TMO Quick Tip - Blocking Outbound Connections with Little Snitch

by , 7:30 AM EST, December 5th, 2007

The firewall in Mac OS X is designed to stop incoming connections. When you're connected to the Internet directly, and your IP address is visible, hackers can generally see your Mac and construct a variety of attacks. These include port scans and then probes of specific ports that look for weaknesses in applications or OS daemons that use those ports. A firewall, with Stealth Mode turned on, stops that cold.

A previous TMO Quick Tip discussed how to customize the Mac OS firewall in those cases where controlled, authorized external access is required. For example, SFTP or HTTP access from the outside.

However, the firewall only blocks incoming connections. One of the features of the TCP/IP protocol is that outgoing packets from, say, a Web browser, are tagged with both the origin and destination IP addresses. That's how the packets of data sent out trigger a response that knows how to come back to your Mac. As a result, a connection to a Website can in principle bring back with it, embedded in the packets, a payload that will naturally bypass the firewall. If that didn't happen, you'd never be able to browse with the firewall enabled.

Sometimes, cleverly constructed, malicious code, coming back to a port handled by a specific application, for example QuickTime, can exploit poor code, cause a buffer to overflow, and external code brought in can be caused to execute. That's bad news.

In turn, that code could, for example, trigger the transmittal of private data on the hard disk back to the malicious Website, and that's something that's not controlled by the firewall. As a result, for complete security, a vigilant Mac OS X user should also monitor outgoing connections.

In turns out that there is an excellent piece of software that can do that: Little Snitch 2. Don't let the fact that the developer is in Austria concern you; they're the good guys.

Once Little Snitch is installed, it will monitor all outgoing connections. You can set rules for trusted sites and block outgoing connections by application and by port. It sounds technical, but it's really easy. In the example below, the Address Book is not allowed to connect to homepage.mac.com. Mail is not allowed to connect on port 80 -- as some graphics attachments in spam try to do. However, outgoing connections with iChat are allowed.

Sample Little Snitch Configuration

As you build up confidence in each Mac OS X application and system daemon and what it connects to, and grant your permission, Little Snitch dynamically builds an outbound set of filter rules. If some new and unexpected outbound connection happens, you'll be offered the opportunity to block it. You can manually make changes to the rules as well.

You'll spend some early days training Little Snitch, but the payoff in the long run is that no data will leave your computer without your consent. That provides a lot of peace of mind. Little Snitch is modestly priced (US$24.95), well written and stable. The latest version is Leopard compatible.