Passive FTP Enabled on MacBook After Apple Store Reset and Other Observations

macOS Firewall

Let’s take a look at my post-Apple Store DFU macOS Firewall Settings… First, all these entries — they don’t seem normal. Note that I manually set these entries to Block. Now let’s try interacting:

Every time I close the window the settings reset back to allowing any “signed” local software to accept any incoming connections.

There’s no good reason these controls should toggle back on.

Searching Google or interacting with its AI mode will source various Apple Community Notes that seem less than trustworthy¹.

This Connection Is Not Secure

When I use:
sudo networksetup -setnetworkserviceenabled “Wi-Fi” off
I get This Connection Is Not Secure in Safari:

When I bring my WiFi back up it goes right back to a valid connection.

System Configuration PLISTs

When I run sudo plutil -p /Library/Preferences/SystemConfiguration/preferences.plist I get some concerning results, including an indication there’s a constant FTP stream associated with my connection:

Unfortunately, Apple’s documentation is so sparse I can’t tell what is supposed to be here or not. It doesn’t seem correct that there’s a default passive FTP turned on as a default in macOS while Lockdown Mode is enabled.

Bonus

Bonus from a MacBook Pro in my home I suspect to be infected. You’ll note the “When using this certificate” swaps from Never Trust to Always Trust: