Macos Network Security

macOS Network Security Assessment & Hardening

This skill helps you assess, understand, and harden macOS network services and protocols. It covers remote access services, service discovery protocols, known vulnerabilities, and security best practices.

Quick Reference

Remote Access Services

Service Discovery Protocols

Service Enumeration

Check All Remote Services Status

Run this script to check which remote services are enabled:

# Check remote services status
rmMgmt=$(netstat -na | grep LISTEN | grep tcp46 | grep "*.3283" | wc -l)
scrShrng=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | grep "*.5900" | wc -l)
flShrng=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | egrep "\\*.88|\\*.445|\\*.548" | wc -l)
rLgn=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | grep "*.22" | wc -l)
rAE=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | grep "*.3031" | wc -l)
bmM=$(netstat -na | grep LISTEN | egrep 'tcp4|tcp6' | grep "*.4488" | wc -l)
printf "\nService Status (0=OFF, >0=ON):\n"
printf "Screen Sharing: %s\n" "$scrShrng"
printf "File Sharing: %s\n" "$flShrng"
printf "Remote Login (SSH): %s\n" "$rLgn"
printf "Remote Management (ARD): %s\n" "$rmMgmt"
printf "Remote Apple Events: %s\n" "$rAE"
printf "Back to My Mac: %s\n\n" "$bmM"

Browse Bonjour Services

# Browse SSH services
dns-sd -B _ssh._tcp

# Browse HTTP services
dns-sd -B _http._tcp

# Browse all services
dns-sd -B _services._dns-sd._udp.local

Network Scanning

# Nmap - discover mDNS services on a host
nmap -sU -p 5353 --script=dns-service-discovery <target>

# mdns_recon - scan subnet for misconfigured mDNS responders
python3 mdns_recon.py -r 192.168.1.0/24 -s _ssh._tcp.local

Security Vulnerabilities

Recent Screen Sharing / ARD Vulnerabilities

Recent Bonjour/mDNS Vulnerabilities

ARD Security Concerns

Critical: ARD uses only the first 8 characters of the VNC password for authentication, making it vulnerable to brute force attacks with no default rate limiting.

Detection: Use nmap's vnc-info script to identify vulnerable instances:

nmap --script vnc-info -p 5900 <target>

Services supporting VNC Authentication (2) are especially susceptible.

Hardening Recommendations

1. Disable Unnecessary Remote Services

# Disable Screen Sharing
sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate

# Disable Remote Login (SSH)
sudo launchctl unload -w /System/Library/LaunchDaemons/ssh.plist

# Disable Bonjour (if not needed)
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

2. Firewall Rules for ARD

If ARD must be enabled, restrict it to local subnet:

# Add ARDAgent to Application Firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent

# Block ARDAgent by default
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockapp /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent on

3. Network-Level Protections

• Restrict UDP 5353 to link-local scope on routers and firewalls
• Block or rate-limit mDNS traffic on wireless controllers
• Use mDNS proxy to prevent cross-subnet service discovery
• Put remote services behind VPN instead of exposing to Internet

4. System Hardening

• Enable System Integrity Protection (SIP) - critical for full vulnerability protection
• Keep macOS fully patched - Apple supports last 3 major releases
• Use strong passwords - especially for VNC/ARD (8+ chars minimum)
• Disable "VNC viewers may control screen with password" when possible

5. MDM Restrictions (Enterprise)

For environments requiring Bonjour internally but not across boundaries:

• Use AirPlay Receiver profile restrictions via MDM
• Deploy mDNS proxy solutions
• Configure network segmentation to isolate service discovery

Assessment Workflow

Step 1: Enumerate Services

1. Check local listening ports
2. Browse local Bonjour services
3. Scan network for exposed services

Step 2: Identify Vulnerabilities

1. Check macOS version against CVE table
2. Test ARD for weak authentication
3. Verify mDNS responder configuration

Step 3: Apply Hardening

1. Disable unnecessary services
2. Configure firewall rules
3. Update system and verify patches
4. Document remaining services and justification

Tools Reference

When to Use This Skill

Use this skill when you need to:

• Assess macOS network security posture
• Enumerate remote access services on macOS
• Understand Bonjour/mDNS protocol behavior
• Identify and remediate macOS network vulnerabilities
• Harden macOS systems against network-based attacks
• Investigate privilege escalation via network services
• Configure secure remote access on macOS
• Audit macOS systems for compliance

References

• The Mac Hacker's Handbook
• TAOMM - The Art of Mac Malware
• macOS Red Teaming - ARD
• NVD - CVE Database