IPhone – iPod app of the iPhone connecting to internet

iphoneipod.app

On iPhone 4 IOS 4.3.5, if I start playing music the iPod app is getting or sending information from internet.

To reproduce it :
kill the ipod app using the "taskbar"
then play some music
your will notice the turning "wheel" of data transfer during a few seconds

I am not using Genius or Ping.
I have already the song cover.
I don't have any vocals

Do you have an idea of what kind of info is sent or received ?

Update : I am trying to connect through fiddler on my PC
Fiddle is acting as a proxy and will let me inspect the data
BUT the wifi proxy settings is returning from manual to disabled all the time !

Best Answer

The iPod app is contacting iTunes server to get some encrypted keys. Three of them actually, respectively called "signature", "certs" and "bag". All of them are part of an xml (plist) file located at http://ax.init.itunes.apple.com/bag.xml?ix=2.

There's no POST data, just some cookies and HTTP headers giving information about the device and the context. These informations are part of many request made to Apple servers by iOS.

I have no idea what this "bag" can be nor what it's used for.

Details

Here's the request headers :

User-Agent : iTunes-iPhone/4.3.4 (4; 32GB)
Accept-Language : fr;q=1.0,en;q=1.0[...]
X-Apple-Store-Front : [cut]
X-Apple-Connection-Type : WiFi
X-Apple-Cuid : [cut]
X-Apple-Software-Cuid : [cut]
X-Dsid : [cut]
X-Apple-Client-Application : MediaPlayer
X-Apple-Client-Versions : iBooks/1.3

The cookies names :

mz_at1
s_vi
dssid2
mz_pc
mz_at0
ds01_a
Pod
s_vnum_us
s_vnum_befr
mz_if
mz_pt
a
s_vnum_fr
s_cvp35b

And the XML scheme :

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"> 
    <dict> 
        <key>signature</key>
        <data>[encrypted string]</data> 
        <key>certs</key> 
        <array> 
            <data>[encrypted string]</data> 
        </array> 
        <key>bag</key>
        <data>[VERY long encrypted string]</data> 
    </dict> 
</plist>

The "certs" part seems to be constant, even with a standard browser and none of the special HTTP headers or cookies.

(I don't want to publish too many details as I don't know what they contain about me or my Apple ID.)

Related Question