The Mac Observer

Skip navigational links

You're viewing an article in TMO's historic archive vault. Here, we've preserved the comments and how the site looked along with the article. Use this link to view the article on our current site:
Blocking Outbound Connections with Little Snitch

TMO Quick Tip - Blocking Outbound Connections with Little Snitch

by , 7:30 AM EST, December 5th, 2007

The firewall in Mac OS X is designed to stop incoming connections. When you're connected to the Internet directly, and your IP address is visible, hackers can generally see your Mac and construct a variety of attacks. These include port scans and then probes of specific ports that look for weaknesses in applications or OS daemons that use those ports. A firewall, with Stealth Mode turned on, stops that cold.

A previous TMO Quick Tip discussed how to customize the Mac OS firewall in those cases where controlled, authorized external access is required. For example, SFTP or HTTP access from the outside.

However, the firewall only blocks incoming connections. One of the features of the TCP/IP protocol is that outgoing packets from, say, a Web browser, are tagged with both the origin and destination IP addresses. That's how the packets of data sent out trigger a response that knows how to come back to your Mac. As a result, a connection to a Website can in principle bring back with it, embedded in the packets, a payload that will naturally bypass the firewall. If that didn't happen, you'd never be able to browse with the firewall enabled.

Sometimes, cleverly constructed, malicious code, coming back to a port handled by a specific application, for example QuickTime, can exploit poor code, cause a buffer to overflow, and external code brought in can be caused to execute. That's bad news.

In turn, that code could, for example, trigger the transmittal of private data on the hard disk back to the malicious Website, and that's something that's not controlled by the firewall. As a result, for complete security, a vigilant Mac OS X user should also monitor outgoing connections.

In turns out that there is an excellent piece of software that can do that: Little Snitch 2. Don't let the fact that the developer is in Austria concern you; they're the good guys.

Once Little Snitch is installed, it will monitor all outgoing connections. You can set rules for trusted sites and block outgoing connections by application and by port. It sounds technical, but it's really easy. In the example below, the Address Book is not allowed to connect to homepage.mac.com. Mail is not allowed to connect on port 80 -- as some graphics attachments in spam try to do. However, outgoing connections with iChat are allowed.


Sample Little Snitch Configuration

As you build up confidence in each Mac OS X application and system daemon and what it connects to, and grant your permission, Little Snitch dynamically builds an outbound set of filter rules. If some new and unexpected outbound connection happens, you'll be offered the opportunity to block it. You can manually make changes to the rules as well.

You'll spend some early days training Little Snitch, but the payoff in the long run is that no data will leave your computer without your consent. That provides a lot of peace of mind. Little Snitch is modestly priced (US$24.95), well written and stable. The latest version is Leopard compatible.

Observer Comments

Show: Subjects Only | Full Comments
Close Name:Guest
Subject: Little Snitch in the hands of novice users....

...equals tech support nightmare. We are getting more and more problems reported because people don't know what they are doing with Little Snitch.

Comment on this Article


You cannot edit your comments.   You cannot delete your comments.

Comments are currently closed. Please email the author instead.


Recent Headlines - Updated November 21st

Fri, 7:07 PM
Games - Soccer Sim Championship Manager 2010 Released for Mac
6:47 PM
Games - EA Publishes Original Monopoly for iPhone
6:15 PM
News - Original Apple I on Ebay for $50K, w/Letter from Steve Jobs
6:11 PM
Games - New iPhone Games: Secret of the Lost Cavern Ep 1, New DJ Nights, More
5:47 PM
Games - Star Trek D-A-C Game Headed to the Mac Next Month
4:57 PM
Product News - TidBITS Releases “Take Control of Syncing Data in Snow Leopard”
4:26 PM
John Martellaro's Blog - Particle Debris (week ending 11/20) Stationery Pads Go Poof
2:59 PM
Free on iTunes - Musée du Louvre, Art Lite, SketchBook Mobile X and More.
1:50 PM
Deal Brothers - Acer P215H bmid 21.5” Widescreen LCD Monitor:  $139.99
11:24 AM
TMO Appearances - Jeff Gamet Shares More Holiday Gift Ideas on MacJury
10:43 AM
Product News - Cocktail 4.5 for Leopard Adds QuickLook Cache Clearing
10:06 AM
News - Hack Enables Mac OS X 10.6.2 on Netbooks

The Mac Observer Reader Specials

  • __________
  • Buy Stuff, Support TMO!
  • Podcast: Mac Geek Gab
  • Podcast: Apple Weekly Report
  • TMO on Twitter!