6 ms·
$70 device can spoof an Apple device sending BLE Advertising Packets
- deleted 3y ago[deleted]
- buildbot 3y agoAwesome and neat hack, though not really a big surprise. I wonder why apple does not sign the requests with an internal hardware key or something though, given that an Apple TV should have a secure enclave of some kind?
- demondemidi 3y agoAn advertising beacon is too small to contain a message and a signature.
- Aloha 3y agoI dont think there is much of a message in there, its just a iBeacon packet type. Just using the default iBeacon structure - you could have a hash tucked into the major/minor bytes (4 bytes tot) which would correspond to a value blasted out by Avahi on the network the AppleTV is connected to. You could also just blast out a list of valid iBeacon UUID'a out in the same way. Requiring your phone be on wifi and be on the same network at the AppleTV would allow for that. You could even, for example have a ATV device trying to connect require an AppleID and a network connection which could cause a valid iBeacon UUID be seeded to the mobile devices attached to that account. That all said, There does appear to be a handshake before data is sent, because at that point is no longer a BLE iBeacon being used to send the data, you would need to connect to the device - which would involve either pairing or a handshake. So this appears to just be a nuisance attack, rather than a actual attack.
- ikekkdcjkfke 3y agoIs only a single packet being sent or something?
- demondemidi 3y agoIt is advertising.
- tamimio 3y agoIf you go to defcon and still naive enough to share your password with a random popup, maybe you shouldn’t be there in the first place.
- saagarjha 3y agoThere’s nothing here that requires it to be done at DEF CON or to people who in theory are smart enough to understand how to not be hacked.
- dr_whom 3y agoDEF CON isn't what it once was, it's something like 30,000 people that are not all hackers necessarily. I agree people should be smart enough but some people are there for their first time and are interested in learning about security.
- lathiat 3y agoDoing it at Defcon is a show. The point isn't really to actually collect passwords there, it's to demonstrate what's possible in the rest of the world, where people absolutely will.
- tinus_hn 3y agoSo you get asked to share a password, and if you choose to do so, you share a password! What will they think of next!
- noman-land 3y agoThat's a pretty obtuse way to describe phishing, one of the industry's simplest and most devastatingly effective hacking methods to this day.
- editional 3y agoSo you get emailed a usually pretty obvious fake website, you are asked to login, and if you login you leak your password! Surely nobody would fall for this!
- tinus_hn 3y agoYes! Tune in next week, when we blame the website for this!
- asynchronous 3y agoGlad I’m not going crazy and when this was happening at DEF CON it really was someone doing research as I suspected
- pixl97 3y agoWhen I'm at Def Con I'm setting my phone on Airplane mode... of course on an iPhone that is actually useless with the default settings https://support.apple.com/en-us/HT204234 https://support.apple.com/en-us/HT204234 >Turning on Airplane Mode, turns off all radios except for Bluetooth. If you turn off Bluetooth while you're in Airplane Mode, your device will remember that and will turn off Bluetooth the next time that you turn on AirPlane Mode.
- transpute 3y ago2020, https://news.ycombinator.com/item?id=37113807 https://news.ycombinator.com/item?id=37113807 > If Bluetooth is ON on your Apple device everyone nearby can understand current status of your device, get info about battery, device name, Wi-Fi status, buffer availability, OS version and even get your mobile phone number. 2019, https://www.idownloadblog.com/2019/11/12/airplay-tvs-tutorial/ https://www.idownloadblog.com/2019/11/12/airplay-tvs-tutoria... & https://old.reddit.com/r/ios/comments/nlsf0z/how_to_prevent_airplay_from_automatically/ https://old.reddit.com/r/ios/comments/nlsf0z/how_to_prevent_... > AirPlay can automatically play video on nearby TVs, but that’s not always the behavior you might want. Learn how to stop your iPhone, iPad or iPod touch from automatically playing video on any frequently used AirPlay TVs in your household.
- zik 3y agoThat's the really disturbing part of all this. As a user you can take reasonable steps to ensure that you're not vulnerable - switch your bluetooth off but your device straight up lies to you saying it's off while it's leaking data and making you vulnerable.
- fbdab103 3y agoApple also makes it deliberately annoying to pseudo-disable Bluetooth.
- gumby 3y agoThe problem with the bluetooth switch (or "bluetooth headphone switch" in most peoples' mind) is that if it switched off BT completely people would be surprised when their watch stopped talking to their phone, or they couldn't airdrop to their neighbor etc. Perhaps I should have written "problem" with quotes. The control center does what most people think they want. It used to be that when you enabled airplane mode on your watch it set it for your phone too, but you had to get out out of airplane mode on each device. Makes sense to me, but apparently not to everyone, so I was amazed when disabling airplane mode on your watch did the same on the phone. At least it highlights the absurdity of airplane mode. Apart from my own belief that "no means no" when it refers to radios in my devices, I'm also disappointed in the other data that are shared. The phone number, for example, AFAICT is used for joining secured wifi: if you join a network, everybody around you who's connected to that network is asked if they would like to share the password with you (you don't even see it). A handy feature, but not one implemented in a privacy-protecting way (shame on you, Apple!)
- madeofpalk 3y agoMy understanding is the spoof prompts you to enter your device passcode, but the passocde isn’t actually transmitted to the spoofer?
- d1str0 3y agoThe passcode is not, but its prompting you to share a password with your “Apple TV” so that password will be shared.
- jeffbee 3y agoThat seems a little goofy. Why don't they just rendezvous in the cloud such that the authentication on the iPhone is imputed upon the Apple TV, without the Apple TV ever possessing the password? This is how all other streaming things I own work.
- bob-09 3y agoTo rendezvous with the cloud, it needs a network connection first. This pop-up is meant to transmit the network password your iPhone uses so the factory reset Apple TV can establish its own network connection.
- doctor_eval 3y ago[flagged]
- robgibbons 3y agoWhat is the little circular attachment on the iPhone?
- awinter-py 3y agojeez where are you getting a pi zero 2 for under $70
- 14u2c 3y ago$15 at MicroCenter. They get new stock pretty regularly too. The og zero is $5.
- unmole 3y agoI was confused about the $70 dollars in the headline because I remember doing the same thing with a ~$5 BLE dongle 6 years ago. Turns out they included the cost of the RPi that the dongle is connected to.
- natch 3y agoWhy spend $70? https://www.ebay.com/itm/195922683631 https://www.ebay.com/itm/195922683631?
- sumuyuda 3y agoFunny that the article doesn’t call out that the disconnect Bluetooth button in control center is a dark pattern designed to get you to leave Bluetooth on. I had to create a shortcut to turn off Bluetooth so I don’t have to go through the Settings app. Apple also re-enables Bluetooth on every iOS update.
- wtschnbm 3y agoDoes Apple have an interest in Bluetooth always being on? Is this meant to ensure that Airtags work well (even if the phone's owner does not use one)?
- whatsthatabout 3y agoI also don’t like the fact how the toggles work but yes apple has an interest in bluetooth/wifi beeing always on - the apple watch for example. Not so tech savvy people would disable bluetooth/wifi not realizing that this also disconnects the watch. There are probably way more features in the apple ecosystem relying on bluetooth/wifi
- neilalexander 3y agoMostly for the Apple Watch.
- bzzzt 3y agoAnd AirPods, AirDrop, Apple TV Remote, carkit etc. I think we’re well past the point of Bluetooth being optional.
- intelVISA 3y agoThey do, they collect metadata of Bluetooth devices and other wireless SSIDs to report back to [redacted]
- salad-tycoon 3y agoThis but also don’t forget AirTag , find my network, and watch is still connected even when the button is greyed out.
- iamflimflam1 3y agoIt’s interesting, but the whole point of BLE was supposed to be interoperability. The original concept was that there would a standard set of published profiles defining services and characteristics. As a hardware manufacturer you could build a device that matched these profiles and then you would advertise your services to anyone nearby. Software developers would code against these profiles services and characteristics and be able to use any matching hardware. It’s kind of worked for some things. But mostly everyone wants to keep people in their own ecosystem - so you end up with either crappy hardware and or crappy software that you are locked into.
- franga2000 3y agoI do a lot of BLE reverse engineering and this pisses me off endlessly. The only place I find standard characteristics are some sensors and the occasional light switch. The VAST majority of devices are doing custom protocols over RX/TX characteristics, with the occasional "BLE Mesh" being thrown in, I'm guessing just to drain my will to live.
- iamflimflam1 3y agoI feel your pain.
- herunan 3y agoGood luck asking people to turn off BT. It’s a faf having to do that in an era of smartwatches and wireless headphones.