DealsOnTheWeb Daily Deal: Computer Geeks' 12-Year Anniversary Sale - Save Up to 87%
TMO Quick Tip - Blocking Outbound Connections with Little Snitch
by , 7:30 AM EST, December 5th, 2007
The firewall in Mac OS X is designed to stop incoming connections. When you're connected to the Internet directly, and your IP address is visible, hackers can generally see your Mac and construct a variety of attacks. These include port scans and then probes of specific ports that look for weaknesses in applications or OS daemons that use those ports. A firewall, with Stealth Mode turned on, stops that cold.
A previous TMO Quick Tip discussed how to customize the Mac OS firewall in those cases where controlled, authorized external access is required. For example, SFTP or HTTP access from the outside.
However, the firewall only blocks incoming connections. One of the features of the TCP/IP protocol is that outgoing packets from, say, a Web browser, are tagged with both the origin and destination IP addresses. That's how the packets of data sent out trigger a response that knows how to come back to your Mac. As a result, a connection to a Website can in principle bring back with it, embedded in the packets, a payload that will naturally bypass the firewall. If that didn't happen, you'd never be able to browse with the firewall enabled.
Sometimes, cleverly constructed, malicious code, coming back to a port handled by a specific application, for example QuickTime, can exploit poor code, cause a buffer to overflow, and external code brought in can be caused to execute. That's bad news.
In turn, that code could, for example, trigger the transmittal of private data on the hard disk back to the malicious Website, and that's something that's not controlled by the firewall. As a result, for complete security, a vigilant Mac OS X user should also monitor outgoing connections.
In turns out that there is an excellent piece of software that can do that: Little Snitch 2. Don't let the fact that the developer is in Austria concern you; they're the good guys.
Once Little Snitch is installed, it will monitor all outgoing connections. You can set rules for trusted sites and block outgoing connections by application and by port. It sounds technical, but it's really easy. In the example below, the Address Book is not allowed to connect to homepage.mac.com. Mail is not allowed to connect on port 80 -- as some graphics attachments in spam try to do. However, outgoing connections with iChat are allowed.
![]() Sample Little Snitch Configuration |
|---|
As you build up confidence in each Mac OS X application and system daemon and what it connects to, and grant your permission, Little Snitch dynamically builds an outbound set of filter rules. If some new and unexpected outbound connection happens, you'll be offered the opportunity to block it. You can manually make changes to the rules as well.
You'll spend some early days training Little Snitch, but the payoff in the long run is that no data will leave your computer without your consent. That provides a lot of peace of mind. Little Snitch is modestly priced (US$24.95), well written and stable. The latest version is Leopard compatible.
Observer Comments
Recent Headlines - Updated Tuesday, August 19th, 2008
- Tue., 5:00 PM
- Corsaire Publishes Guide on Hardening OS X Leopard
- 3:30 PM
- iPodObserver - Pacific Crest Sees Big Jump in iPhone Surfing, Rising Apple Cash Flow
- 3:00 PM
- iPodObserver - Blog: Infineon Drivers May be Cause of iPhone 3G Dropped Calls
- 1:35 PM
- Cooliris 1.8 Adds Safari 3.1 Support
- 1:15 PM
- PCW: Intel, Dell Innovate for Mobile Users, Windows Sleeps
- 12:30 PM
- Psystar Misses Another Deadline to Respond, Given Extension
- 12:00 PM
- Dr. Mac: Rants & Raves - Episode #84: When Good iPhones Go Bad...
- 10:50 AM
- Apple Intros New Get a Mac Ads
- 10:15 AM
- Hot Forum Topic - Reader Perception: Apple's PR
- 9:40 AM
- Apple Tops PCs in Customer Satisfaction Study
- 9:00 AM
- Apple to Open Fort Worth Store on Aug 23
- 8:30 AM
- Apple's $20 Billion Cash and a 21st Century Mission
- 7:50 AM
- iPodObserver - Apple Tosses MobileMe Users 60 Day Credit
- 6:00 AM
- iPO Review - DLO Portable Speakers for iPhone
The Mac Observer Reader Specials
- Download Typestyler, still the Ultimate Styling Tool for Internet, Print and Video Graphics. Works great in Classic with a Native OS X Version on the way. Free Tryout: www.typestyler.com
- OWC: Upgrade to a Larger Hard Drive, Add Additional Drives SATA for Mac Pro and G5s, up to 1.0TB in each Bay. 500GB from $90!
New iMac 800Mhz Memory 4GB $98, 2GB $50. Click to Maximize your Macs...
Mac observers can now play Party Poker for Mac as well as Mac casino games by going to MacPokerOnline.com.
RamJet Memory: Mac Pro FB-DIMMs: 2Gig kit $115, 4Gig kit $179, 8Gig kit for $355! 500G Seagate Hard Drive $129! Click hereFor the latest Apple products use Ciao a comparison website to find laptops like MacBook Air. Then find the best prices on MP3 players and use our comparison tool to evaluate cell phones.
Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.


