4 ms·

Apple knew AirDrop users could be identified and tracked as early as 2019

itslennysfault 3y ago
[flagged]
- giuliomagnifico 3y ago
  It would be legit but unfortunately I think it's very difficult to prove (to a court) that Apple knew and intentionally did nothing.
  - Arnt 3y ago
    Most of us ship suboptimal code and intend to improve it later, knowing that later often turns into never.
theshrike79 3y ago
> “This breach is just another way for Beijing to target any Apple user it perceives to be an opponent. The time to act is now, and Apple must be held accountable for failing to safeguard its users against such blatant security breaches.” (Marco Rubio, Florida Senator) Holy shit the amount of hyperbole is staggering. "Any Apple user", so Beijing can just "target" Joe Nobody in Bumfuck, Idaho's iPhone if they perceive him to be an opponent? But the guy making the accusation is from Florida, so... >Chinese authorities claim they exploited the vulnerabilities by collecting some of the basic identifying information that must be transferred between two Apple devices when they use AirDrop — data including device names, email addresses and phone numbers. Yep, this is bad, but not really a zero day vulnerability. It lets someone who is in range when you're airdropping stuff in public to see your basic info. Not really a worrying case in normal use, but Chinese dissidents have a very specific use-case for transferring stuff P2P without going through the government monitored network.
giuliomagnifico 3y ago
> A group of Germany-based researchers at the Technical University of Darmstadt, who first discovered the flaws in 2019, told CNN Thursday they had confirmation Apple received their original report at the time but that the company appears not to have acted on the findings. The same group published a proposed fix for the issue in 2021, but Apple appears not to have implemented it, the researchers said. >One of the researchers, Milan Stute, shared an email with CNN showing a representative of Apple’s product security team acknowledging the researchers’ report in 2019
- deleted 3y ago
  [deleted]
sleepybrett 3y ago
I guarantee that the engineer who built airdrop knew that as soon as he committed his code.
- xxs 3y ago
  Likely before that
- lxgr 3y ago
  Likely, given that Apple's public documentation of the exact behavior probably didn't write itself: https://support.apple.com/guide/security/airdrop-security-sec2261183f4/web https://support.apple.com/guide/security/airdrop-security-se...
hospitalJail 3y ago
[flagged]
- throwanem 3y ago
  Not that I'm either, but I think I'd rather be a consequentialist than a nihilist.
zitterbewegung 3y ago
I mean wasn’t this obvious when Tile’s came out ? Honestly at this point Tile’s are more secure because less people use it.
- Anechoic 3y ago
  This is about AirDrop, not Air Tags.
MattPalmer1086 3y ago
Matthew Green just wrote up the details of the attack: https://blog.cryptographyengineering.com/2024/01/11/attack-of-the-week-airdrop-tracing/ https://blog.cryptographyengineering.com/2024/01/11/attack-o...
- dang 3y ago
  Thanks! That looks more informative so I've re-upped https://news.ycombinator.com/item?id=38955018 https://news.ycombinator.com/item?id=38955018 (via the second-chance pool mechanism) and will move the relevant comments thither.
crowcroft 3y ago
Big on privacy though.
- ijhuygft776 3y ago
  Big on privacy if you listen to what Apple says and ignore the news.
daft_pink 3y ago
Why are we blaiming Apple that an easy file transfer service that most users use casually to transfer files doesn’t meet the needs of anonymity for dissidents when being tracked by a major world superpower government. It’s not sure why we’re treating this like it’s the Tor browser. It’s a way to quickly share the photos you’ve taken among friends. It’s not some conspiracy. Apple just didn’t design the product for what they’re using it for.
- aaomidi 3y ago
  When you are a large entity, you have a lot of responsibilities to ensure that your users are safe even when they don’t use a service in its intended fashion. This is fundamental to secure design and it’s also why it’s important for teams to have a both diverse skill set and diverse background to really think out how these features may be used.
  - daft_pink 3y ago
    How can a beacon service that can detect whether other iPhones in your general area are in your contacts be totally private secure and totally anonymous and to anyone let alone the local government's intelligence service? Have you ever used airdrop? I don't understand why anyone would expect a high degree of privacy from this application. I think it demonstrates how when you are a large enough entity you get totally blamed for everything no matter what. Make it totally anonymous to send to everyone and you get blamed for creepers sending anonymous dick pics. Don't make it anonymous and you get blamed for the government spying on users en masse because they can track you within bluetooth radius.

[flagged]

giuliomagnifico 3y ago
It would be legit but unfortunately I think it's very difficult to prove (to a court) that Apple knew and intentionally did nothing.
- Arnt 3y ago
  Most of us ship suboptimal code and intend to improve it later, knowing that later often turns into never.

> “This breach is just another way for Beijing to target any Apple user it perceives to be an opponent. The time to act is now, and Apple must be held accountable for failing to safeguard its users against such blatant security breaches.” (Marco Rubio, Florida Senator) Holy shit the amount of hyperbole is staggering. "Any Apple user", so Beijing can just "target" Joe Nobody in Bumfuck, Idaho's iPhone if they perceive him to be an opponent? But the guy making the accusation is from Florida, so... >Chinese authorities claim they exploited the vulnerabilities by collecting some of the basic identifying information that must be transferred between two Apple devices when they use AirDrop — data including device names, email addresses and phone numbers. Yep, this is bad, but not really a zero day vulnerability. It lets someone who is in range when you're airdropping stuff in public to see your basic info. Not really a worrying case in normal use, but Chinese dissidents have a very specific use-case for transferring stuff P2P without going through the government monitored network.

giuliomagnifico 3y ago

> A group of Germany-based researchers at the Technical University of Darmstadt, who first discovered the flaws in 2019, told CNN Thursday they had confirmation Apple received their original report at the time but that the company appears not to have acted on the findings. The same group published a proposed fix for the issue in 2021, but Apple appears not to have implemented it, the researchers said. >One of the researchers, Milan Stute, shared an email with CNN showing a representative of Apple’s product security team acknowledging the researchers’ report in 2019

deleted 3y ago
[deleted]

sleepybrett 3y ago

I guarantee that the engineer who built airdrop knew that as soon as he committed his code.

xxs 3y ago
Likely before that
lxgr 3y ago
Likely, given that Apple's public documentation of the exact behavior probably didn't write itself: https://support.apple.com/guide/security/airdrop-security-sec2261183f4/web https://support.apple.com/guide/security/airdrop-security-se...

hospitalJail 3y ago

[flagged]

throwanem 3y ago
Not that I'm either, but I think I'd rather be a consequentialist than a nihilist.

zitterbewegung 3y ago

I mean wasn’t this obvious when Tile’s came out ? Honestly at this point Tile’s are more secure because less people use it.

Anechoic 3y ago
This is about AirDrop, not Air Tags.

MattPalmer1086 3y ago

Matthew Green just wrote up the details of the attack: https://blog.cryptographyengineering.com/2024/01/11/attack-of-the-week-airdrop-tracing/ https://blog.cryptographyengineering.com/2024/01/11/attack-o...

dang 3y ago
Thanks! That looks more informative so I've re-upped https://news.ycombinator.com/item?id=38955018 https://news.ycombinator.com/item?id=38955018 (via the second-chance pool mechanism) and will move the relevant comments thither.

crowcroft 3y ago

Big on privacy though.

ijhuygft776 3y ago
Big on privacy if you listen to what Apple says and ignore the news.

daft_pink 3y ago

Why are we blaiming Apple that an easy file transfer service that most users use casually to transfer files doesn’t meet the needs of anonymity for dissidents when being tracked by a major world superpower government. It’s not sure why we’re treating this like it’s the Tor browser. It’s a way to quickly share the photos you’ve taken among friends. It’s not some conspiracy. Apple just didn’t design the product for what they’re using it for.

aaomidi 3y ago
When you are a large entity, you have a lot of responsibilities to ensure that your users are safe even when they don’t use a service in its intended fashion. This is fundamental to secure design and it’s also why it’s important for teams to have a both diverse skill set and diverse background to really think out how these features may be used.
- daft_pink 3y ago
  How can a beacon service that can detect whether other iPhones in your general area are in your contacts be totally private secure and totally anonymous and to anyone let alone the local government's intelligence service? Have you ever used airdrop? I don't understand why anyone would expect a high degree of privacy from this application. I think it demonstrates how when you are a large enough entity you get totally blamed for everything no matter what. Make it totally anonymous to send to everyone and you get blamed for creepers sending anonymous dick pics. Don't make it anonymous and you get blamed for the government spying on users en masse because they can track you within bluetooth radius.