macOS 27 Contacts Apple Services During First Boot, Researcher Finds

SANS Internet Storm Center researcher Johannes Ullrich examined the network activity generated by a macOS 27 “Golden Gate” system during its first boot, before a user logged in. The capture contained about 300 packets, although Ullrich said this was probably inflated because the test system used both Wi-Fi and wired interfaces, each of which performed its own DHCP and IP discovery. IPv6 duplicate-address detection worked as expected and used ICMPv6 nonces, which help prevent some spoofing-based denial-of-service attacks.

The system performed DNS lookups for Apple services involved in activation, Apple ID verification, push messaging and captive-portal detection, as well as records used for DNS-over-HTTPS resolver discovery, reverse DNS and NAT64. Ullrich recorded TLS connections to `albert.apple.com`, `init.push.apple.com` and `courier.push.apple.com`, plus an OCSP request to `ocsp.digicert.com` to validate the activation server’s certificate.

He specifically advised not blocking or TLS-intercepting `albert.apple.com`, which uses certificate pinning. macOS 27 also advertised no services through multicast DNS during boot.

The observed TCP behaviour was largely unchanged from earlier macOS releases, including a window scale of 6, ECN and random timestamps. The only visible boot user agent was `com.apple.trustd/3.0`; Safari identified itself as version 27.0 but reported the operating system as `Intel Mac OS X 10_15_7`, despite the capture being taken from a Mac with an Apple “M” processor.