a mechanism for people to opt-out of this online check, but this has not been added to macOS.
|
||||
|
||||
While you [can](https://eclecticlight.co/2021/02/23/how-to-run-apps-in-private) manually opt out of this check relatively easily, we recommend against doing so unless you would be badly compromised by the revocation checks performed by macOS, because they serve an important role in ensuring compromised apps are blocked from running.
|
||||
|
||||
@ -32,14 +32,14 @@ However, exploits in protective utilities like `sudo` have been [discovered in t
|
||||
|
||||
If you do use a second account, it is not strictly required to ever log in to your original Administrator account from the macOS login screen. When you are doing something as a Standard user which requires Administrator permissions, the system should prompt you for authentication, where you can enter your Administrator credentials as your Standard user on a one-time basis. Apple provides [guidance](https://support.apple.com/HT203998) on hiding your Administrator account if you prefer to only see a single account on your login screen.
|
||||
|
||||
Alternatively, you can use a utility like [macOS Enterprise Privileges](https://github.com/SAP/macOS-enterprise-privileges) to escalate to Administrator rights on-demand, but this may be vulnerable to some undiscovered exploit, like all software-based protections.
|
||||
|
||||
### iCloud
|
||||
|
||||
The majority of privacy and security concerns with Apple products are related to their *cloud services*, not their hardware or software. When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This level of access has occasionally been abused by law enforcement to get around the fact that your data is otherwise securely encrypted on your device, and of course Apple is vulnerable to data breaches like any other company.
|
||||
When you use Apple services like iCloud, most of your information is stored on their servers and secured with keys *which Apple has access to* by default. This is called [Standard Data Protection](https://support.apple.com/en-us/102651) by Apple.
|
||||
|
||||
Therefore, if you use iCloud you should [enable **Advanced Data Protection**](https://support.apple.com/HT212520). This encrypts nearly all of your iCloud data with keys stored on your devices (end-to-end encryption), rather than Apple's servers, so that your iCloud data is secured in the event of a data breach, and otherwise hidden from Apple.
|
||||
|
||||
If you want to be able to install apps from the App Store but don't want to enable iCloud, you can sign in to your Apple Account from the App Store instead of **System Settings**.
|
||||
|
||||
### System Settings
|
||||
|
||||
There are a number of built-in settings you should confirm or change to harden your system. Open the **Settings** app:
|
||||
@ -54,6 +54,8 @@ Depending on if you are using **Wi-Fi** or **Ethernet** (denoted by a green dot
|
||||
|
||||
Click on the "Details" button by your network name:
|
||||
|
||||
- [x] Select **Rotating** under **Private Wi-Fi address**
|
||||
|
||||
- [x] Check **Limit IP address tracking**
|
||||
|
||||
##### Firewall
|
||||
@ -134,21 +136,13 @@ On older Intel-based Mac computers, FileVault is the only form of disk encryptio
|
||||
|
||||
### MAC地址随机化
|
||||
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network. However, when you connect to a preferred Wi-Fi network, the MAC address used is never randomized. Full MAC address randomization is an advanced topic, and most people don't need to worry about performing the following steps.
|
||||
macOS uses a randomized MAC address when performing Wi-Fi scans while disconnected from a network.
|
||||
|
||||
Unlike iOS, macOS doesn't give you an option to randomize your MAC address in the settings, so if you wish to change this identifier, you'll need to do it with a command or a script. To set a random MAC address, first disconnect from the network if you're already connected, then open **Terminal** and enter this command to randomize your MAC address:
|
||||
You can set your MAC address to be randomized per network and rotate occasionally to prevent tracking between networks and on the same network over time.
|
||||
|
||||
``` zsh
|
||||
openssl rand -hex 6 | sed 's/^\(.\{1\}\)./\12/; s/\(..\)/\1:/g; s/.$//' | xargs sudo ifconfig en0 ether
|
||||
```
|
||||
Go to **System Settings** → **Network** → **Wi-Fi** → **Details** and set **Private Wi-Fi address** to either **Fixed** if you want a fixed but unique address for the network you're connected to, or **Rotating** if you want it to change over time.
|
||||
|
||||
`en0` is the name of the interface you're changing the MAC address for. This might not be the right one on every Mac, so to check you can hold the option key and click the Wi-Fi symbol at the top right of your screen. "Interface name" should be displayed at the top of the dropdown menu.
|
||||
|
||||
This command sets your MAC address to a randomized, "locally administered" address, matching the behavior of iOS, Windows, and Android's MAC address randomization features. This means that every character in the MAC address is fully randomized except the second character, which denotes the MAC address as *locally administered* and not in conflict with any actual hardware. This method is most compatible with modern networks. An alternative method is to set the first six characters of the MAC address to one of Apple's existing *Organizational Unique Identifiers*, which we'll leave as an exercise to the reader. That method is more likely to conflict with some networks, but may be less noticeable. Given the prevalence of randomized, locally administered MAC addresses in other modern operating systems, we don't think either method has significant privacy advantages over the other.
|
||||
|
||||
When you connect to the network again, you'll connect with a random MAC address. This will be reset on reboot.
|
||||
|
||||
Your MAC address is not the only unique information about your device which is broadcast on the network, your hostname is another piece of information which could uniquely identify you. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** > **General** > **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
Consider changing your hostname as well, which is another device identifier that's broadcast on the network you're connected to. You may wish to set your hostname to something generic like "MacBook Air", "Laptop", "John's MacBook Pro", or "iPhone" in **System Settings** → **General** → **Sharing**. Some [privacy scripts](https://github.com/sunknudsen/privacy-guides/tree/master/how-to-spoof-mac-address-and-hostname-automatically-at-boot-on-macos#guide) allow you to easily generate hostnames with random names.
|
||||
|
||||
## Security Protections
|
||||
|
||||
@ -179,20 +173,61 @@ System Integrity Protection makes critical file locations read-only to protect a
|
||||
|
||||
##### App Sandbox
|
||||
|
||||
macOS apps submitted to the App Store after June 1, 2012 are required to be sandboxed using the [App Sandbox](https://developer.apple.com/documentation/security/app_sandbox).
|
||||
On macOS, whether an app is sandboxed is determined by the developer when they sign it. The App Sandbox protects against vulnerabilities in the apps you run by limiting what a malicious actor can access in the event that the app is exploited. The App Sandbox *alone* can't protect against [:material-package-variant-closed-remove: Supply Chain Attacks](../basics/common-threats.md#attacks-against-certain-organizations ""){.pg-viridian} by malicious developers. For that, sandboxing needs to be enforced by someone other than the developer themselves, as it is on the App Store.
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. You should avoid non-App Store software as much as possible.
|
||||
Software downloaded from outside the official App Store is not required to be sandboxed. If your threat model prioritizes defending against [:material-bug-outline: Passive Attacks](../basics/common-threats.md#security-and-privacy){ .pg-orange }, then you may want to check if the software you download outside the App Store is sandboxed, which is up to the developer to *opt in*.
|
||||
|
||||
</div>
|
||||
|
||||
You can check if an app uses the App Sandbox in a few ways:
|
||||
|
||||
You can check if apps that are already running are sandboxed using the [Activity Monitor](https://developer.apple.com/documentation/security/protecting-user-data-with-app-sandbox#Verify-that-your-app-uses-App-Sandbox).
|
||||
|
||||
<div class="admonition warning" markdown>
|
||||
<p class="admonition-title">警告</p>
|
||||
|
||||
Just because one of an app's processes is sandboxed doesn't mean they all are.
|
||||
|
||||
</div>
|
||||
|
||||
Alternatively, you can check apps before you run them by running this command in the terminal:
|
||||
|
||||
``` zsh
|
||||
% codesign -dvvv --entitlements - <path to your app>
|
||||
```
|
||||
|
||||
If an app is sandboxed, you should see the following output:
|
||||
|
||||
``` zsh
|
||||
[Key] com.apple.security.app-sandbox
|
||||
[Value]
|
||||
[Bool] true
|
||||
```
|
||||
|
||||
If you find that the app you want to run is not sandboxed, then you may employ methods of [compartmentalization](../basics/common-threats.md#security-and-privacy) such as virtual machines or separate devices, use a similar app that is sandboxed, or choose to not use the unsandboxed app altogether.
|
||||
|
||||
##### Hardened Runtime
|
||||
|
||||
The [Hardened Runtime](https://developer.apple.com/documentation/security/hardened_runtime) is an extra form of protection for apps that prevents certain classes of exploits. It improves the security of apps against exploitation by disabling certain features like JIT.
|
||||
|
||||
You can check if an app uses the Hardened Runtime using this command:
|
||||
|
||||
``` zsh
|
||||
codesign --display --verbose /path/to/bundle.app
|
||||
```
|
||||
|
||||
If Hardened Runtime is enabled, you will see `flags=0x10000(runtime)`. The `runtime` output means Hardened Runtime is enabled. There might be other flags, but the runtime flag is what we're looking for here.
|
||||
|
||||
You can enable a column in Activity Monitor called "Restricted" which is a flag that prevents programs from injecting code via macOS's [dynamic linker](https://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html). Ideally, this should say "Yes".
|
||||
|
||||
##### Antivirus
|
||||
|
||||
macOS comes with two forms of malware defense:
|
||||
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run.
|
||||
1. Protection against launching malware in the first place is provided by the App Store's review process for App Store applications, or *Notarization* (part of *Gatekeeper*), a process where third-party apps are scanned for known malware by Apple before they are allowed to run. Apps are required to be signed by the developers using a key given to them by Apple. This ensures that you are running software from the real developers. Notarization also requires that developers enable the Hardened Runtime for their apps, which limits methods of exploitation.
|
||||
2. Protection against other malware and remediation from existing malware on your system is provided by *XProtect*, a more traditional antivirus software built-in to macOS.
|
||||
|
||||
We recommend against installing third-party antivirus software as they typically do not have the system-level access required to properly function anyways, because of Apple's limitations on third-party apps, and because granting the high levels of access they do ask for often poses an even greater security and privacy risk to your computer.
|
||||
|
||||
Reference in New Issue
Block a user