1

On a new test iMac (running Mavericks 10.9.2) I discovered 2 repeated errors related to apsd (Apple Push Notification Service daemon).

Repeated failing connections

A netstat command displays a huge number of not correctly terminated tcp connections. All these dead connections are toward a domain at Apple, and using port 5223/tcp.Actually I have 400 of them:

$ netstat -An 
Active Internet connections
Socket           Flowhash Proto Recv-Q Send-Q  Local Address      Foreign Address    (state)    
[...]
ffffff8024040d88 c23b1438 tcp4       0      0  •••.My_IP.••.50929 17.149.36.133.5223 ESTABLISHED
ffffff8022ef8d88 31793d40 tcp4       0    106  •••.My_IP.••.50604 17.149.32.8.5223   FIN_WAIT_1 
ffffff8022cc2d88 c977e8ee tcp4       0    143  •••.My_IP.••.50491 17.172.232.142.522 FIN_WAIT_1 
[...]

Repeated invalid certificates

Every each 90 minutes, apsd is telling it can't recognize a certificate. A large grep on system.log logs display this repeated error:

$ zgrep apsd /var/log/system.log.[0-6].gz
[...]
/var/log/system.log.0.gz:May 25 00:48:01 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
/var/log/system.log.0.gz:May 25 02:18:22 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
/var/log/system.log.0.gz:May 25 03:48:44 ••.My_name.My_domain.•• apsd[106]: Unrecognized leaf certificate
[...]

Related documentation

I found here the way to shut up this daemon:

How to disable Apple Push Notification Service (apsd) on OS X 10.8?

I didn't find here any explanation on how this daemon is working, how it is started or stopped:

man apsd

I found here a correct explanation of the behaviour of apsd seeing a wrong certificate:

Unrecognized leaf certificate.

Questions

This daemon is clearly misbehaving and typical of many security problems (bad connection, bad certificate validation, data leak…).

How should this daemon work?
Which service is it useful to?
Is this daemon functioning with these repeated misbehaviours?
How may I check it?
How might I have fired this misbehaving daemon?
And finally, shouldn't I stop it definitively?

Improve this question
1
  • → George: thank you for your improvments:). Could you tell me why something as plain stupid as <code> doesn't produce a clean output of command lines, log files? – dan May 26 '14 at 15:24
4

The service is used for delivering you push notifications. Push notifications usually appear in the Notification Center in the top right corner of your desktop. Read more about it here:

http://support.apple.com/kb/ht5362

If you disable the service, you'll probably lose notifications for events such as received iMessage-messages, Facetime calls and notification from websites that you have requested notifications from.

From what you write, there does not seem to be a weighty reason for disabling it. It is a normal, system service that should not pose a problem to your system.

The connections in FIN_WAIT_1 state does not pose a problem to your system. You can safely ignore it (in those numbers).

You can also safely ignore the log message. The log message does not indicate that there has been a "data leak" as such.

The reason for the log message is that Apple uses a large number of servers for sending your push notifications. Your computer will connect to a (somewhat) random of those servers. The server will present a generic certificate for the service, and not one customized to the exact "sub-server" you have connected to. That is the cause of the log message. This is something Apple needs to fix on their servers, but it is a known bug and not something you yourself can do anything about.

This does not mean that you lose encryption or anything like that, but it might mean that your system could be vulnerable to a Man-In-The-Middle attack, where you could be sent falsified Push Notifications. Whether that is indeed the case would require further research. It is most likely that Apple employed some sort of certificate pinning or similar to avoid this type of exploit. The likelihood that you should be attacked this way is pretty low anyhow. I.e. don't worry about it.

I don't see why you say the daemon is "misbehaving". It is not misbehaving more on your computer than on any other computer. You could say that it is misbehaving, but it is doing so by Apple's design. So instead, create bug reports with Apple to let them know that you're seeing a problem.

Of course, if you do not actually use Push Notifications for anything, you can safely disable it.

Improve this answer
4
  • apsd is detecting an invalid certificate. Then this daemon acts in either of 2 ways: 1) it does accept an invalid certificate (this is bad, and open it to easy attacks), 2) it doesn't accept an invalid certificate and sends clear data (this is bad: data leak). This isn't just a bug. – dan May 26 '14 at 16:01
  • 1
    I tried to write this in my original reply, but your assumption that the program must work in one of those two ways is flawed. There's simple more options than those two, and this is why I wrote that you need to do more research on how the program actually works, because you can say that there is an "easy attack". The idea that it sends the data in clear text is very ungrounded - that would be extremely unlikely. Normally, if you have a program that complains about a certificate, and you force the connection anyways, it will still be encrypted - you're "just" not certain whom you talk to. – jksoegaard May 26 '14 at 16:52
  • 1
    As I indicated in my original reply, there's more options than simply the two you list. One could be that the program uses certificate pinning (i.e. the program actively checks that the certificate presented by the server is a specific certificate). Another possibility is that the setup uses a longer chain of certificates than usually. I.e. you would have a CA, a cert for the service (which is there things normally stop) - and then that certificate could have been used to sign certificates for the individual servers. That leaf certificate wouldn't validate, but the rest of the chain would. – jksoegaard May 26 '14 at 16:54
  • 1
    As the rest of the chain validates, you're certain you're talking to an Apple server - you just wouldn't know for certain which one. This is "good enough" - but again, I'm stating these as possibilities - not how it is actually done. You need to do research into the specific program to get that information. – jksoegaard May 26 '14 at 16:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .