10

Looking through some log files today I found something strange :

TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4629 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.253 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4930 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4931 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.250 -
TCP_MISS/200 4656 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.248 -
TCP_MISS/200 5206 CONNECT api.smoot.apple.com:443 - HIER_DIRECT/17.252.11.248 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 1041 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 6959 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 1057 CONNECT bookkeeper.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 22836 CONNECT init.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 22868 CONNECT init.itunes.apple.com:443 - HIER_DIRECT/23.217.226.217 -
TCP_MISS/200 5155 CONNECT xp.apple.com:443 - HIER_DIRECT/17.154.66.107 -
TCP_MISS/200 5155 CONNECT xp.apple.com:443 - HIER_DIRECT/17.154.66.107 -

Apparently api.smoot.apple.com is used for Spotlight search suggestions in Yosemite, except during the timeframe the log was taken I didn't even pull down on my home screen to open the search, and the spotlight suggestions are disabled in the phone's search settings - for the other hosts they are linked to iTunes but no info on what they do exactly...

I did some testing and it seems like every time I unlock my phone after a bit of inactivity, or shortly after I lock it again a request to that host is fired and gets a response with an average size of 5kb...

All these URLs were called when the device was idle, freshly unlocked and on the home screen with no apps in background.

Can anyone shed some light on this ?

  • Sadly, those could all be different settings. Automatic software update checks, Xprotect checks, iTunes and iBooks automatic download checks, sharing diagnostic information to Apple and third party developers - each of which has different settings to opt in/out of. – bmike Nov 20 '14 at 19:01
  • I'd recommend installing Little Snitch and blocking everything which is not obviously necessary and then check if any relevant functionality is impacted. – oarfish Nov 20 '14 at 19:25
  • what does it read when you use Siri? #siriProxy – Phill Pafford Nov 21 '14 at 3:19
  • 2
    Your iPhone is not "secretly" talking to these hosts or they wouldn't be appearing in the logs. – tubedogg Nov 21 '14 at 8:11
  • 2
    @tubedogg they appear in a proxy's log, on the device itself there are no traces of these requests... I'd call that quite secret. – user56648 Nov 21 '14 at 13:05
6

Regarding api.smoot.apple.com, from Hacker News. Note this is regarding Yosemite, but I would imagine it similarly applies to Mobile Safari on iOS, especially since the hostname is the same (emphasis mine):

There are two "Spotlight Suggestions":

  • "Spotlight Suggestions" in Safari
  • "Spotlight Suggestions" in Spotlight

Both query the same servers, both use the same name, and both return the same information.

A reasonable person might believe that, having followed Apple's instructions for disabling "Spotlight Suggestions" (the Spotlight kind), they'd disabled "Spotlight Suggestions" (the Safari kind) -- especially if you didn't actually see any suggestions appear in Safari (I didn't!).

Mark Rowe, Safari developer at Apple: "That’s probably a fair complaint." https://twitter.com/bdash/status/524005838743035904

...

The network query posted here is actually a search metrics POST, not a live search query, and it's used as metrics for local and remote search performance.

  • Your last line is confusing. An HTTP POST of any sort provides the server with information even if the payload is empty; however, as I've noted the GET requests themselves are not empty at all. Each letter that a user taps or keyboard key pressed carries that letter, plus longitude and latitude, along with other network information to Apple. That seems very "live" to me. Would you please clarify what you mean by "not a live search query". It seems to diminish this issue or at least inaccurately describes it. – Michael Prescott Dec 12 '17 at 1:08
  • @MichaelPrescott My comments are copied and pasted from the post linked, which in turn links to this gist. That is the "network query" being referred to. It is not live in that it is not obtaining results from Apple, rather it is being used for "metrics for local and remote search performance" as stated. – tubedogg Dec 13 '17 at 20:50
5

I think this is just Apple's remote keylogger service. I imagine iOS devices behave the same as OS X. On OS X, every single keypress is sent to api.smoot.apple.com along very accurate longitude and latitude and device information.

It might be a little fuzzy, but you can see in the screen capture below that with each keypress there is a GET request that carries this information to Apple. At the immediate instant that you start searching your computer, typing characters, each character you type is sent to Apple. On the final request the full string is sent. Besides the keylogging, you can also see that your exact location as you type is sent.

On your local network, you can try and block this. I doubt that you can regain any privacy if you're using a mobile device.

local machine medical records

Update: October 14, 2016 I check on this problem ever so often. As of this date and macOS Sierra version 10.12, it is still transmitting abundant data via GET HTTP requests on each keystroke, including precise latitude and longitude, live, for local machine searches. I do wish there was full disclosure so that all users were made fully aware of how invasive this feature can be and clear options for either disabling it or even better, making it so that data is only sent when explicitly chosen to send. While it might be a minor inconvenience if a user opted to do so, it would be just great if we could click a button or hit tab to perform a search via the web vs our local machines.

local document credit card numbers

  • 3
    Just to clarify, every single keypress while searching your computer and apparently your iPhone is sent to Apple. – Michael Prescott Sep 14 '15 at 2:40
  • Why do they need the lat and long? Seems irrelevant to making searches better – Kolob Canyon Oct 27 '16 at 4:24
  • I doubt that recording that much information in realtime about so many people, so many devices, is just for improving searches. The possibilities are limited only by imagination. What would you do if you had access to a system that could pinpoint any device, any person, with a record of most everything they use their phone or computer to do? Post advertisements just for that person, improve their search results, help them find a restaurant, steal business plans, stalk them. People should be able clearly see when and what their devices are doing and be able to stop it without a CS degree. – Michael Prescott Nov 10 '16 at 21:56
  • What is this tool you are using? – hello_harry Aug 13 '17 at 15:37
  • @hello_harry "Charles Proxy" – Michael Prescott Aug 23 '17 at 22:33
1

api.smoot.apple.com is another norm in the industry. It does quite a few things like most vendor api's do. Its used to assist users and make their lives easier by providing suggestions, advertisements, and whatever the vendor deems appropriate.

However, no vendor is a saint and Apple is no different; its a business. If that includes using your network to transmit your data to them in aggregate or by keystroke, then they have no reason not to put themselves in the pipeline to collect and use what they deem appropriate.

It is the same with Google. In Chrome's settings, you can disable everything, but you can not prevent it from communicating with its API. I tested a few months ago and Chrome would not render a single webpage i put in the address bar if i blocked the google api. If I have turned all those settings off, what is being sent to Google? So, Chrome has already forced itself into user's data pipeline. It is by definition a trojan, but lets not start name-calling. The industry trend started many years ago.

Intel WiDi...I really need to connect to the Intel api every time I launch WiDi on my PC...really Intel? I could not opt-out of the auto-updater?

Microsoft Windows 10...just try to stop it from changing itself to facilitate "security" or collection of data regarding your desktop environment. You agreed to allow it when you installed Windows.

In fairness to app vendors, it is the norm and users allow it because they want the functionality. A legitimate app wont install unless users agree to whatever permissions the app says it needs. No one bothers to look at all that because, hey, I need a flashlight app right now; who cares if it requires permissions to read my text messages and read my SD card...in order for me to install it...so I can use my camera flash like a flashlight right now. Most apps are up front with their permission requirements...most users just don't care; make what i want happen right now.

And just to clarify, Michael Prescott's post above about "while searching"...do you think your phone keyboard, which is used for text messages and every other app on your phone does not communicate with an api? (Android or Apple device immaterial)

In order to trend a user and correlate patterns vendors can use, vendors need to uniquely track users for targeted marketing before they depersonalize it...conveniently, a user's OS (apple or windows) has an advertisement id enabled automatically...

  • We probably should be "name calling". It is most definitely a keystroke logger and I agree, it is probably fair to classify as a trojan as well. People need to understand the extent of this, and even more so, the dangers. Downplaying it as if it is an acceptable norm doesn't help. There is no reason for a company or hacker to embed keystroke loggers, capture, and transmit ALL interactions with a device along with geographic and network data. If it was an individual doing it, we'd be talking about the criminality of it, not the RESTful APIs, data pipelines, other technical babble. – Michael Prescott Nov 23 '17 at 15:14
  • I really like your answer, but I definitively disagree on "users allow it because they want the functionality". I don't want. And I don't want things to be done behind my back. Sadly " it is the norm" but It shouldn't and it wouldn't if users would actually have a choice. – digitaldonkey Feb 16 at 16:46

You must log in to answer this question.