Leopard's Firewall a 'Mess,' Breaks Skype, Says Researcher

Skype Problems

When the "Set access...." mode is turned on, Leopard digitally signs applications that the user allows access to incoming communication. But if that application is subsequently changed -- say when it's updated to a new version -- the signature no longer matches and the application won't run. While that's typical of firewalls, Leopard also blocks applications that change at runtime. Skype, the popular VoIP software and instant messenger, is one such program.

If the user has set the firewall to "Set access..." and runs Skype, the icon will bounce a time or two on the dock, but not load. Nor does Leopard tell the user that Skype has failed or why it won't launch. Only the Mac OS X Console gives a clue, with a message such as: 11/2/07 9:47:51 AM [0x0-0x35035].com.skype.skype[399] Check 1 failed. Can't run Skype

"You can fix this by reinstalling Skype," said Mogull, "and it will work until the next time it's run. Then you have to reinstall Skype again. That's a bit of a problem."

Skype has acknowledged the problem as far back as August, but while it said then it was working on a fix, no version compatible with the Leopard firewall has been issued. (The last Mac OS X Skype update was released in July.)

"I was close to recommending the firewall in app signing mode ["Set access..."], but not with this problem of breaking applications," he said. Instead, users should rely on the protection built into their routers. "If you have a wireless router between the modem and your Mac, you're fine," he said.

But even a flawed firewall isn't fatal, Mogull noted, for Mac users. "I run a firewall, but it's kind of out of habit from my days with Windows," he said. "I like that extra layer of protection." But there have been few cases where exploits have actually claimed success against Apple's systems. "There was a zero-day, but that's been patched. I don't know of any ways of getting in today." He declined to name the exploit.

"Fortunately, all of this is fixable," he said. "Apple clearly was a little rushed, but they're moving in the right direction. It's our responsibility to keep on Apple to make sure they convert these concepts into actual implementations."