isc.sans.edu 15 Sept 2026, 15:23 UTC

macOS 27 Reveals Its Pre-Login Network Activity in New Analysis

macOS 27 Reveals Its Pre-Login Network Activity in New Analysis
CyberSIXT Evidence Panel Source marked as original reporting

JOHANNES Ullrich of the SANS Internet Storm Centre has examined the network activity generated by macOS 27 “Golden Gate” before a user logs in. In a brief capture, he recorded about 300 packets, although the total was probably increased because the test system used both Wi-Fi and wired interfaces, each of which performed its own DHCP and IP discovery. IPv6 duplicate-address detection worked as expected and used ICMPv6 nonces, which help prevent some spoofing-based denial-of-service attacks. The system also advertised no services through multicast DNS on UDP port 5353.

The boot process generated DNS look-ups for Apple and network-related domains, including `_dns.resolver.arpa`, Apple push-messaging hosts, `albert.apple.com` for device activation, `appleid.apple.com`, `ipv4only.arpa` for NAT64 discovery and `www.apple.com` for captive-portal detection. Ullrich advises not blocking `albert.apple.com`, noting that it uses certificate pinning and should not be subjected to TLS interception.

Four TCP connections were observed: HTTPS to `albert.apple.com`, an IPv6 OCSP request to `ocsp.digicert.com` to validate that certificate, and encrypted connections to Apple push services on ports 443 and 5223. The captured OCSP request used the user agent `com.apple.trustd/3.0`. Safari identified itself as version 27.0, while reporting the platform as “Intel Mac OS X 10_15_7”, despite the test machine using an Apple M-series processor.

View full article

Article by CyberSIXT