2

One of my company computers - a Macbook Air, was shown to have security vulnerability as part of a recent external network scan.

The issues are related to Linux 4.0. Mac OS is a UNIX flavor, not Linux (FYI - I'm not an expert at all!!). I'm wondering if these vulnerabilities are perhaps related to the router connecting the computer to the internet? Maybe the router is running on Linux?

These are the issues:

Is there a way to patch/fix these issues? I upgraded to Big Sur, yet the vulnerabilities remain.

3
  • 1
    Welcome to Ask Different. Be sure you read the tour - chit chat like tia and putting your signature in the question body is often down voted. This seems to be well scoped and researched, just not following the custom here of editing a question for brevity.
    – bmike
    Nov 15 '20 at 19:54
  • You might be on to something with your thoughts regarding the router. You mention it's an external scan; if your router is configured as many routers are (e.g. NAT), an external scan has no way to reach your computer (without specifically making access available). You could try turning the computer off entirely, and asking them to scan again. If they still find vulnerabilities, you can at least rule your computer out.
    – negacao
    Nov 15 '20 at 21:27
  • @negacao Is on to something - you might get the security team to provide you with the network hardware address they are scanning - if it's a NAT or router or other network device - you might need to ask them to send you gear they can support and patch. Home routers are very much a weak point with so many people accessing work resources from non-managed network segments. Alternately - you could hop on a work VPN and have them scan your IP address - not some other device.
    – bmike
    Nov 15 '20 at 22:27
3

Rather than fight your security team or do their job I suggest you turn on your firewall and block all traffic, and ask them to rescan. That should fix their bad detection problem. Unless you’re running docker or another actual Linux VM, their fingerprint detection is incorrect or the scan isn’t of your machine. I would even offer to connect to their network with VPN so they can be sure they are scanning your hardware directly and not some NAT device or router between you and them.

Also, don’t blame security too hard - this security theater happens in most organizations. They likely didn’t even bother to check your network address and could be blaming you for the last person to be assigned that DHCP address on your network. They are likely as under funded, over worked as you are. However, security is something you’d hate to not do your part so engage them to be sure they are correctly mitigating the threats they received - if it’s not you, they need to focus their efforts eleswhere as something they scanned needs patching.

Also, if they continue to pester you, figure out how much you value your time and buy this firewall so you can confirm they are scanning your device.

I think just running little snitch is one of the most effective deterrents in a corporate setting as much malware checks for it. They won’t even install or run since they don’t want to get caught by the snitch.

4
  • I did exactly that. However, the scan still shows the same vulnerability. Why would that be if all inbound connections are blocked?
    – PolarNorth
    Nov 15 '20 at 20:09
  • The software doing the scan is broken. You don’t have Linux kernel unless you’re running docker or some sort of virtualization. @PolarNorth
    – bmike
    Nov 15 '20 at 20:22
  • Thinking exactly the same thing. Thanks again!
    – PolarNorth
    Nov 15 '20 at 20:24
  • Also, @PolarNorth I would invest in LittleSnitch - it’s super beneficial for all sorts of work tasks. And you can just run it out of the box, no need to make any always on or so figure it. Plus their support is top notch.
    – bmike
    Nov 15 '20 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .