Posts

Showing posts from September, 2011

iPhone's Persistent Connection to Apple

I recently noticed that iOS MDM servers have the ability to connect to phones and initiate checkins even when a device is connected to WiFi. Packet analysis showed absolutely no communication between Apple PUSH service or MDM servers with the phone. On the contrary, the transaction was always magically initiated by the iOS device. How could this happen?

As we know, iOS devices have 2 NIC's - one for WiFi and the other for 3G communication. On further analysis, I was able to observe that even though the device switched over to the WiFi network, the 3G network interface of the device was still active in the background and maintained a persisten connection to apple PUSH servers at port 5223. Hence, whenever Apple or MDM servers wanted to send a PUSH notification, the notification was sent over 3G and in response the device responds back over WiFi.

A simple netstat on the device reveals the following:


netstat -a
tcp4 0 0 10.XXX.XXX.XXX.4XXXXnk11p01st-courie.5223
ESTABLISHED

The 3G/Edge netw…