5 ms·

I understand iCloud, iTunes, and all other apple services need to communicate with their servers. My point is to question why do they need more than 1000 hosts

I understand iCloud, iTunes, and all other apple services need to communicate with their servers. My point is to question why do they need more than 1000 hosts for their endpoints? It only look suspicious in my eyes. https://stan.sh/images/ios_domains.csv https://stan.sh/images/ios_domains.csv

flotillo 9y ago
Why is it suspicious? I don't see your reasoning here. Having a diverse range of DNS names requested doesn't seem to me to be an indicator of suspiciousness. On earlier releases of iOS that had a public jailbreak released, I spent quite some time using HttPeek (https://github.com/Yonsm/HttPeek https://github.com/Yonsm/HttPeek) to examine what various OS processes were sending, and found nothing untoward. I'd be surprised if this had changed for the worse in more recent iOS releases.
kalleboo 9y ago
One area where Apple uses a large amount of domain names on purpose is for their captive portal detection. Supposedly they do this on purpose so that captive portals can't try to hard-code a list of domains in order to white-list/fool it.
- tomjakubowski 9y ago
  What benefit would a captive portal derive from hiding from Apple's captive portal detector?
  - hmage 9y ago
    iOS offers a slideover view that gets dismissed once absence of captive portal is detected. That way you can’t redirect people forcibly to your website after auth is done in a way that persists. But if you force people to use a browser rather than auto disappearing modal view, the bounce rate is much lower once you force them to visit your website after captive portal login.
- im3w1l 9y ago
  Device: Am I on a captive portal? Nonce. Apple server: No. Same Nonce. Cryptographic signature. If different response: Captive portal. If no response: No internet.
  - im3w1l 9y ago
    Oops, this doesn't actually work, because the captive portal can just let that one request through unmodified...
TazeTSchnitzel 9y ago
1) Every service most likely has many, many different servers providing it. These may have different hostnames. Particularly consider that Apple uses a lot of cloud services. 2) All the services you list in fact consist of many smaller services. iTunes alone is a storefront, a CDN, a payment processing service, a DRM system, a syndication service, an account management service, a media library synchronisation service, a streaming media service, and so on. iCloud is a blanket name for a large collection of big services which themselves may consist of many smaller services. 3) That isn’t even the full set of services. In light of these considerations, 1000 hostnames should not be unexpected. That might even be a surprisingly small figure.
AdamJacobMuller 9y ago
Why not? I've developed some very large globe-spanning systems that are probably a single-digit % complexity as the Apple ecosystem and we touch hundreds of endpoints. Doesn't seem suspicious to me at all.

flotillo 9y ago

Why is it suspicious? I don't see your reasoning here. Having a diverse range of DNS names requested doesn't seem to me to be an indicator of suspiciousness. On earlier releases of iOS that had a public jailbreak released, I spent quite some time using HttPeek (https://github.com/Yonsm/HttPeek https://github.com/Yonsm/HttPeek) to examine what various OS processes were sending, and found nothing untoward. I'd be surprised if this had changed for the worse in more recent iOS releases.

kalleboo 9y ago

One area where Apple uses a large amount of domain names on purpose is for their captive portal detection. Supposedly they do this on purpose so that captive portals can't try to hard-code a list of domains in order to white-list/fool it.

tomjakubowski 9y ago
What benefit would a captive portal derive from hiding from Apple's captive portal detector?
- hmage 9y ago
  iOS offers a slideover view that gets dismissed once absence of captive portal is detected. That way you can’t redirect people forcibly to your website after auth is done in a way that persists. But if you force people to use a browser rather than auto disappearing modal view, the bounce rate is much lower once you force them to visit your website after captive portal login.
im3w1l 9y ago
Device: Am I on a captive portal? Nonce. Apple server: No. Same Nonce. Cryptographic signature. If different response: Captive portal. If no response: No internet.
- im3w1l 9y ago
  Oops, this doesn't actually work, because the captive portal can just let that one request through unmodified...

TazeTSchnitzel 9y ago

1) Every service most likely has many, many different servers providing it. These may have different hostnames. Particularly consider that Apple uses a lot of cloud services. 2) All the services you list in fact consist of many smaller services. iTunes alone is a storefront, a CDN, a payment processing service, a DRM system, a syndication service, an account management service, a media library synchronisation service, a streaming media service, and so on. iCloud is a blanket name for a large collection of big services which themselves may consist of many smaller services. 3) That isn’t even the full set of services. In light of these considerations, 1000 hostnames should not be unexpected. That might even be a surprisingly small figure.

AdamJacobMuller 9y ago

Why not? I've developed some very large globe-spanning systems that are probably a single-digit % complexity as the Apple ecosystem and we touch hundreds of endpoints. Doesn't seem suspicious to me at all.