Apple drops controversial firewall-bypass feature on macOS

Researchers claim the ContentFilterExlusionList posed a huge cyber security risk

A mouse hovering over the Safari logo on a MacBook

Apple has removed a controversial feature in its macOS operating system that allowed more than 50 of its own apps to completely bypass third-party security tools like firewalls and virtual private networks (VPNs).

The ContentFilterExclusionList, introduced in macOS 11 Big Sur, was flagged by the security community and developers late last year as being a potential security risk. This list’s existence in macOS meant traffic generated from Apple software such as Maps and iCloud couldn’t be blocked by a socket filter firewall.

The developer of the Little Snitch firewall tool, Norbert Heger, described this behaviour as “a hole in the wall”.

Patrick Wardle, a security researcher with software firm Jamf, even demonstrated how it may be possible for malware to abuse “excluded” apps to generate web traffic to bypass firewalls. 

Those who initially sounded the alarm, including Heger, Wardle and others, have now welcomed Apple’s decision to remove ContentFilterExclusionList with the release macOS 11.2 beta 2.

The exclusion list fist emerged as part of Apple’s shift away from third-party kernel extensions, including network kernel extensions (NKEs), which allowed developers to load code directly into the macOS operating system. These NKEs, however, were used by a number of third-party security platforms, including firewalls such as LuLu and Little Snitch.

To continue to support such products on modern iterations of macOS, Apple introduced the user-mode Network Extension Framework (NEF), which developers could use instead to retain macOS compatibility for their firewalls and VPNs.

Apple then exempted more than 50 of its own applications and daemons from being routed through the NEF by introducing the ContentFilterExclusionList. This meant third-party firewalls that used this new framework weren’t able to block traffic from them.

“Many (rightfully) asked, "What good is a firewall if it can't block all traffic?",” Wardle said in a blog post. “Well, after lots of bad press and lots of feedback/bug reports to Apple from developers such as myself, it seems wiser (more security conscious) minds at Cupertino prevailed.”

“The ContentFilterExclusionList list has been removed (in macOS 11.2 beta 2). Which means, (socket filter) firewalls such as LuLu can now comprehensively filter/block all network traffic.”

Researchers have speculated that Apple excluded its own apps from the oversight of third-party firewalls in the name of overall security. For example, if excluded, these services may continue to receive updates when all web traffic is blocked.

Featured Resources

How to scale your organisation in the cloud

How to overcome common scaling challenges and choose the right scalable cloud service

Download now

The people factor: A critical ingredient for intelligent communications

How to improve communication within your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Most Popular

Star Alliance passenger data stolen in SITA data breach
data breaches

Star Alliance passenger data stolen in SITA data breach

5 Mar 2021
I went shopping at Amazon’s till-less supermarket so that you don’t have to

I went shopping at Amazon’s till-less supermarket so that you don’t have to

5 Mar 2021
How to find RAM speed, size and type

How to find RAM speed, size and type

26 Feb 2021