News for hackers. Stuff that matters.

A comment on Alarming number of DNS requests made by iOS devices. Parent comment

Re:Alarming number of DNS requests made by iOS devices by stanlarroque on Saturday October 21, 2017 @10:27PM (#15524822)
I understand iCloud, iTunes, and all other apple services need to communicate with their servers. My point is to question why do they need more than 1000 hosts for their endpoints? It only look suspicious in my eyes.

https://stan.sh/images/ios_domains.csv

[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by TazeTSchnitzel on Saturday October 21, 2017 @11:39PM (#15525049)
1) Every service most likely has many, many different servers providing it. These may have different hostnames. Particularly consider that Apple uses a lot of cloud services.

2) All the services you list in fact consist of many smaller services. iTunes alone is a storefront, a CDN, a payment processing service, a DRM system, a syndication service, an account management service, a media library synchronisation service, a streaming media service, and so on. iCloud is a blanket name for a large collection of big services which themselves may consist of many smaller services.

3) That isn’t even the full set of services.

In light of these considerations, 1000 hostnames should not be unexpected. That might even be a surprisingly small figure.

[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by flotillo on Saturday October 21, 2017 @10:37PM (#15524851)
Why is it suspicious? I don't see your reasoning here. Having a diverse range of DNS names requested doesn't seem to me to be an indicator of suspiciousness.

On earlier releases of iOS that had a public jailbreak released, I spent quite some time using HttPeek (https://github.com/Yonsm/HttPeek) to examine what various OS processes were sending, and found nothing untoward.

I'd be surprised if this had changed for the worse in more recent iOS releases.

[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by kalleboo on Saturday October 21, 2017 @11:48PM (#15525070)
One area where Apple uses a large amount of domain names on purpose is for their captive portal detection. Supposedly they do this on purpose so that captive portals can't try to hard-code a list of domains in order to white-list/fool it.
[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by im3w1l on Sunday October 22, 2017 @12:08AM (#15525113)
Device: Am I on a captive portal? Nonce.

Apple server: No. Same Nonce. Cryptographic signature.

If different response: Captive portal. If no response: No internet.

[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by im3w1l on Sunday October 22, 2017 @10:29PM (#15530262)
Oops, this doesn't actually work, because the captive portal can just let that one request through unmodified...
[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by tomjakubowski on Saturday October 21, 2017 @11:53PM (#15525087)
What benefit would a captive portal derive from hiding from Apple's captive portal detector?
[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by hmage on Sunday October 22, 2017 @12:26AM (#15525155)
iOS offers a slideover view that gets dismissed once absence of captive portal is detected. That way you can’t redirect people forcibly to your website after auth is done in a way that persists.

But if you force people to use a browser rather than auto disappearing modal view, the bounce rate is much lower once you force them to visit your website after captive portal login.

[ Parent | on HN ]
Re:Alarming number of DNS requests made by iOS devices by AdamJacobMuller on Sunday October 22, 2017 @06:45PM (#15529437)
Why not?

I've developed some very large globe-spanning systems that are probably a single-digit % complexity as the Apple ecosystem and we touch hundreds of endpoints. Doesn't seem suspicious to me at all.

[ Parent | on HN ]