sec14-paper-wang-tielei

Domain Time Frame HTTP headers (Source IP, UA) iOS Mac Mozilla Otherswdist.apple.com 10/24-11/04/2013 3,530 115 0 114 1 0swscan.apple.com 10/24-11/04/2013 9,643 3,884 0 3,875 9 0swcdn.apple.com 10/19-11/11/2013 18,649 613 0 140 473 0iphone-wu.apple.com 10/18-11/04/2013 17,606 1,772 1,174 598 0 0apple-mobile.query.yahooapis.com 10/22-11/02/2013 16,808 3,018 2,999 19 0 0gs-loc.apple.com 10/22-11/04/2013 2,380 561 367 182 0 0p*-buy.itunes.apple.com 10/26-10/29/2013 487 119 - - - App Storeinit-p01st.push.apple.com 10/18-10/31/2013 8,990 - - - - -Table 5: Ground truth of fingerprint domain names.query init-p01st.push.apple.com when the cacheexpires.2. Reverse Engineering: We also reverse engineeredthe push service daemon process apsd in iOS located at/System/Library/PrivateFrameworks/ApplePushService.framework/. We found that theURL http://init-p01st.push.apple.com/bagis used to set up the push-server’s configurationpath in the class APSEnvironmentProductionthrough the method setConfigurationURL. Furthermore,in another private framework calledPersistentConnection, we found that the maximumlength of time this connection can last is set to 1,800sby setMaximumKeepAliveInterval(1800.0).This means iOS devices must re-send an HTTP requestto get push server configurations at least every1,800s. Moreover, the final A-type domain frominit-p01st.push.apple.com has a TTL of 20s. As aresult, every time the HTTP request is made, there mustbe a DNS query for the A-type domain.3. Idle iPod Touch Experiment: We set upan iPod Touch to never auto-lock, connected it to aWiFi hotspot, and left it idle for 35.5 hours. Duringthis period, there were 150 DNS queries toinit-p01st.push.apple.com in total. Average queryinterval was 859s, with a maximum value of 1,398s and aminimum value of 293s. The maximum query interval isconsistent with our 1,800s result via reverse engineering.Our findings show that as long as an iOS deviceis connected to the Internet, it constantlyqueries init-p01st.push.apple.com for push serviceconfigurations, with query intervals shorter thanan hour. Each query interval is determined byboth the HTTP Cache-Control value and an enforcedmaximum interval value. The query interval forinit-p01st.push.apple.com from iTunes is muchlonger. The reason for this query interval difference maybe that iOS devices are more mobile than PCs. As aniOS device moves, it might need a push server closer toits current location, to ensure small push service delay.Given the unique fingerprint for App Store purchasesand a unique iOS heartbeat query pattern,we inferred a lower bound of Windows iTunesby estimating the number of CIDs that queriedp*-buy.itunes.apple.com but did not queryinit-p01st.push.apple.com in the hour beforeand after the purchase query. If the Windows iTuneshappened to query init-p01st.push.apple.comwithin those two hours, or if the user did not purchaseanything in the iTunes App Store, it wouldbe a false negative, since we cannot recognize WindowsiTunes even though it exists. However, thereare no false positives. Note that we cannot useinit-p01st.push.apple.com to estimate the numberof iOS devices for two reasons: i) Windows iTunescan query this domain; ii) the final A-type domain ofinit-p01st.push.apple.com can come from multipleoriginal domain names 6 . Therefore, by removingCIDs that queried init-p01st.push.apple.com inthe small time window, we exclude a larger set of CIDsthat purchased from within iOS, resulting in a lowerbound for Windows iTunes estimation.On 10/12/2013, from the 142,907 infected CIDswith iOS devices, we further identified 112,233 CIDswith Windows iTunes purchases on the same day, i.e.,Set iTunes ∩ Set iOS . This indicates that 112,233 (23.70%)of CIDs have both iOS devices and Windows iTunes, butno Mac OS X within the home network.5.7 Mobile Banking TrafficThe iOS devices behind bot CIDs with Windows iTunesare potential victims of our attacks. To estimate the percentageof those devices that may have banking appsinstalled, we chose mobile domains from eight banks(Citibank, Wells Fargo, PNC, Bank of America, Suntrust,Bank of the West, and U.S. Bank), and examinedhow many of those iOS devices queried them. We discoveredthat 4,593 (4%) of 112,233 potential victimsqueried mobile banking domains on 10/12/2013. Thisindicates that these devices are likely installed with mobilebanking apps that could be replaced with fake mobilebanking apps once they are infected, as discussed inSection 3.6 This is the only fingerprint domain name we used whose final A-type domain could be resolved from multiple different domain names.1088 23rd USENIX Security Symposium USENIX Association