Characterizing the Security of Endogenous and Exogenous Desktop Application Network Flows

Matthew McNiece, Ruidan Li, and Bradley Reaves

Proceedings of the Passive and Active Measurement Conference, 2021

Measuring network security of MacOS applications requires on-device flow collection and distinguishing app activity from user activity.

Abstract

Most desktop applications use the network, and insecure communications can have a significant impact on the application, the system, the user, and the enterprise. Understanding at scale whether desktop application use the network securely is a challenge because the application provenance of a given network packet is rarely available at centralized collection points. In this paper, we collect flow data from 39,758 MacOS devices on an enterprise network to study the network behaviors of individual applications. We collect flows locally on-device and can definitively identify the application responsible for every flow. We also develop techniques to distinguish “endogenous” flows common to most executions of a program from “exogenous” flows likely caused by unique inputs. We find that popular MacOS applications are in fact using the network securely, with 95.62% of the applications we study using HTTPS. Notably, we observe security sensitive-services (including certificate management and mobile device management) do not use ports associated with secure communications. Our study provides important insights for users, device and network administrators, and researchers interested in secure communication.

Citation (IEEE)

M. McNiece, R. Li, and B. Reaves, “Characterizing the Security of Endogenous and Exogenous Desktop Application Network Flows,” in Proceedings of the Passive and Active Measurement Conference, 2021.

BibTeX

@inproceedings{mlr21,
  author = {{Matthew McNiece} and Li, Ruidan and {Bradley Reaves}},
  booktitle = {{Proceedings of the Passive and Active Measurement Conference}},
  date = {2021-03},
  title = {Characterizing the Security of Endogenous and Exogenous Desktop Application Network Flows},
}