3

I monitor all my traffic using Little Snitch. Recently, I've noticed strange IP addresses making connections to the "mach_kernel" process. Most of these IP addresses seem to originate from other programs (for example, I might see a Google address connected to mach_kernel when I'm browsing Gmail via my browser).

Is my Mac infected? The main concern here is that I have a virus which is MitMing traffic of other programs on my box. How can I tell if this is the case?

  • what is the "strange" IP address? so we can look it up for you. – Ruskes Jan 15 '15 at 3:34
  • Unfortunately, I don't have any off-hand, as I restart my Macbook every time I notice mach_kernel connections (which seems to fix things, at least temporarily). However, I have noticed that they relate to other programs on my box. For example, when using Skype, I'll see connections to Microsoft servers, or when using Chrome, I'll see connections to Gmail servers. That's why I'm worried about MitM attacks. – Dan Jaouen Jan 15 '15 at 3:40
  • Open Terminal in your Utility Folder and type following "lsof -i" and look at the result – Ruskes Jan 15 '15 at 3:49
  • I'm not noticing anything strange in the lsof output at the moment, but I will try again the next time I notice mach_kernel activity. – Dan Jaouen Jan 15 '15 at 3:54
  • ok, let me know. You can always run the Clamxav app to check for viruses and other. clamxav.com – Ruskes Jan 15 '15 at 4:11
1

I have asked the Little Snitch development team at obdev about this issue. Here is the response:

In fact local traffic over AFP or SMB protocol is routed by the mach_kernel process on newer OS X systems.

It is defined as /mach_kernel on 10.10.x. I'm on OS X 10.11.4 here, where the process path is now /System/Library/Kernels/kernel

Unfortunately it can not be treated the same way as other processes, but usually your local network rules should cover all relevant connections for it.

But I have to admit that I also remember a case where external connections are associated with the mach_kernel by mistake and it seems to happen when the tables in the Little Snitch Network Monitor cache got mixed somehow. Do you perhaps experience such external connections associated with the mach_kernel process? Possibly thats an issue of memory - happening when your system (including the Little Snitch Network Monitor) is up running for quite some time… I already talked to our developers about that and we will keep an eye on that issue.

...

Simon

"the tables in Little Snitch Network Monitor cache got mixed somehow"? Seriously?

It does indeed seem to happen after my machine has been running for days or weeks without reboot. And a reboot will fix it temporarily. It is possible that this is simply a bug in Little Snitch.

However, I find it dubious that traffic routed over mach_kernel "cannot be treated the same way as other processes". I am not informed about how Little Snitch is architected. It may not be able to run in kernel space (ring 0), but I find it terribly convenient in today's climate of mass government spying that the OSX kernel can simply take over and get around Little Snitch. I believe IPTables would have no such trouble in blocking traffic, but it is most certainly of a different architecture and user model altogether.

See here for additional reference: https://security.stackexchange.com/questions/58815/do-firewalls-always-run-in-userspace

Switching to FOSS/Linux is looking more and more like the path to be on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .