Apple seems to have fixed the issue with its first-party apps bypassing VPNs and firewalls in macOS Big Sur. The issue was reported back in November and seems to have been fixed in macOS Big Sur 11.2 beta 2, which was just released to developers and public beta testers yesterday.
The issue could have potentially allowed malicious apps to take advantage of the bypass mechanism and share data without any restrictions. A proof of concept was even demonstrated by the security researcher who had first reported the issue. A Reddit user had refuted these claims that Apple’s apps are bypassing VPNs, with details to back them up, however, it did not gather much attention.
Apple removes ContentFilterExclusionList from macOS Big Sur 11.2 beta 2
When the issue was originally reported to Apple, they said that it was a design decision. Patrick Wardle, the security researcher who had reported this issue, had shared with the company that this change was a privacy and security issue. Apple has finally removed the ContentFilterExclusionList list from macOS Big Sur 11.2 beta 2, which means that first-party apps can no longer bypass firewalls and VPNs, and neither malicious apps take advantage of this.
The ContentFilterExclusionList list has been removed (in macOS 11.2 beta 2)!!
This means socket filter firewalls (such as LuLu) can now comprehensively monitor & block all network traffic)
Read more: https://t.co/GJXkRA31e7 pic.twitter.com/BZJ2NmkRQm
— patrick wardle (@patrickwardle) January 13, 2021
Although the feature is available in the latest macOS Big Sur beta, it is still not available to all users. The stable macOS Big Sur still has this issue with firewalls and VPNs, and it is up to Apple to release macOS 11.2 to all users to fix this problem as it could have severe privacy and security implications.
- macOS Big Sur beta code hints that Apple will prevent users from downloading unsupported iOS apps on M1 Macs
- Apple has stopped offering standalone combo installers for macOS Big Sur
- macOS Big Sur 11.2 beta released to developers
- macOS Big Sur 11.1 update enables full-screen iPhone and iPad apps on M1 Macs
- How to clean install macOS Big Sur on a Mac
- How to create macOS Big Sur bootable USB installer
- Try these top 10 new features in macOS Big Sur