CalvinBackup/Unauthorized-Signer

Fork 0

mirror of https://github.com/JGoyd/Unauthorized-Signer.git synced 2026-02-12 22:12:50 +00:00

Files

Joseph Goydish II d202d717ff Create The Facts.md

2025-12-07 20:39:48 -05:00

15 KiB

Raw Permalink Blame History

Apple Internal Certificate Compromise - Evidence Documentation

Executive Summary

A retail iPhone was found containing an AppleCare Profile Signing Certificate with organizational unit "Configuration Profiles" - a credential exclusively used within Apple's internal infrastructure. This certificate was used to sign a malicious surveillance profile that captured unredacted Siri and voice telemetry for seven days. The certificate chains to Apple's root CA and is cryptographically valid, confirming it was legitimately issued by Apple's PKI but subsequently stolen or leaked.

Key Findings

1. Internal-Only Certificate on Consumer Device

Subject OU: Configuration Profiles (Apple internal infrastructure only)
Never legitimately deployed to retail iPhones
Used exclusively for enterprise/corporate Apple device management
Presence on consumer device indicates unauthorized deployment

2. Certificate Serial Absent from Public Records

Serial: 0xb745972d0f5e989
SHA-256: EC45F3657DF082E0A230CC9C1DA69B71F7B14790526925A768DA6675AB7BAC8E

Not found in Certificate Transparency logs (expected for internal Apple certificates)
Chains to Apple Root CA (cryptographically valid)
Confirms internal credential, not public-facing certificate

3. Certificate Usage Timeline

Issued: 2023-08-22 16:31:30 GMT
First observed use: 2025-11-27
Status: Valid through 2026-08-21

Malicious Surveillance Payloads

Profile Structure

Profile UUID: 50C237AB-E7E6-4014-BD62-2F204DC6FAA1
Identifier: com.apple.assistant.speech_logging
Organization: Apple Inc. (spoofed)
Installed: 2025-11-27T13:26:58Z
Removed: 2025-12-04T13:26:54Z
Duration: Exactly 7 days

Payload 1 - VoiceServices Logging

UUID: CCCDC519-2EA7-4A1D-93B6-DD4F026F6629
Subsystem: VoiceServices
Level: Debug (7 - maximum verbosity)
Privacy: PUBLIC (unredacted)
Persist: TRUE

Payload 2 - Siri Subsystems Logging (28 Components)

UUID: 2cb17420-1f7a-012e-6679-442c03067622
Subsystems:
  - com.apple.siri.homecommunication
  - com.apple.siri.request_dispatcher
  - com.apple.sirinaturallanguageparsing
  - AnnounceTelephony (phone call transcripts)
  - SiriAudioSupport (audio stream capture)
  - [23 additional internal subsystems]
  
Settings: Debug (7), PUBLIC, Persist
Result: Full voice transcripts, unredacted

Payload 3 - Speech Logging Configuration

UUID: 01BEC389-FD6A-45FA-8AE1-F9442AA43B60
Type: com.apple.defaults.managed
Effect: Speech logging enabled system-wide

Data Captured

All Siri voice commands (unredacted)
Voice transcriptions (PUBLIC = no privacy redaction)
Phone call announcements
Home automation commands
Natural language processing data
Audio streams

Storage location: /var/db/diagnostics/ (persisted for exfiltration)

Significance of Evidence

Evidence	Why It Matters
OU "Configuration Profiles"	Internal Apple credential - never on retail devices
7-day exact surveillance window	Precision timing indicates advanced planning
PUBLIC privacy setting	Disables iOS privacy protections (full unredacted logging)
28 internal Siri subsystems	Configuration impossible without Apple internal knowledge
Clean removal after 7 days	Professional tradecraft, minimal forensic traces
Profile signed with stolen certificate	Only Apple PKI can issue this credential

Conclusion

Certificate is legitimate Apple-issued (not forged)
Certificate was stolen or leaked from Apple's internal PKI
Used for targeted surveillance on consumer device
Requires advanced capability or Apple insider access

Certificate Chain Validation

Apple Root CA
  └─> Apple Application Integration 2 Certification Authority
      Serial: 0x4b9fb65914a9869
      SKID: F7:BE:7C:21:60:91:DB:3D:1B:7B:D8:3A:32:81:69:DF:9E:6C:7F:9B
      └─> AppleCare Profile Signing Certificate (COMPROMISED)
          Serial: 0xb745972d0f5e989
          AKID: F7:BE:7C:21:60:91:DB:3D:1B:7B:D8:3A:32:81:69:DF:9E:6C:7F:9B (MATCH)
          Valid: 2023-08-22 to 2026-08-21
          Status: CRYPTOGRAPHICALLY VALID

Chain validates - this is not a forgery. The breach is theft of legitimate Apple credential, not certificate fraud.

Indicators of Compromise

Certificate Serial:   0xb745972d0f5e989
Certificate SHA-256:  EC45F3657DF082E0A230CC9C1DA69B71F7B14790526925A768DA6675AB7BAC8E
Profile UUID:         50C237AB-E7E6-4014-BD62-2F204DC6FAA1

Critical Indicators

Certificate OU = "Configuration Profiles"
- Only exists in Apple internal infrastructure
- Never ships on consumer devices under any circumstance
Absent from Certificate Transparency logs
- Confirms internal-only status
- Public certificates are always logged; internal certificates are not
Cryptographically valid chain
- Not a forgery or fake certificate
- Real Apple PKI credential that was stolen or leaked
Professional operational security
- 7-day exact surveillance window
- Clean removal with minimal traces
Internal telemetry configuration
- 28 Siri subsystems (requires Apple internal knowledge)
- PUBLIC privacy setting (disables redaction)
- Debug level 7 (maximum verbosity)
- Configuration impossible without insider expertise

There is no benign explanation for this combination of factors.

Impact Assessment

Credential theft: Apple internal PKI compromised
Surveillance capability: Full voice/Siri logging (unredacted)
Operational security: Advanced tradecraft demonstrated
Scope: Unknown - could affect multiple targets

Only Apple can determine:

Who requested certificate serial 0xb745972d0f5e989 on Aug 22, 2023
Whether other certificates from same source are compromised
Full scope of PKI infrastructure breach

Technical Analysis

Certificate Metadata

Subject Distinguished Name:

CN: AppleCare Profile Signing Certificate
OU: Configuration Profiles (APPLE INTERNAL ONLY)
O:  Apple Inc.
C:  US

Issuer Distinguished Name:

CN: Apple Application Integration 2 Certification Authority
OU: Apple Certification Authority
O:  Apple Inc.
C:  US

Certificate Details:

Serial Number (HEX):    0xb745972d0f5e989
Serial Number (DEC):    825382981382564233
Subject Key ID (SKID):  50:1F:B8:13:8C:90:8D:48:84:71:67:CB:F6:8A:D6:0C:06:7E:96:DA
Authority Key ID (AKID): F7:BE:7C:21:60:91:DB:3D:1B:7B:D8:3A:32:81:69:DF:9E:6C:7F:9B

Validity Period:
  Not Before: 2023-08-22 16:31:30 GMT
  Not After:  2026-08-21 16:31:29 GMT
  Current Status: VALID (as of 2025-12-07)

Key Usage (Critical): Digital Signature
Extended Key Usage (Critical): 1.2.840.113635.100.4.16 (Apple Profile Signing)

Certificate Policies:
  Policy: 1.2.840.113635.100.5.1
  CPS: http://www.apple.com/appleca

Public Key: RSA (2048 bit)
Signature Algorithm: sha256WithRSAEncryption

Hashes and Verification

Certificate (DER format):

File: cert_1.der
Size: 1,367 bytes
SHA-256: EC45F3657DF082E0A230CC9C1DA69B71F7B14790526925A768DA6675AB7BAC8E
SHA-1:   1ACD2CAD357E18167FAF30B55EF83CED0997DDD1

Intermediate CA (DER format):

File: cert_2.der
Size: 1,052 bytes
SHA-256: D3496F4B73CD67AAB9F2FCB1D5AA41F8DC457769C455C792B70DDB19E92023D6

Malicious Profile (plist format):

File: profile.stub
Size: 11,918 bytes
SHA-256: 5E85947ADBD3BF4D1F4DB7627FAEE2A96AF4C9DE19F0763BEB4D8BC7570A00DF

Attack Timeline

2023-08-22 16:31:30 GMT
  ↓ Certificate issued by Apple PKI
  ↓ OU "Configuration Profiles" = internal use only
  ↓ Serial: 0xb745972d0f5e989

2025-11-27 13:21:00 UTC 
  ↓ Attack begins - physical or remote access obtained

2025-11-27 13:26:58.446042 UTC
  ↓ Malicious profiles installed (7-minute window)
  ↓ Profile UUID: 50C237AB-E7E6-4014-BD62-2F204DC6FAA1
  ↓ Surveillance begins - all Siri commands logged

[7-DAY SURVEILLANCE WINDOW]
  ↓ Voice commands captured (unredacted)
  ↓ Data exfiltrated
  ↓ Professional operational security maintained

2025-12-04 13:26:54.376820 UTC
  ↓ Profiles removed (exactly 7 days later)
  ↓ Clean removal - no active traces
  ↓ Only stub files remain in logs

2025-12-07
  ↓ Discovery via sysdiagnose analysis
  ↓ Forensic investigation initiated

Key Observations:

Installation window: 7 minutes (professional precision)
Surveillance period: Exactly 7 days (0 hours, 0 minutes)
Clean removal: No active artifacts, only historical logs

Detailed Payload Analysis

Payload 1 - VoiceServices Logging:

UUID: CCCDC519-2EA7-4A1D-93B6-DD4F026F6629
Type: com.apple.system.logging
Subsystem: VoiceServices
Settings:
  - Enable-Logging: TRUE
  - Level: Debug (7 - maximum verbosity)
  - Default-Privacy-Setting: PUBLIC (unredacted)
  - Persist: TRUE
  - TTL: Inherit

Payload 2 - Siri Subsystems Logging (Full List):

UUID: 2cb17420-1f7a-012e-6679-442c03067622
Type: com.apple.system.logging
Subsystems: 28 Siri-related components
  1. com.apple.siri.homecommunication
  2. com.apple.siri.SiriNLUTypes.Serializer
  3. com.apple.siri.marrs.QueryRewrite.CCQRAer
  4. com.apple.siri.request_dispatcher
  5. com.apple.sirinaturallanguageparsing
  6. com.apple.siri
  7. com.apple.siri.marrs.QueryRewrite.RepetitionDetector
  8. com.apple.sirireferenceresolution
  9. CDM.SiriNLUOverrides.AssetManagement
  10. CDM.SiriNLUOverrides.Metrics
  11. CDM.SiriNLUOverrides
  12. CDM.SiriNLUOverrides.Database
  13. CDM.SiriNLUOverrides.Matching
  14. libmorphun
  15. SiriHomeCommunication
  16. SiriPhone
  17. AnnounceTelephony
  18. DEFAULT-OPTIONS
  19. SiriAudioDESPlugin
  20. SiriAudioSupport
  21. AudioFlowDelegatePlugin
  22. SiriAudioInternal
  23. UsoGraphProtoReader
  24. AutoSend
  25. UncertaintyPrompt
  26. common
  27. Utilities
  28. FlowFrameKit
  29. SiriKitFlow
  30. SiriKitExecutor

Settings (ALL subsystems):
  - Enable-Logging: TRUE
  - Level: Debug (7)
  - Default-Privacy-Setting: PUBLIC (UNREDACTED)

Payload 3 - Speech Logging Configuration:

UUID: 01BEC389-FD6A-45FA-8AE1-F9442AA43B60
Type: com.apple.defaults.managed
Settings: Speech logging enabled

Capabilities Granted:

Full Siri voice command logging (unredacted)
Voice transcription capture (PUBLIC privacy = no redaction)
Network communication logging
Home automation commands
Phone call transcripts (Announce Telephony)
Audio stream capture
NLU (Natural Language Understanding) data
All data persisted to /var/db/diagnostics/

Indicators of Compromise (Complete List)

Certificate IOCs:

Serial (HEX): 0xb745972d0f5e989
Serial (DEC): 825382981382564233
SHA-256: EC45F3657DF082E0A230CC9C1DA69B71F7B14790526925A768DA6675AB7BAC8E
SHA-1:   1ACD2CAD357E18167FAF30B55EF83CED0997DDD1
Subject CN: AppleCare Profile Signing Certificate
Subject OU: Configuration Profiles
SKID: 50:1F:B8:13:8C:90:8D:48:84:71:67:CB:F6:8A:D6:0C:06:7E:96:DA
AKID: F7:BE:7C:21:60:91:DB:3D:1B:7B:D8:3A:32:81:69:DF:9E:6C:7F:9B

Profile IOCs:

UUID: 50C237AB-E7E6-4014-BD62-2F204DC6FAA1
Identifier: com.apple.assistant.speech_logging
Display Name: Siri Logging
Payload UUIDs:
  - CCCDC519-2EA7-4A1D-93B6-DD4F026F6629
  - 2cb17420-1f7a-012e-6679-442c03067622
  - 01BEC389-FD6A-45FA-8AE1-F9442AA43B60

Raw Certificate Data (PEM Format)

Certificate 1 (Stolen AppleCare Certificate):

Certificate 2 (Intermediate CA):

Summary

Critical Observations

Certificate is legitimate, not forged
- Valid Apple PKI chain
- AKID/SKID match confirmed
- Signature cryptographically verified
- This is a real Apple credential
Certificate should not exist on consumer devices
- OU "Configuration Profiles" = Apple internal only
- Used for enterprise/corporate profile management
- Never deployed to retail iPhones
- Presence indicates unauthorized deployment
Absence from CT logs confirms internal status
- Public certificates appear in CT logs
- Internal certificates (like this) are not logged
- CT absence + device presence = breach
Certificate was stolen or leaked from Apple
- Issued Aug 22, 2023 by Apple PKI
- Used Nov 27 - Dec 4, 2025 for surveillance
- Only Apple can trace who obtained this certificate
Professional operation
- Precision timing (7-day exact window)
- Clean removal (minimal forensic traces)
- iOS expertise (profile payloads configuration)
Attribution path: Apple PKI logs
- Serial 0xb745972d0f5e989 is the key identifier
- Apple internal logs track certificate requests and approvals
- Only Apple can identify who requested this certificate

15 KiB Raw Permalink Blame History