sec14-paper-wang-tielei

under /private/var/mobile/Library/FairPlay/iTunes_Control/iTunes/. A heavily obfuscated kernelmodule FairPlayIOKit and a heavily obfuscateduser space daemon fairplayd are involved in this process.Furthermore, this user space daemon fairplaydis also involved in the generation of afsync.rq andafsync.rq.sig mentioned in Section 2.2. After receivingthe syncing request from a PC, the air traffic controlservice atc running in iOS devices will communicatewith fairplayd through Mach messages to generateafsync.rq and afsync.rq.sig.A.2 MeasurementExclude small business networks. We plotted the cumulativedistribution for number of distinct valid domainsqueried from all CIDs in a day in Figure 6. SomeCIDs queried a lot more than 2,000 distinct domains in aday, e.g., 25,138,224. However, we only show in Figure6 until 2,000 unique domains in the x-axis. TheCDF curve grows extremely slowly after 1,000 uniquedomains, and 99.5% of CIDs queried fewer than 1,000unique domains in a day. Therefore, we only use CIDsthat queried fewer than 1,000 distinct valid domains perday in our experiment.CDF(%)1007550250CDF for Unique Domains per Day0 500 1000 1500 2000Unique Domains Queried by CID per DayFigure 6: Cumulative distribution for number of distinctvalid domains queried from all CIDs, on 10/12/2013.15USENIX Association 23rd USENIX Security Symposium 93