How to remediate – Apple Remote Events Service Detection

1. Introduction

Apple Remote Events Service Detection identifies a remote events service listening on your computer. This service allows other computers to interact with your system over a network. A compromised service could allow an attacker to remotely control the affected machine. Confidentiality, integrity and availability may be impacted if exploited.

2. Technical Explanation

The Apple Remote Events Service is designed for inter-application communication but can be abused by attackers on the same network. An attacker needs network access to exploit this service. There is no known CVE associated with simply detecting the listening service, however exploitation could lead to arbitrary code execution. For example, an attacker could send commands to the service to launch applications or modify system settings.

• Root cause: The Apple Remote Events Service listens for incoming connections by default.
• Exploit mechanism: An attacker sends malicious events to the service, triggering unintended actions on the host.
• Scope: macOS systems with the Apple Remote Events Service enabled are affected.

3. Detection and Assessment

You can confirm whether a system is vulnerable by checking if the service is listening for connections. Use the following methods to assess your systems.

• Quick checks: Run lsof -i :5900 in Terminal. If the service is running, you will see processes bound to port 5900.
• Scanning: Nessus plugin ID 138462 can detect this service. This is an example only.
• Logs and evidence: System logs may show connections attempts on port 5900.

lsof -i :5900

4. Solution / Remediation Steps

Limit incoming traffic to this port if desired. Follow the steps below to apply a fix.

4.1 Preparation

• The roll back plan involves restoring from backup or re-enabling access through the firewall if necessary.
• A change window may be needed depending on your organisation’s policies.

4.2 Implementation

1. Step 1: Open System Preferences and navigate to Security & Privacy > Firewall.
2. Step 2: Click ‘Firewall Options’.
3. Step 3: Add Apple Remote Events Service (port 5900) to the list of blocked applications or services.

4.3 Config or Code Example

Before

# No firewall rule blocking port 5900

After

# Firewall rule blocking incoming connections on port 5900.  (Example using pfctl)
block drop in quick proto tcp from any to any port 5900

4.4 Security Practices Relevant to This Vulnerability

Least privilege can reduce the impact if exploited. Input validation can block unsafe data sent to the service.

• Practice 1: Least privilege – limit user accounts with access to sensitive services.
• Practice 2: Network segmentation – isolate critical systems from untrusted networks.

4.5 Automation (Optional)

# Example using pfctl to block port 5900 (use with caution)
sudo pfctl -f /etc/pf.conf

5. Verification / Validation

• Post-fix check: Run lsof -i :5900 in Terminal. The output should not show any processes bound to port 5900.
• Re-test: Re-run lsof -i :5900 to confirm the service is no longer listening.
• Monitoring: Monitor system logs for connection attempts on port 5900.

lsof -i :5900

6. Preventive Measures and Monitoring

Update your security baseline to include a rule blocking unnecessary incoming connections on port 5900. Add checks in CI or deployment pipelines to ensure the firewall is configured correctly.

• Baselines: Update your security baseline with this configuration.
• Pipelines: Include a check for blocked ports during system build and deployment.
• Asset and patch process: Review firewall rules regularly as part of your asset management process.

7. Risks, Side Effects, and Roll Back

Blocking port 5900 may prevent legitimate applications from communicating with the service. The roll back steps involve removing the firewall rule or re-enabling access through the firewall configuration.

• Risk or side effect 1: Blocking port 5900 could break inter-application communication.
• Roll back: Remove the firewall rule blocking incoming connections on port 5900.

8. References and Resources

• Vendor advisory or bulletin: https://support.apple.com/?path=Mac/10.4/en/mh896.html
• NVD or CVE entry: Not applicable for detection of listening service only.
• Product or platform documentation relevant to the fix: https://support.apple.com/?path=Mac/10.5/en/8418.html