MacBook Neo 经 Apple Store DFU 重置后仍存在后台被动 FTP 等异常网络配置

My last post covered my most recent observations as I work towards a clean and secured iCloud + set of Apple devices. This post will give some examples of what I mean when I say “odd behaviors” and a partial timeline of events.

These are observations from a freshly wiped MacBook Neo that had an in-store DFU (Device Firmware Update) performed Friday October 2nd. The device is in Lockdown Mode, has no iCloud account attached to it, nor any third-party applications installed.

System Configuration PLISTs — Yikes

Diving in… When I run sudo plutil -p /Library/Preferences/SystemConfiguration/preferences.plist I get some concerning results, including an indication there’s a constant FTP stream associated with my connection:

Specifies en0 as WiFi. Includes a series of DNS, IPv4, IPv6, Proxy, FTP, SMB, and purported “User Defined” changes.

Unfortunately, Apple’s documentation is so sparse I can’t tell what is supposed to be here or not.

What I definitely know is not supposed to be here: FTPPassiveset to true.

Press enter or click to view image in full size

“the client initiates both the command channel and the data channel, allowing connections to pass through client-side firewalls” — no thank you.

Second, I really feel deeply these Proxy settings are likely not factory installed defaults, but again, Apple publishes nothing on this so on this I’ll begrudgingly accept they populate this field by default¹.

Here’s another one.

en0 makes a return but this time saying JoinMode is Automatic. The last image demonstrated en0 is our WiFi. I have Lockdown Mode turned on, which is supposed to prevent WiFi from auto-connecting

I’m not in any way comfortable accepting that “JoinMode” => “Automatic”is benign if I’m in a feature called “Lockdown Mode”.

The Apple Store Diagnostic iPhone/iPads show my devices as not being in enrolled in any Mobile Device Management (MDM) or Apple Business Manager (ABM) Servers.

macOS Firewall Uncertainty

Let’s take a look at my post-Apple Store DFU macOS Firewall****Settings… First, all these entries — they don’t seem normal but all the LLM’s and their tenuous sources assure me these entries are default… Note that I manually set these entries to Block. Now let’s try interacting:

Press enter or click to view image in full size

I’m pretty sure pressing Ok isn’t supposed to undo the changes you make to the Firewall settings

Every time I close the window the settings reset back to allowing any “signed” local software to accept any incoming connections. It’s entirely possible for there to be self-signed applications installed without my knowledge, if something is able to apply the above described changes.

Searching Google or interacting with its AI modality shows various Apple Community Notes I have some concerns about². At one point, it even actively networking security advice that I can’t actually find a documented answer for. I installed Apple Intelligence on my iPhone to ask the same question — as, from what I understand, the base model is Gemini:

Press enter or click to view image in full size

This Reddit thread from 2025 shows a number of people passionately arguing their macOS Firewall as On or Off by default:

Temporary Peace of Mind

While writing these posts I’ve used:
sudo networksetup -setnetworkserviceenabled “Wi-Fi” off
to get a bit of comfort of privacy to work, given the above documented issues … which results in the following This Connection Is Not Secure in Safari:

Press enter or click to view image in full size

This Connection Is Not Secure displays when setnetworkserviceenabled turns off Wi-Fi but not when the Wi-Fi is toggled off.

When I bring my WiFi back up (using the above command, swapping off for on) my iPhone in Hotspot mode will not show up as an available macOS WiFi network (I toggle all the iPhone cellular, wifi, hotspot and macOS WiFi ones on and off) and I have to manually enter the SSID and password⁴.

Bonus Gotcha

Bonus from a MacBook Pro in my home I suspect to be infected⁵:

Press enter or click to view image in full size

It’s easy to miss, but at the 3 second mark when I click the Details dropdown to collapse Details at about the 2-second mark, the drop-downs switch from “Never Allow” to “Always Allow”.

Using The Past to Contextualize The Present

I’ve been thinking a lot lately about the development of Windows Vista’s User Account Control (UAC— the annoying popup with a dark overlay that asked you to confirm security changes) alongside the introduction of the desktop compositor, or Desktop Window Manager (DWM— the thing that let you have transparent/blurred graphical interfaces like the glass/”Aero” taskbar and glass titlebars and borders — think the “frame” around the window to fun visuals like Aero Peek, hovering over a taskbar icon to show the Windows you have open).

A big concern at the time was the real rising risk of “pixel overwrite attacks”, where an attacker perfectly positioned their UI atop the “secure” input. The user would type into the intercepted input, the attacker would pass the input to the real application so the user never was any the wiser.

I’m not well-versed in macOS internals and woefully out of date at Windows. But I still can put together fundamentals… Let’s take a look at defaults read com.apple.systemuiserver:

Press enter or click to view image in full size

defaults read com.apple.systemuiserver shows__NSEnableTSMDocumentWindowLevel

If anyone has other commands to try in this vein, I’m all ears. There is very little that Google turns up for NSEnableTSMDocumentWindowLevel. What we can say:

It seems to be an internal Apple API that allows overlaying a window atop all other windows to collect input. Google AI summarized it as:
“an internal, legacy Apple configuration key used to control how a window’s layer hierarchy interacts with the Text Services Manager (TSM) in macOS”
One result includes this GitHub Issue in simplified Chinese, in a repo that purports to clean stubborn spyware: https://github.com/tw93/Mole/issues/1000
A post from 2010 that comes up in searches for NSEnableTSMDocumentWindowLevelthat discusses stealing plist content:https://www.macscripter.net/t/configure-a-new-account-with-applescript-well-partly/59601

I’ll leave the Windows Vista UAC/DWM history and investigation into com.apple.systemuiserver for a future post. If you have any genuine insights here, please reach out!

Abridged Timeline

A brief timeline of the most recent round of oddities⁶.

**Saturday, September 19th:**Put my iPhone 15 Pro in Lockdown mode after noticing odd screen flashing while looking at sensitive materials. My iCloud account had Advanced Data Protection and other various security controls already turned on.
Sunday, September 20th: My iPhone displays it’s first device-wide overlay loudly announcing an expired SSL certificate from May 29, 2025, while my AT&T BGW320–500 (Humax) is on and the fiberoptic PON is off.
**Thursday, September 24th:**I turn off my AT&T Fiberoptic equipment and go iPhone only after
**Saturday, September 26th:**iPhone 15 Pro in permanent state of This Connection Is Not Secure following deletion of eSIM while in Lockdown Mode.
**Sunday, September 27th:**Purchase new iPhone 18 Pro, new provider (AT&T), new phone number, new iCloud account. iCloud account setup in Apple Store. AT&T Line was added to an existing account at a nearby Authorized Retailer. I’ll note I found it a bit odd the retailer used Spectrum Wi-Fi for their own operations.
**Thursday Morning, October 1st:**I finally bite the bullet and bought a MacBook Neo so I can get back to work. I set it up at home using my iPhone 18 Pro + it’s iCloud account and pretty quickly see 4 UTM tunnels turn into 8.
**Thursday Afternoon, October 1st:**Head to an AT&T corporate store to get a new eSIM QR code instead of reactivating my phone there on their Wi-Fi/around other devices.
Thursday Evening, October 1st: Head to the Apple Store where an incredibly helpful and compassionate manager treats my issue with respect and notes with curiosity he experiences one of the symptoms on his home computer. We proceed to perform a DFU on the iPhone 18 Pro, while he happily grabs a USB-C > Ethernet adapter so I can activate the iPhone with the QR code on their network.
He also suggests I can come in the store to use their phone and Wi-Fi to talk to Apple Support the following day so they can run diagnostics on my iPhone while I talk to them.
**Friday, October 2nd:**I come into the Apple Store with my notes all prepared and ready to talk to Apple Support and hopefully escalate the issue to engineering. We hit an undocumented issue where Lockdown Mode prevents uploading files to Apple’s upload portal⁶. Apple Store employees also see that my iCloud 6-digit verification codes between the Neo and 18 Pro (on their Wi-Fi) showing as invalid.
Apple Support ends with directing me to the Security Program link, which doesn’t really put my devices in a usable state. They offer to help me wipe them, but I’d much rather Apple’s engineers are aware of this issue and can pull the exact logs/configurations that have lead to this state.
Apple Store manager performs a DFU of the MacBook Neo which had been claiming to be up to date with macOS 26.6 — in fact it still says it’s logged into my account, we update to macOS 27.
I want to clarify in no way do I blame the Apple Store employees for the presence of these Biome Proactive Harvesting containers. The initial post was an incredulity at Lockdown Mode without iCloud, Siri, or Apple Intelligence setup to include these invasive features.

Summarizing

Hopefully this post helps demonstrate that we face an ecosystem devoid of reliable documentation and are rapidly ceding authoritative decisions to opaque models. Models that still will cite downright inaccurate and harmful security related advice when they should at this point be more than advanced enough to know proper security posture. See Appendix 2 for more.

Get sparky’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

On the devices front, we have an iPhone and MacBook that the Apple Store diagnostic devices show as free of MDM or ABM enrollment.

My best theory right now is my iPhone 18 Pro iCloud account carried something that “infected” the MacBook Neo on setup. I’m left to conclude that either a DFU can allow malicious configurations to survive, or upon opening my MacBook Neo at home, some neighbor’s Wi-Fi connection “infected” it with the above settings, despite being in Lockdown Mode.

Neither are great options. As I wrote this post, I stumbled upon a genuine vulnerability I can go report to the Security Program, so maybe I can finally get the ball rolling on solving these issues…

Appendix

1. The Necessity of Reliable, Rich, Human-Authored Documentation

Note the URL that doesn’t show defaults or screenshots. Note screenshots for employees and customers or else it becomes tribal knowledge.

I have two Intel based Macs with Monterey. One I used Codex on heavily before replacing with an M4 Air. The other Mac also shows signs of network configuration tampering despite never using LLM products on it (though at least it doesn't exhibit the dreaded double-login-screen). The latter machine’s Wi-Fi icon displays (very logically) the with an outline of the Wi-Fi symbol struck through the center:

Monterey Mac Mini Wi-Fi “Off” with bars empty and diagonal strike through.

Monterey Mac Mini Wi-Fi “Off” with bars empty and diagonal strike through. Sorry for potato quality.

The former Monterey machine (heavily used Codex) has the “newer” style Wi-Fi symbol. Note, the boot-loader broke when I tried to create a guest account on the “Codex-heavy” Intel Mac, so I don’t have the exact screenshot, but it appears the same as the one on my newly DFU’d MacBook Neo:

MacBook Neo Wi-Fi “Off” icon with bars filled in and diagonal strike through. Same as 2017 Intel Monterey MacBook Pro.

In short: OS defaults cannot be left up to guesswork and trusting LLM’s, lest the “true” state of a UI drifts into becoming tribal knowledge where no human readily remembers or can verify the true true.

2. Computer Class and Media Literacy and Citing Your Sources

Growing up in the 90’s and early 2000’s we had “computer classes”. Starting with old Macintosh IIe’s you played math and word games on (after one catches on fire and the librarian had to run it out of the school in the snow, they got mostly replaced with a few iMacs we had to share until the No Child Left Behind dollars came in).

In Fifth and Sixth grade, our librarian Mrs. Bailey taught the “computer classes”, which focussed on media literacy and citing of sources. “We have Lexus Nexus for God’s sake”, as she tried implore an appreciation 12 year olds had no capacity for (sorry Mrs. Bailey).

She instilled in us the discipline of following a source all the way through its citations and judging the credibility of the author — thank you, Mrs. Bailey for an invaluable life-skill.

Near the end of the school year a large group of kids realized we could edit Wikipedia (there were significantly less mods and less admin tooling back then) — which didn’t impress Mrs. Bailey and we got an earful for that. We also realized we could make a Geocities site that was well written, and over the summer, we could link to it across different websites with comment sections.

She overheard the scheme (12 year olds really never realize how loud they are) and used it as a teaching moment. There wasn’t a need for fear, she’d earned a place of authority even if it could be irksome — she taught us about early Search Engine Optimization and showed us early studies around coordinated online manipulation of information around computer viruses.

It deserves a whole post of it’s own but — example of sources Google AI cites for questions about default Proxy or Firewall settings. They give out obtuse and obfuscatory answers:

Press enter or click to view image in full size

Or have bios like this:

Press enter or click to view image in full size

“Location: Planet Earth for the time being” “…vortex surfer, galactic traveler, existential detective, systems analyst, artist, transcontinental big-foot hunter…”

Or this “level 10” asshole again that always shows up blaming people for inviting/unwittingly allowing attackers in while gaslighting them with incorrect information about what’s possible security wise, and always get massively upvoted for sharing incorrect information and then the thread gets locked:

Press enter or click to view image in full size

I’m tired…

It’s unclear to me if Apple displays if a post has been edited or how much they monitor brigading. In an age of advanced models, trust in documentation is pretty damn important. See: **“The Necessity of Rich Human-Authored Documentation”**above.

4. Yep, I Know

To those of you screaming “This stack is already compromised!” — I know! I just don’t precisely know what to do about it, hence these posts.

5. The Constructive Approach To Thinking About “Infections”

It can sound frightening to hear the word “Infection” and conjure up all sorts of fantastical catastrophic ideas. The first step is, don’t panic and take a nice bellyful breath.

If you cut your teeth on computing in the 2003/2004 timeframe, you’ll remember things like Trojan Horses and Worm viruses being able to move between files, networked computers, disk partitions, etc with evasive ease. Catching them and wrestling them out of your local network or computers of neighbors you fixed for $50 a pop was just a common occurrence and challenge of life. CNN and other TV networks being knocked off the air because of a virus, for instance. Security started being taken more seriously with proper investment.

We’ve collectively faced challenges of a similar trajectory in the past, and we’ll do it again. History will be our friend, but we’ll have to rely on a combination of doing our homework and trusting our gut instincts should these type of infections become severe enough.

We shouldn’t try and solve the problems of automation with more automation. Investing in people, humans, long-term — not to be trite, but employees a company can trust comes from a company employees can trust.

6. Abridged Timeline and Other Thoughts On Robustness of Apple Procedures

This is an abridged list of events. I’ve shared a more thorough document with Apple support but they suggested I submit it to the Bug Bounty program — which — sure, fine I suppose. But I don’t trust the state of my machines or accounts, and I think some of the information rather sensitive. This seems to sort of fall between the cracks of security and account/device issues.

I tried to upload related files to Apple Support while I was at the Apple Store using their phone and Wi-Fi. Working with the in-store team, we ran into an issue where the file uploads were stuck at 0%.

In this moment it became apparent there was no mechanism for Apple Store employees to upload data a custom provides (with the explict intent of sharing with Apple Support) say on a thumb drive or printed out. This could be an issue in future situations.

I tried turning off Lockdown Mode for just the Apple Support provided upload link, and that allowed us to proceed. The Lockdown Mode limitation on uploads to their own service should probably be better communicated to Apple Support and Apple Store representatives, or perhaps a non-web based file transfer utility and zero-trust initialization system.

Written by sparky

0 followers