From ae09408a617be94059908592ac7fd1cd4376c2b8 Mon Sep 17 00:00:00 2001
From: JGoyd <josephgoyd@proton.me>
Date: Tue, 19 Aug 2025 16:20:38 -0400
Subject: [PATCH] README.md

---
 README.md | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f8c04af
--- /dev/null
+++ b/README.md
@@ -0,0 +1,94 @@
+# Silent TCC Bypass & Undocumented Data Flow in iOS 18.6
+
+**Author**: Joseph Goydish  
+**Date**: August 19, 2025  
+**Affected Versions**: iOS 18.6+ (Confirmed: iPhone 13–15)  
+**Access Required**: Physical device (no jailbreak or exploit)  
+**Detection Method**: Native system logs (`log collect`, `Console.app`, `sysdiagnose`)  
+
+---
+
+##  Summary
+
+This report documents **undocumented system behavior** observed in iOS 18.6, where trusted Apple daemons:
+
+- **Bypass TCC (Transparency, Consent, and Control)** to access protected data (e.g. Reminders)
+- **Write to sensitive preference domains** related to photo/comms safety without user interaction
+- **Transmit network data** (~5MB) silently via system daemons
+- Do so with **no app context**, **no user prompt**, and **no visibility** in UI or privacy settings
+
+---
+
+##  Key Findings
+
+- `tccd` silently accessed `kTCCServiceReminders` (Reminders) with `preflight=yes` and no client app
+- `abm-helper`, `CommCenterRootHelper`, `cfprefsd`, and others activated Mach/XPC communication
+- `sosd` attempted writes to `com.apple.messages.commsafety.plist`
+- `nsurlsessiond` and `symptomsd` coordinated silent upload/download (~5MB over 2s)
+
+This behavior violates the assumptions behind Apple's TCC privacy framework and is **not disclosed** in Apple’s documentation.
+
+---
+
+##  Reproduce It Yourself
+
+### Requirements
+- iPhone running **iOS 18.6**
+- macOS with Apple **Console.app**
+- USB cable (no jailbreak required)
+
+### Steps
+
+1. Connect your iPhone via USB
+2. Run the following command in Terminal:
+    ```bash
+    log collect --output ~/Desktop/ios18_logs.logarchive
+    ```
+3. Open `Console.app`, load the `.logarchive`
+4. Filter logs by:
+    - `tccd`
+    - `cfprefsd`
+    - `sosd`
+    - `abm-helper`
+    - `nsurlsessiond`
+    - `symptomsd`
+5. Look for:
+    - `preflight=yes` (TCC)
+    - Writes to `com.apple.messages.commsafety`
+    - Silent network traffic (`rx`/`tx`) within seconds
+
+---
+
+##  Why It Matters
+
+- **No UI prompt, no app context** = user has no way to see or deny access
+- **TCC is silently bypassed**, violating Apple’s stated privacy guarantees
+- **EDR/MDM cannot detect this** — trusted daemons execute the chain
+- **Forensics and red teams** must rely on logs — not standard analytics
+
+---
+
+##  Recommendations
+
+- Monitor system daemon activity with periodic `log collect` analysis
+- Alert on unauthorized TCC access or daemon write attempts
+- Increase transparency from Apple on system-internal privacy behavior
+
+---
+
+##  Resources
+
+- [Apple TCC Framework](https://developer.apple.com/documentation/bundleresources/entitlements)
+- [iOS Privacy & Security Guide (PDF)](https://www.apple.com/privacy/docs/iOS_Security_Guide.pdf)
+
+---
+
+##  License
+
+This research is provided for forensic, academic, and security awareness purposes only.  
+No reverse engineering or binary tampering was performed.
+
+---
+
+>  *“The privacy model we trust is bypassed by the operating system itself.”*
+