Jump to content

Firewall Interactive mode seems to have stopped asking for Apple Signed processes (6.9.200)


Go to solution Solved by erratic,

Recommended Posts

I was running Cyber Security Pro 6.8 and upgraded to 6.9 (.200). I am on Catalina 10.15.7.

I had the Firewall in Interactive mode, and unchecked "Allow software signed by Apple to access the network automatically".

This worked well before the upgrade to 6.9; ESET Cyber Secuity Pro told me about all Apple processes trying to go out, such as ocspd, locationd, etc.

Since 6.9 I find the firewall very quiet on the Apple front. It still tells me when non-Apple processes try to engage in communication, but nothing for Apple processes - which I find odd.

I have the impression something is off with the firewall. Also, and I don't know if that's normal, when I disable "Network Traffic Filtering", the interface does not show a red trianble in the upper right corner, like it does when you disable Real-Time File System Protection. Unless I'm mistaken I thought that normally for disabling Network Traffic filtering would be displayed by ESET as a red issue. In the attached snapshot you can see that Network Traffic Filtering is disabled, yet the Firewall icon shows nothing is wrong, and behind the dropdown menu you an see it is showing "Maximum protection".

What could be wrong? Anything I can check?

Untitled.png

Edited by erratic
Link to post
Share on other sites

I can confirm something is wrong in 6.9.200.

I went back to 6.8.455, my previous version and I got the desired funtionality back regarding Apple signed processes popping up in Interactive mode, something that doesn't work in 6.9.200.

Also, when I disable Network Traffic Filtering in 6.8.455, ESET does signal it in the dashboard (see attachment).

Also, I see lots of "No usable rule found" in the logs.

image.png

Link to post
Share on other sites
  • 3 weeks later...

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...