macOS 27 "Golden Gate" Network Traffic Analysis Reveals Standard Boot Processes
Analysis of macOS 27 "Golden Gate" boot traffic shows standard network protocols for device activation, Apple ID verification, and captive portal detection, alongside IPv6 Duplicate Address Discovery.
A recent analysis of the network traffic generated by a macOS 27 "Golden Gate" system during its initial boot process, before any user login, has shed light on the standard operational procedures and communication patterns employed by Apple's latest operating system. The study, conducted by the SANS Internet Storm Center, captured approximately 300 packets, a figure noted as potentially inflated due to the simultaneous use of both Wi-Fi and wired network interfaces, each initiating its own DHCP and IP discovery.
The examination revealed that macOS 27 adheres to standard compliant Duplicate Address Discovery (DAD) protocols for IPv6. Before assigning an IPv6 address, the system actively uses ICMPv6 Neighbor Solicitation messages, incorporating nonces to mitigate potential spoofing and Denial-of-Service attacks. This ensures the uniqueness and integrity of the assigned IPv6 addresses on the network.
Significant DNS traffic was observed during the boot sequence. macOS 27 resolved a variety of Apple-specific hostnames, including those for push messaging services (_dns.resolver.arpa, 1-courier.push.apple.com, 1-courier.sandbox.push.apple.com), device activation (albert.apple.com), and Apple ID verification (appleid.apple.com). The analysis also noted the resolution of ipv4only.arpa, which is crucial for IPv6-only networks to access IPv4 services via NAT64, and www.apple.com, used for captive portal detection.
The system also engaged in establishing several TCP connections. These included TLS connections to 'albert.apple.com' for device activation, an OCSP connection to 'ocsp.digicert.com' to validate the 'albert.apple.com' certificate, and TLS connections to 'init.push.apple.com' and 'courier.push.apple.com' for push notification services. Notably, 'albert.apple.com' employs certificate pinning, advising against TLS interception for this specific hostname.
In line with previous macOS versions, macOS 27 continues to utilize Multicast DNS (mDNS) on port 5353/udp to advertise services. The analysis also identified the user agent string present in OCSP requests as 'com.apple.trustd/3.0', consistent with prior macOS iterations. Interestingly, the user agent for Safari within the captured data indicated a version of "27.0" for Safari, but an older OS version of "Intel Mac OS X 10_15_7", despite being collected from a Mac with an "M" series CPU, suggesting potential discrepancies in how user agent strings are reported.
The findings underscore that the network activity during macOS boot is largely predictable and follows established protocols for network configuration, service discovery, and security validation. While the analysis focused on IPv6 router advertisements and not DHCPv6, the observed behaviors align with expected operating system functions, providing valuable insights for network administrators and security professionals monitoring endpoint communications.