{"id":15717465,"url":"https://github.com/nufeen/suspicious-sierra","last_synced_at":"2025-10-07T00:41:25.417Z","repository":{"id":85746096,"uuid":"122729259","full_name":"Nufeen/suspicious-sierra","owner":"Nufeen","description":"Sierra network activity list","archived":false,"fork":false,"pushed_at":"2018-07-15T20:17:49.000Z","size":8,"stargazers_count":27,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-05-13T00:44:42.073Z","etag":null,"topics":["macos","macos-sierra","sierra"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Nufeen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-02-24T10:15:50.000Z","updated_at":"2024-02-12T16:53:24.000Z","dependencies_parsed_at":null,"dependency_job_id":"2259e22e-56e6-4c4e-bc18-93bf4ced9a6e","html_url":"https://github.com/Nufeen/suspicious-sierra","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Nufeen/suspicious-sierra","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Nufeen%2Fsuspicious-sierra","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Nufeen%2Fsuspicious-sierra/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Nufeen%2Fsuspicious-sierra/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Nufeen%2Fsuspicious-sierra/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Nufeen","download_url":"https://codeload.github.com/Nufeen/suspicious-sierra/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Nufeen%2Fsuspicious-sierra/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278703578,"owners_count":26031204,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-06T02:00:05.630Z","response_time":65,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["macos","macos-sierra","sierra"],"created_at":"2024-10-03T21:50:14.092Z","updated_at":"2025-10-07T00:41:25.397Z","avatar_url":"https://github.com/Nufeen.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# SUSPICIOUS SIERRA CONNECTIONS\n\nThis is a tiny investigation of suspisious Mac OS Sierra connections reported by Little Snitch (commonly abbreviated as `LS` in current context), each section consists of quotes from the discussions in corresponding links. My own comments are marked with _italic_.\n\nThis document covers only recent network activity, for the detailed Mac OS security guide refer https://github.com/drduh/macOS-Security-and-Privacy-Guide\n\nThis gist with shell script for just disabling everything is related, though I'd recommend to be very careful with it: https://gist.github.com/pwnsdx/d87b034c4c0210b988040ad2f85a68d3 \n\n### Few things to know:\n\nTo get the list of agents you can run: `ls /System/Library/LaunchAgents/`\n\nUtility to operate them is called `launchctl`. To get info about certain service: `launchctl list com.apple.whatever`\n\nLatest Mac OS versions include the System Integrity Protection (SIP) feature, that is controlled by `csrutil` util. \n\nBy default it restricts unloading system agents, so most `launchctl unload` commands in old (pre-Maverics) privacy guides will just fail with the following error: `Operation not permitted while System Integrity Protection is engaged`\n\nStopping certain deamon in current session is not restricted though:\n\n`sudo launchctl stop com.apple.whatever`\n\nYou can disable SIP on your own risk, details here: https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/ConfiguringSystemIntegrityProtection/ConfiguringSystemIntegrityProtection.html\n\n\n## `akd/gsa`\n\n`akd` is part of the AuthKit (authentication/authorisation) framework. Also used in the process of authenticating of iCloud and other accounts using Apple ID.\n\nIt is used to authenticate the App Store. App Store login fails if you block it.\n\nhttps://apple.stackexchange.com/questions/240108/what-is-the-akd-process-and-do-i-need-to-allow-it-to-connect-to-the-internet/247110\n\n_Looks like it's the one you'll really need to keep in order to get updates automatically._\n\n\n## `apsd`\n\nThat is the daemon which arbitrates push notifications and other cloud services.\n\nhttps://www.reddit.com/r/mac/comments/2uris4/disable_apsd_to_speed_up_your_mac/\n\n_Note: `aspd` rule is protected by Little Snitch (they consider it important enough for correct system functionality)._\n\n\n## `captiveagent`\n\nA captive portal is a network that forces an HTTP client to see a special web page (usually for authentication purposes) before using the Internet normally. A captive portal turns a Web browser into an authentication device. These are commonly used on wifi networks where authentication to the private network is done via a login browser page, rather than via the use of a WEP or WPA2 key, for example in some coffee shops and airports.\n\nOn Apple devices, if a captive portal is identified, a special application in `/System/Library/CoreServices` called `Captive Network Assistant.app` is opened. This is a very limited browser, separate to Safari, with no address bar or navigation buttons.\n\nhttps://grpugh.wordpress.com/2014/10/29/an-undocumented-change-to-captive-network-assistant-settings-in-os-x-10-10-yosemite/\n\nhttps://apple.stackexchange.com/questions/45418/how-to-automatically-login-to-captive-portals-on-os-x\n\n_Pretty nice example of how things are messed up nowadays. I disabled it on a wi-fi connected computer and it seemes to be fine, but looks that's the thing to be accurate with, since wrong settings may cause problems with connecting to your own wi-fi networks._\n\n\n## `ckkeyrolld`\n\n_Looks like for now nobody is sure what it is:_\n\n`ckkeyrolld` is the system daemon that rolls and verifies encryption metadata.\n\nNo clue about what these metadata really are and why they need to be shared with Apple.\n\n`ckkeyrolld.plist` is related to iCloud encryption I believe.\n\nhttps://www.reddit.com/r/MacOS/comments/7au0tv/what_is_ckkeyrolld/\n\nhttps://twitter.com/icleus/status/943087366436282370\n\n_Soundes like a creepy crap to be disabled. At least if you are not using iCloud (I do not)._\n\n\n## `com.apple.Safari.SafeBrowsing.Service`\n\nThis database, provided by Google, is used by mobile Safari to check for known malicious web sites.\n\nGoogle is constantly updating this database, so your iDevice refreshes on every sync.\n\nhttps://apple.stackexchange.com/questions/101556/what-is-safari-safe-browsing-data-and-why-does-it-need-to-copy-every-time-i-sync\n\n_Suspicious is that OSX sometimes calls the service while Safari is off. But overall this is a useful one._\n\n\n## `gamed`\n\nObviously this framework is something to do with Apple's Game Centre, which I've only previously come across on iOS. What is it now doing on OSX, given that there seems to be no GUI 'front-end' for it? And how the **** do I disable it?\n\nhttps://discussions.apple.com/message/23567732\n\nhttps://apple.stackexchange.com/questions/223331/how-to-disable-game-center-process-gamed-on-os-x-10-11-el-capitan\n\n_Definitely to be blocked or turned off._\n\n### possible way to disable: \n\nIn system settings, you have the panel with the notification center. I removed the game center from there. Hope it helps!\n\n## `geod.xpc`\n\nIt looks like this service is entirely related to Location Services. Blocking it with Little Snitch (as I have done) and/or disabling it with the launchctl command, will render Location Services inoperable. About the only down side I see to that (for my own usage scenario) is loss of the Find My Mac functionality. Otherwise, I've got no particular reason for apps and system services to be utilising my location. People who travel (across timezones) may find that automatic updating of their timezone and clock will fail.\n\nhttps://discussions.apple.com/thread/7353115\n\n`Locationd` is a daemon that provides location services for OS X's \"Core Location\". This uses skyhook technology to figure out your mac's location (using WiFi). It's the same system used by the iPod Touch, and is also used by the iPhone (The iPhone also uses cell tower triangulation and GPS).\n\nhttps://discussions.apple.com/thread/2141988\n\nEven if you were to process all the geo location aspects on developer.apple.com - it's widely used - far greater than just the Core Location API - https://developer.apple.com/documentation/corelocation.\n\n* Weather\n* Calendar\n* Address Book\n* Maps\n* Siri\n* iCloud (finding the best data center to route uploads)\n* Store (which geographic region should your content be)\n* Time Zone and Night Shift\n* Safari location\n\nhttps://apple.stackexchange.com/questions/201839/services-using-com-apple-geod\n\n### possible way to disable: \n\n_Location Services can be turned off in System Settings (and is actually recommended for the desktops, since you'll hardly ever need them). In my case that didn's stop geod.xpc activity though._\n\n\n## `helpd`\n\n`helpd` is the daemon that's running on your mac that gives you access to the help files when you open a program.\n\nhttps://discussions.apple.com/thread/3930621\n\n_I turn this thing off since it tries to reach remote servers when I do not ask for any kind of help._\n\n\n## `imagent`\n\n`imagent` is part of Apple's Messages app (formerly iChat). (_LS info_)\n\n`IMAgent` is a process that listens for FaceTime invitations. It will be active even if FaceTime isn't running. You don't have to block it, but if you don't use FaceTime you can open the application, open preferences, and turn off FaceTime. That should quit the IMAgent process.\n\nhttps://apple.stackexchange.com/questions/86814/firewall-settings-with-imagent\n\n`imagent` memory leak in Mountain Lion: https://discussions.apple.com/thread/4209012?tstart=0\n\n_Tries to reach `init-p01md.apple.com` with no reason, when iChat/FaceTime/etc are off._\n\n\n## `ksfetch`\n\n_Not an Apple service, but you'll probably encounter it. Useful one. Frequency of update checks is adjustable, see the link below._ \n\nThe `ksfetch` process on OS X is part of Google Chrome's update mechanism. The ks prefix is an abbreviation of Keystone. The process appears to be responsible for fetching updates to Google's products.\n\nhttps://apple.stackexchange.com/questions/207998/what-is-ksfetch-process-on-mac\n\n\n## `mappushd`\n\nLocation Services allows applications and websites to gather and use information based on the current location of your computer.\n\nYour approximate location is determined using information from local Wi-Fi networks, and is collected by Location Services in a manner that doesn’t personally identify you.\n\nhttps://support.apple.com/en-us/HT204690\n\nhttps://support.apple.com/en-gb/HT207092\n\n_The part of Location services. Related to weather, timezones and so on. Can be disabled on desktops. The only real use of them is Find My Mac functionality on macbooks._\n\n## `nbagent`\n\nNoticeboard agent is a macOS system process. As part of Apple’s software update mechanism it is connecting to Apple’s servers. (_LS version_)\n\n`nbagent` is used for website notifications that show up in notification center\n\nhttps://discussions.apple.com/thread/6445084\n\n_Still not sure what it is. What is noticeboard? Why does it need a special agent to connect apple servers? Just disabled it._\n\n## `parsecd`\n\n`parsecd` itself is an unknown network service (possibly related to security) which is run every 10 minutes approximately.\n\nhttps://eclecticlight.co/2017/05/31/an-incomplete-list-of-sierras-dispatched-services/\n\nIs this the service that sends all of my pasteboard content to Apple?\n\nhttps://www.reddit.com/r/mac/comments/54870l/what_is_comappleparsecd/\n\n`parsecd` is a macOS system process that is used for suggestions in Spotlight, Messages, Lookup and Safari (_Little Snitch info_)\n\nBut what the heck does `parsecd` actually do? \n\nIt is location-based suggestions for Siri\n\nI now see a Siri entry that’s checked but greyed out. I suspected that was because she was disabled so I reenabled her. But her location service is still checked and grayed out - no way to disable it!\n\nGuess I’ll just have to block connections with LS to silence the cunning little witch.\n\nhttps://apple.stackexchange.com/questions/266989/what-is-parsecd\n\n## `touristd`\n\nIt can display different Apple tours depending on OS and device. You can try to run `/System/Library/PrivateFrameworks/Tourist.framework/Versions/A/Resources/touristd --help` to get some hint.\n\nhttps://apple.stackexchange.com/questions/294291/what-is-touristd\n\nDetails: \n\nhttps://carlashley.com/2016/10/19/com-apple-touristd/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnufeen%2Fsuspicious-sierra","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnufeen%2Fsuspicious-sierra","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnufeen%2Fsuspicious-sierra/lists"}