Create README.md

README.md

@@ -0,0 +1,31 @@
+# Apple iOS Activation Infrastructure Vulnerability
+
+## Summary
+A **critical vulnerability** in Apple’s iOS activation backend allows injection of unauthenticated XML `.plist` payloads during the device setup phase.  
+The flaw permits arbitrary provisioning changes without authentication, signature verification, or error feedback — exposing devices to **pre-activation tampering** and **persistent configuration manipulation**.
+
+---
+
+## Affected Product
+- **Vendor:** Apple  
+- **Product:** iOS Activation Infrastructure  
+- **Endpoint:** `https://humb.apple.com/humbug/baa` (Apple internal)  
+
+---
+
+## Core Issue
+- The server at `https://humb.apple.com/humbug/baa` accepts unauthenticated XML payloads.  
+- This enables **silent provisioning changes** during activation.  
+- **Impacts include:**
+  - Modem configuration  
+  - CloudKit token behavior  
+  - Carrier-level protocol enforcement  
+
+⚠️ No jailbreak, malware, or user interaction required.
+
+---
+
+## Implications
+- **Supply chain compromise potential**  
+- **Bypasses enterprise MDM and hardening policies**  
+- **Persistent, pre-user compromise vector** during the trusted setup phase