From e25228287ba5d00db3775ba2cf3653c26959b5ae Mon Sep 17 00:00:00 2001
From: Joseph Goydish II <josephgoyd@proton.me>
Date: Tue, 23 Sep 2025 00:34:59 -0400
Subject: [PATCH] Update Technical Write Up.md

---
 Technical Write Up.md | 104 +++++++++++++++++++++++++++++++++++++++---
 1 file changed, 98 insertions(+), 6 deletions(-)

diff --git a/Technical Write Up.md b/Technical Write Up.md
index c1ba6e1..1532540 100644
--- a/Technical Write Up.md	
+++ b/Technical Write Up.md	
@@ -66,10 +66,102 @@ Key observations from the server response:
   - `CommCenter` modem/network configurations  
 - Profiles/configs applied post-activation without user or MDM actions.
 
-### Safe Triage Commands
-```bash
-# Search response captures for certificate blocks
-grep -R "-----BEGIN CERTIFICATE-----" /path/to/response_captures/
+---
 
-# Look for humbug headers in activation logs
-grep -i "HUMBUG_XHEADER_STATUS" /var/log/mobileactivationd*
+## Suspicious Domains from Modified Plist
+
+Analysis of a tampered provisioning `.plist` file revealed spoofed domain entries under the `CriticalDomains` key:
+
+
+
+- `cheeserolling.apple.com`  
+
+- `woolyjumper.sd.apple.com`  
+
+- `basejumper.apple.com`  
+
+- `basejumper-vip.sd.apple.com`  
+
+- `basejumper.sd.apple.com`  
+
+- `locksmith.apple.com`  
+
+- `gdmf-staging-int.apple.com`  
+
+- `pallas-uat.rno.apple.com`  
+
+- `pr2-pallas-staging-int-prz.apple.com`  
+
+- `livability-api.swe.apple.com`  
+
+- `wkms.sd.apple.com`  
+
+- `wkms-uat.sd.apple.com`  
+
+- `knox.sd.apple.com`  
+
+
+
+---
+
+
+
+## DNS / Resolution Context
+
+During investigation, several of these domains were tested for resolution. Results indicate they are **non-functional or suspicious**:
+
+
+
+- **`basejumper.apple.com`**  
+
+  - No A/AAAA/CNAME records found (per Cloudflare DNS lookup).  
+
+  - Only an SPF-related TXT record was returned, valid for 1 hour.  
+
+  - ➝ Suggests a placeholder/non-routable domain, not an active Apple service.
+
+
+
+- **`locksmith.apple.com`**  
+
+  - Could not be resolved (`HTTP Connect` failure, no DNS resolution).  
+
+  - ➝ Appears unused or intentionally absent from DNS.
+
+
+
+- **`cheeserolling.apple.com`**  
+
+  - Could not be resolved (`HTTP Connect` failure, no DNS resolution).  
+
+  - ➝ Likely a fake or internal-only test entry, not routable externally.
+
+
+
+Other entries (e.g., `pallas-uat`, `wkms`, `knox`) were not resolved during this check but follow similar suspicious naming conventions, hinting at either **staging/internal use only** or **fabricated values for tampered plist injection**.
+
+
+
+---
+
+
+
+## Contextual Interpretation
+
+- These spoofed or non-resolving domains **should not normally appear** in device provisioning flows.  
+
+- Their presence indicates the plist was **modified to insert unauthorized endpoints**, expanding the potential attack surface.  
+
+- Even if non-routable externally, such injected domains could be abused in **enterprise or captive environments** where DNS is controlled.  
+
+- This reinforces the risk: unauthenticated plist injection allows attackers to redefine “critical domains” in the activation workflow.  
+
+
+
+---
+
+
+
+## Conclusion
+
+The vulnerability in Apple’s activation backend, coupled with evidence of tampered plist files containing suspicious/unresolvable domains, demonstrates the feasibility of **pre-activation trust boundary manipulation**. Attackers could exploit this weakness to silently alter provisioning logic, introduce rogue network policies, and undermine enterprise security controls before the device reaches the user