12 ms·
Apple AirDrop shares more than files
- anfilt 6y ago2019 WTF... Really well hopefully that this gets more public that motivates some action.
- random5634 6y agoFor most people this is not a big issue
- Spivak 6y agoWhich is fair but someone motivated, say a vendor that sells those "track customers in your store with bluetooth/Wi-Fi" adds support for this. Sure it's relatively low signal but it also costs nothing.
- e2le 6y agoYep, it's being known about for a while. https://github.com/hexway/apple_bleee/tree/master/hash2phone https://github.com/hexway/apple_bleee/tree/master/hash2phone
- auslegung 6y agoWhat do you think about editing the title to indicate AirDrop has security issues? When I clicked I thought it was going to be about what all I can share using airdrop lol
- the_other 6y agoI guessed it could go either way. I only clicked through to find out if it was less dry than a security issue!
- heavymark 6y agoInteresting. I just read the title and assumed it was talking about security issues. Since we all know AirDrop can share files (what it was intended for), presumed this meant it's also sharing some data/privacy issues unbeknownst to us.
- saurik 6y agoI even work in the field of security most of the time, and while I suspected it might have something to do with security, I assumed that even then it was going to be someone who simply was annoyed you could send an executable or a PDF with an exploit over AirDrop, as opposed to metadata ;P.
- Gaelan 6y agoIt can also share, at minimum, URLs.
- Koliakis 6y agoI felt the title was too ambiguous. The only reason why I assumed it was about security is because I looked at the source URL.
- xeromal 6y agoI definitely thought the same thing! haha
- throw14082020 6y agoI would prefer to just link to https://privatedrop.github.io/ https://privatedrop.github.io/ It lists 2 vulnerabilities: Sender Leakage and Receiver leakage. The files are not at risk, its your phone number and apple ID. Or alternatively, Maybe rename to: Apple AirDrop reveals mobile number and email
- kbenson 6y agoLooking at the article I would say the actual title presented is "Apple AirDrop shares more than files: TU-Researchers discover significant privacy leak in Apple's file-sharing service", but that's a bit long for a HN title. I'm not sure what the policy is on using the subtitle (TU-Researchers discover significant privacy leak in Apple's file-sharing service) if it's more descriptive, but I think it would make sense in this case.
- leifg 6y agoApple hasn’t responded to responsible disclosure for 2 years?
- ProAm 6y agoThey do not earn 30% on security issues.
- jqpabc123 6y agoExactly! And for the same reason, they don't spend much time scanning apps in their app store either. https://www.forbes.com/sites/kateoflahertyuk/2019/01/07/these-14-apple-apps-could-pose-a-big-security-risk/?sh=4a1af54bcd6e https://www.forbes.com/sites/kateoflahertyuk/2019/01/07/thes...
- zepto 6y agoDo you think they think that bad publicity is good for their reputation?
- jqpabc123 6y agoRepeated incidents of malware doesn't seem to have hurt them much yet so until it does, don't expect them to look too closely at apps in their store. https://techcrunch.com/2020/08/31/apple-notarized-mac-malware/ https://techcrunch.com/2020/08/31/apple-notarized-mac-malwar...
- bla3 6y ago> studies by TU researchers at the Department of Computer Science show that uninvited people can also tap into data. Cool. Security research is important. > The research team developed a solution that could replace the flawed AirDrop. Wait, what? Nobody will want to install some third-party tool over this.
- lathiat 6y agoThe way I read it their implementation was more of a proof of concept of a better privacy preserving system that works in the same way. Rather than a separate app.
- lorenzfx 6y agoI would actually love a similar (open source) system, that is working cross-platform. EDIT: I just found snapdrop [1], but haven't given it a try yet. [1] https://github.com/RobinLinus/snapdrop https://github.com/RobinLinus/snapdrop
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- random5634 6y agoThis only is a risk when you open the share pane close to your attacker. Your email and phone number may be less secret than these folks claim . But aside from this overhype interesting work.
- guipsp 6y agoI, as a user, don't expect my phone number and email do be shared automatically when I open the share pane.
- random5634 6y agoNot that many users expect to sit next to an attacker running this system AND be sharing something. No question should be fixed - but compared to the rce s Apple has had (which do get fixed quickly) this is relatively lower risk
- kevincox 6y agoWhy not? I meet my friends for lunch and want to send them some photos while sitting in the restaurant? This seems like a very plausible scenario and most users would not expect and would not want everyone in the restaurant to be able to see their email and phone number.
- coder543 6y agoThe implausible part is not having lunch with friends, although the pandemic has made that feel less plausible than it used to be... but rather, having an attacker actively running an attack within 10s of feet of your table at the restaurant. What is your threat model that makes this plausible?! You must be super important to have attackers following you to lunch. Or maybe you like to eat at restaurants that do their best to harvest all visitor data, even going so far as to use cutting edge vulnerabilities? The person you replied to literally said this should be fixed. I agree with them that this is nowhere near as serious as issues Apple has had before, since the attack requires physical proximity and the use of the share pane. Even then, it doesn’t give the attacker RCE privileges or anything similarly world shaking. Should Apple fix it? Again, absolutely. No one has said otherwise. Nothing is 100% secure, so the relative risk posed by vulnerabilities can only really be assessed with a threat model. In most threat models, this is nowhere near as bad as their “GOTO Fail” bug or any number of others over the years. I think celebrities and VIPs are essentially the only ones whose threat models would actually be impacted by this vulnerability in a plausible way.
- danaris 6y agoTL;DR: If you're using an Apple device with AirDrop, and have the share sheet open for something that would be shareable with AirDrop, a malicious device within ~30ft of you could start attempting to brute-force the hashes of contacts your device exposes to determine whether the other device is a contact. (The contact exposure is in support of a setting for AirDrop to work with Everyone, Contacts Only, or No one.) While it's certainly a bit concerning, it's pretty unlikely to be a practical attack, particularly since all it does is get you the user's contact list. It doesn't sound like there's any way of using it to exfiltrate other information, and though the article doesn't touch on this (that I saw) I'd be surprised if the attack was fast enough to just gulp down all your contacts in the couple of seconds most people have their share sheets open.
- djrogers 6y ago> since all it does is get you the user's contact list. It’s not even that - all it gets is the phone number associated with your personal contact card.
- grupthink 6y ago> I'd be surprised if the attack was fast enough to just gulp down all your contacts in the couple of seconds most people have their share sheets open. No, with the share sheet open, the attacker can simply record the hashes of phone numbers that are being broadcasted. And then crack the hashes off-line at any time, which is easy since there are at max 999-999-9999 hashes.
- zimpenfish 6y ago> since there are at max 999-999-9999 hashes Assuming that's meant to represent 10 digits, it's not sufficient. My phone number is one longer than that (11 digits). If you drop the 0 prefix and use +44 instead, that'll be 12 digits (or 13 if you include the + but you could specify that as always present.) (A minor nit since it only increases the search space 10x or 100x which probably doesn't make a huge impact?)
- 6y ago
- kuu 6y agoTL/DR: "As an attacker, it is possible to learn the phone numbers and email addresses of AirDrop users – even as a complete stranger. All they require is a Wi-Fi-capable device and physical proximity to a target that initiates the discovery process by opening the sharing pane on an iOS or macOS device."
- scotchmi_st 6y agoOne explanation is that Apple has sat on this for 2 years, knowing this is a serious security bug. Another explanation is that they just don't think it's that serious. The article states- > The discovered problems are rooted in Apple's use of hash functions for “obfuscating” the exchanged phone numbers and email addresses during the discovery process. However, researchers from TU Darmstadt already showed that hashing fails to provide privacy-preserving contact discovery as so-called hash values can be quickly reversed using simple techniques such as brute-force attacks. The post that they then linked to is about how, by hashing random phone numbers, you can effectively de-anonymise users of popular messaging apps. So you'd need to be in physical proximity to the person, and what you're getting is details like your phone number which aren't especially private anyway (they literally need to be given to people to be of any use). It's far from the dragnet-level issue facing Signal & Whatsapp and others. I don't know, but that doesn't seem like an especially serious issue to me. It seems just like a research group trying to make some hype for themselves.
- deleted 6y ago[deleted]
- ryanwhitney 6y agoNot sure how much is required to brute force these, but AirDrop has been used in notably sensitive situations like the Hong Kong protests[1], where I’m sure anonymity was assumed. Proximity doesn’t mean I would like to share my phone number. Seems like an unlikely attack day-to-day, but one with definite privacy and personal safety concerns. 1: https://qz.com/1660460/hong-kong-protesters-use-airdrop-to-breach-chinas-firewall/ https://qz.com/1660460/hong-kong-protesters-use-airdrop-to-b...
- scotchmi_st 6y agoIf the state where you live wants to know if you've been at a protest, they have more efficient ways of figuring that out than sending someone out to walk around, trying to collect AirDrop IDs. That should be the least of your worries. I mean sure, I'm not saying there's no issue here. But it certainly isn't 'huge' either.
- bionade24 6y agoSeems like Apple completely ignored that inside a country the first three digits are guessable and the hashed string has a defined length, which makes hash cracking a lot easier.
- crazygringo 6y agoSo this appears to require brute-forcing through every possible hash to see which ones match. How long would this take? I mean, is the person's iPhone going to respond to all 10 billion possible domestic US phone numbers in the, what, 3-10 seconds they have their share sheet open? Not to mention the far larger space of e-mail addresses, ultimately limited by whatever the hash length is? Unless the AirDrop protocol is permitting the validation of many millions of hashes per second (presumably requiring 100mbps+ speed), this doesn't appear to be even remotely a viable attack method in practice, no?
- Someone 6y agoI think the attack is: - mass record all these requests - offline, recover the phone numbers or email addresses ⇒ you know who was where, when.
- jmull 6y agoThat attack doesn't fit this vulnerability. The target has to open the sharing pane on their phone while the attacker is in proximity. That probably effectively stops "mass" attacks.
- captn3m0 6y agoI felt like I've read this vulnerability described before. Found this from 2 years ago: https://arstechnica.com/information-technology/2019/08/apples-airdrop-and-password-sharing-features-can-leak-iphone-numbers/ https://arstechnica.com/information-technology/2019/08/apple... Research links: https://hexway.io/research/apple-bleee/ https://hexway.io/research/apple-bleee/ https://arxiv.org/pdf/1904.10600.pdf https://arxiv.org/pdf/1904.10600.pdf https://www.usenix.org/system/files/sec19fall_stute_prepub.pdf https://www.usenix.org/system/files/sec19fall_stute_prepub.p...
- ergl 6y agoThe issue with phone number hashes has been known for a while. See for example this post by Project Zero[0] where they leverage the issue (search for "Enabling AWDL") to remotely activate airdrop. [0]: https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-c...
- johnklos 6y agoDetails are nice. Sure, I'll take your statement that AirDrop hashes aren't as robust as they should be at face value, but I'm going to need you to provide more information. Of course, the PDFs have this, but the article would do well to better summarize. If a brute-force requires multiple 500 watt GPUs in order to brute force in real time, I'd like to know. This is vastly different than if it can be done on a laptop's GPU. If hashes can be cracked later offline with 100% certainty, I'd like to know, since a malicious device can just collect hashes simply by traveling around a city. But if the brute forced hashes need to be confirmed with the other AirDrop device in real time, else you don't know which of dozens, hundreds, or thousands of results you might get, then this is mostly a non-issue.
- eptcyka 6y agoWhats _multiple_? If it takes 20 high end Tesla to crack this real-time, a desktop could feasibly brute force the hashes in hours, and a laptop could do so in a day. This is good enough for targetted attacks to be practical.
- mstute 6y agoThere is no need to brute force. We can build a rainbow table with valid phone numbers, which we can use to lookup a phone number hash in real time (about 50ms on a regular desktop machine). PoC available here: https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-leak/README.PoC.md https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-...
- KingOfCoders 6y agoWhenever Apple has a security problem, have of the comments on HN wants to discuss it away - why on earth would you like to be less secure?
- crazygringo 6y agoNot all vulnerabilities are equal, and engineering resources are finite. Isn't analyzing severity one of the most interesting, and critical, parts of discussing a potential vulnerability?
- Black101 6y agoApple is less about privacy then they claim.
- hansel_der 6y agotrue, so is google. the choice is reduced to "how much information do i want my personal communicator to be leaking" (and somewhat "to whom")
- Black101 6y agoGoogle doesn't claim that they are trying to protect your privacy... ever since Gmail started, Google said that they were reading your emails.
- hansel_der 6y ago> Google doesn't claim that they are trying to protect your privacy they do. but yea, there stance is no as belivable.
- okdana 6y agoAirDrop also shares your full name (seemingly the one associated with your Apple ID, not what you have set for yourself in your contacts), both by displaying it in the sharing interface on the involved devices and by attaching it as an extended attribute to uploaded files. The latter is more serious imo, because those attributes live on your file system basically for ever, and they're preserved when transferring to another compatible file system or even when archived in a zip file. The meta-data can ride along with the files to completely unrelated systems even years after the fact. So if you AirDrop some files to your computer and then zip them up, anyone you send that zip to (a journalist, a public file-hosting site, w/e) will have your full legal name to go with them. Even sharing your name through the interface seems questionable -- the fact that you and another person have each other's phone numbers is not necessarily an indication that you want to share your real names with each other. (Though i guess someone could usually find it out anyway if they already had your phone number.) I reported this to Apple, but i don't think they care. Seems like it's by design.
- hda111 6y agoThis is a privacy nightmare.
- casualtemp 6y agoIsn't that name editable on your Apple ID page? That name is also not part of your financial data on the iPhone (which usually involves your real name).
- xvector 6y agoWow, you're right! 1. Airdrop an item to your Mac. 2. Run 'mdls [file]' to see associated metadata 3. Copy the file, run 'mdls [file]' again - open it locally or even in a macOS VM - you'll see that your name and phone name is copied with the file! https://eforensicsmag.com/airdrop-forensics-by-kinga-kieczkowska/ https://eforensicsmag.com/airdrop-forensics-by-kinga-kieczko...