MacOS 27 - First Boot, (Tue, Sep 15th)
This report from SANS Internet Storm Center details the network traffic observed during the initial boot process of macOS 27 "Golden Gate." The analysis reveals standard IPv6 Neighbor Discovery with duplicate address discovery and nonce protection, DNS resolution for various Apple services (including device activation and push notifications), and TLS connections to Apple servers. The report highlights the complexity of Apple's network infrastructure and the importance of avoiding unnecessary blocking of legitimate traffic.
This report from SANS Internet Storm Center examines the network activity of macOS 27 "Golden Gate" during its initial boot sequence. The analysis focuses on the network traffic generated by the system before a user logs in, providing insight into the system's communication patterns.
During boot, macOS 27 performs standard IPv6 Neighbor Discovery, utilizing duplicate address discovery and ICMPv6 nonces to mitigate potential DoS attacks. DNS resolution is also active, resolving several Apple-related hostnames, including `_dns.resolver.arpa` (SVCB), `1-courier.push.apple.com`, `126.2.5.10.in-addr.arpa`, `albert.apple.com`, `appleid.apple.com`, and `www.apple.com`. The hostname `albert.apple.com` is used for device activation and employs certificate pinning to prevent TLS interception. For IPv6-only networks, the record `ipv4only.arpa` resolves to a NAT64 IPv6 prefix.
Network connections include TLS connections to `albert.apple.com` (HTTPS on port 443, IPv4), an OCSP connection to `ocsp.digicert.com` (HTTP on port 80, IPv6) to verify the certificate for `albert.apple.com`, TLS to `init.push.apple.com` (port 443), and a TLS connection to `courier.push.apple.com` (port 5223). Multicast DNS is used to advertise services on port 5353/udp. The user agent string observed during boot is `com.apple.trustd/3.0`. Safari's user agent is `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15`, indicating Safari version 27.0, although the OS version reported is "Intel Mac OS X 10_15_7" (collected from a Mac with an "M" CPU).
Johannes B. Ullrich, Ph.D., Dean of Research, SANS.edu, provided this analysis.