ParetoSecurity/pareto-mac

[Bug]: Failing "AirPlay receiver is off"

jone opened this issue · 6 comments

jone commented

What happened?

The AirPlay receiver is off check fails on my machine.
But in the sharing control panel I have nothing activated. I'm not sure what I have to do now.
Bildschirmfoto 2021-11-07 um 13 02 38

Version

HW: MacBookPro14,1
macOS: 11.6.0
App Version: 1.4.1
Build: 2736

Relevant log output

No response

dz0ny commented

Could you run in Terminal sudo lsof -i -P | grep LISTEN this will list the apps that are running on the same port as Airplay.

For example, this output is when native AirplayServer is enabled:

ControlCe   433          dz0ny   36u  IPv4 0x7ab8ea6f8fee427b      0t0    TCP *:7000 (LISTEN)
ControlCe   433          dz0ny   37u  IPv6 0x7ab8ea6f8d1e95e3      0t0    TCP *:7000 (LISTEN)
ControlCe   433          dz0ny   38u  IPv4 0x7ab8ea6f8d1e57bb      0t0    TCP *:5000 (LISTEN)
ControlCe   433          dz0ny   39u  IPv6 0x7ab8ea6f988ee5c3      0t0    TCP *:5000 (LISTEN)
jone commented

Found the relevant service:

python    22030           jone    3u  IPv4 0x1e516b700e73fc9f      0t0    TCP localhost:5000 (LISTEN)
python    22034           jone    3u  IPv4 0x1e516b700e73fc9f      0t0    TCP localhost:5000 (LISTEN)
python    22034           jone    5u  IPv4 0x1e516b700e73fc9f      0t0    TCP localhost:5000 (LISTEN)

That's when I'm running a local flask application at port 5000 (with FLASK_ENV=development). Seems to be a false positive.

  • 👍1
dz0ny commented

Yes false positive, we also check for other ports that are related to AirPlay but that's not sufficient enough. The next release will also check if the underlying process is not active.

  • 👍1
zupo commented

Just a bit more context: Pareto Security app now also checks for process name (ControlCenter) along with the port.