Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking through some log files today I found something strange :

TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4629 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4930 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.248 -
TCP_MISS/200 5206 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.248 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 1041 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 1057 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 22836 CONNECT init.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 22868 CONNECT init.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 5155 CONNECT xp.apple.com:443 - HIER_DIRECT/17.154.66.107 -
TCP_MISS/200 5155 CONNECT xp.apple.com:443 - HIER_DIRECT/17.154.66.107 -

Apparently api.smoot.apple.com is used for Spotlight search suggestions in Yosemite, except during the timeframe the log was taken I didn't even pull down on my home screen to open the search, and the spotlight suggestions are disabled in the phone's search settings - for the other hosts they are linked to iTunes but no info on what they do exactly...

I did some testing and it seems like every time I unlock my phone after a bit of inactivity, or shortly after I lock it again a request to that host is fired and gets a response with an average size of 5kb...

All these URLs were called when the device was idle, freshly unlocked and on the home screen with no apps in background.

Can anyone shed some light on this ?

share|improve this question
    
Sadly, those could all be different settings. Automatic software update checks, Xprotect checks, iTunes and iBooks automatic download checks, sharing diagnostic information to Apple and third party developers - each of which has different settings to opt in/out of. – bmike Nov 20 '14 at 19:01
    
I'd recommend installing Little Snitch and blocking everything which is not obviously necessary and then check if any relevant functionality is impacted. – oarfish Nov 20 '14 at 19:25
    
what does it read when you use Siri? #siriProxy – Phill Pafford Nov 21 '14 at 3:19
1  
Your iPhone is not "secretly" talking to these hosts or they wouldn't be appearing in the logs. – tubedogg Nov 21 '14 at 8:11
1  
@tubedogg they appear in a proxy's log, on the device itself there are no traces of these requests... I'd call that quite secret. – user56648 Nov 21 '14 at 13:05

Regarding api.smoot.apple.com, from Hacker News. Note this is regarding Yosemite, but I would imagine it similarly applies to Mobile Safari on iOS, especially since the hostname is the same (emphasis mine):

There are two "Spotlight Suggestions":

  • "Spotlight Suggestions" in Safari
  • "Spotlight Suggestions" in Spotlight

Both query the same servers, both use the same name, and both return the same information.

A reasonable person might believe that, having followed Apple's instructions for disabling "Spotlight Suggestions" (the Spotlight kind), they'd disabled "Spotlight Suggestions" (the Safari kind) -- especially if you didn't actually see any suggestions appear in Safari (I didn't!).

Mark Rowe, Safari developer at Apple: "That’s probably a fair complaint." https://twitter.com/bdash/status/524005838743035904

...

The network query posted here is actually a search metrics POST, not a live search query, and it's used as metrics for local and remote search performance.

share|improve this answer

I think this is just Apple's remote keylogger service. I imagine iOS devices behave the same as OS X. On OS X, every single keypress is sent to api.smoot.apple.com along very accurate longitude and latitude and device information.

It might be a little fuzzy, but you can see in the screen capture below that with each keypress there is a GET request that carries this information to Apple. At the immediate instant that you start searching your computer, typing characters, each character you type is sent to Apple. On the final request the full string is sent. Besides the keylogging, you can also see that your exact location as you type is sent.

On your local network, you can try and block this. I doubt that you can regain any privacy if you're using a mobile device. Might be best to just use these platforms for play and not private personal things like health or sensitive business information.

enter image description here

share|improve this answer
1  
Just to clarify, every single keypress while searching your computer and apparently your iPhone is sent to Apple. – Michael Prescott Sep 14 '15 at 2:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.