8 ms·

AirPods fast connect security vulnerability

312 points by memalign 2y ago

a1o 2y ago
Very nice write-up > ... see if I could get all the functionality working on Linux as well. ... I’ll talk about the specifics in another blog post ... I am super curious to read when you do write-up about implementation of this functionality in Linux! Thanks for that and I will refresh the blog until that is written :)
deleted 2y ago
[deleted]
- deleted 2y ago
  [deleted]
rock_artist 2y ago
> That’s because AirPods auto-update their firmware by themselves, but only when they’re used together with an iPhone or MacBook, so Android users have no easy way to update their firmware. From what I remember, advantage of affected Beats devices which also use same chip is they can actually be updated from the beats app on Android
- nuccy 2y ago
  I use Airpods Pro (1st before and now 2nd gen) with Android phones. And indeed no way to update firmware from Android, no way to check firmware version, no way to select modes, no way to change long press behaviour, no way to check battery level (there are third party apps but they work unreliably). Luckily all that can be done on Mac (except fitting test, which requires iPhone only), though the firmware upgrade process is as confusing as it can possibly be - a user has zero control whatsoever and zero information about status/progress. One of the support team members in an Apple Store once suggested: you need to leave AirPods connected to the Mac inserted into open case, which is plugged and charging for about 30 minutes to upgrade the firmware. Though in my experience there is definitely a random factor in play for such an upgrade. Moreover I have an impression that even Apple Store employees sometimes have very vague idea how Apple products interplay with any other Apple product excepting the iPhone. Two times I had hardware issue with 1st and 2nd gen Airpods they were very confused that I don't use those with iPhone but with a Mac and Android only.
  - dbg31415 2y ago
    I had 3 sets of AirPods. 2 upgraded inside of an hour by leaving them connected to my MacBook, while they were charging and the AirPod cases were open. One didn't upgrade. Annoying. I left it for about 4 hours. Anyway, you can force an upgrade by hitting "forget this device" and then re-pairing it. As soon as you do, the firmware will upgrade.
    - Angostura 2y ago
      Useful tip. Thank you
    - geon 2y ago
      How do you even know when an upgrade needs to be done?
      - shzhdbi09gv8ioi 2y ago
        Compare firmware version of your AirPods with the advisory. Select the AirPods under Bluetooth on your iPhone, firmare version is shown as "Version".
  - Rinzler89 2y ago
    >no way to update firmware from Android, no way to check firmware version To be fair, even on iOS you can't manually trigger a firmware update as Apple in their infinite wisdom decided that's too complicated for the average user, and to make things simpler for them, firmware updates just happen automagically™. When do they happen? Whenever they fee like it. Just keep your phoner and Airpods close to each other and it will happen eventually, some time. Or not, if you have an error that causes the process to silently fail and the user will have no idea and no way to manually trigger the update or debug it, because that would ruin the AM (Apple Magic™).
    - jen729w 2y ago
      > Apple in their infinite wisdom decided that's too complicated for the average user It absolutely is too complicated for the average user. No sarcasm whatsoever. 100% sincere comment. ‘The average user’ has utterly no clue about this sort of thing, and nor should they be expected to.
StrLght 2y ago
I understand that chances are pretty slim but I still hope that this will make Apple do something regarding AirPods updates on other OSes or at least on Android.
diebeforei485 2y ago
There is no manual update option. Auto-update is the only way to update, and it's unclear how to cajole it to auto-update.
- Operyl 2y ago
  If I recall correctly, removing/unpairing the AirPods and forcing a re-pair will forcibly trigger an update.
cjk2 2y ago
I didn't even know about this vulnerability and mine are updated. Just how I like things.
zeroz 2y ago
Settings > Bluetooth > Your AirPods (click on [i]) shows the version, even if AirPods are not actively connected. 6A326 seems to be the version including the fix. https://support.apple.com/en-us/HT214111 https://support.apple.com/en-us/HT214111
- mh- 2y ago
  >AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8 I'm on 6F8, which I presume is for AirPods Pro 2nd gen.
schrodinger 2y ago
Obviously any vulnerability is bad, but I'm trying to understand just how bad this one is. What "scary" things could an attacker do? It doesn't sound like they could listen in on a phone call you're having without your knowledge, or even an audio stream, since it breaks the original connection, right? So is the worst they could do is come within a pretty short distance of you, scan for your mac address, and the auto-connect and play some noise into your ears? Or is there more? I suppose you could do something like take over the airpods of a high-level celebrity or politician while they're on a video call, that could be bad (but caught instantly). Anything worse?
- Gigachad 2y ago
  Realistically the worst thing is just being annoying. If it was left unpatched, someone would make an airpod jammer app for the flipper zero and cause annoyance in public places killing the audio on everyones airpods.
- etbebl 2y ago
  A lot of people wear airpods around even if they're not actively using them, right? So if that's the case, you could use the microphone to eavesdrop on an in-person conversation. Although since it has to be within Bluetooth range, might be easier to just eavesdrop normally.
  - anamexis 2y ago
    > A lot of people wear airpods around even if they're not actively using them, right? Do they?
    - stirlo 2y ago
      Yes. They’re easy to just leave in your ears and go about your day
      - cpuguy83 2y ago
        Especially with the loud noise suppression.
bagels 2y ago
One more advantage of wired headphones in addition to them not running out of batteries.
- rwmj 2y ago
  As well as being able to connect reliably. Bluetooth on Linux is a disaster.
  - ku1ik 2y ago
    Have you tried PipeWire? As long as bt driver for you adapter is decent PipeWire makes using all sorts of bluetooth audio devices a breeze. At least for me it works great, all the time.
jessriedel 2y ago
> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds. > With this trick, they can establish that both devices are speaking the Fast Connect protocol without violating the Bluetooth specification, and then go on to exchange 3 more back-and-forth messages, negotiating all the things necessary to fully connect the two devices. > The fact that this only takes 4 messages back-and-forth in total is what makes Fast Connect fancy, because usually in Bluetooth the phase of wiring up the individual channels for a connection is quite a complex negotiation and involves sending various SDP descriptors that describe which protocols/features both sides support. Two devices in the same room communicating over even a very narrow slice of the electromagnetic spectrum could exchange many thousands of messages per second. What is it about Bluetooth that causes each message to take a hundred milliseconds rather than, say, a microsecond? What is setting the timescale for this process?
- vlovich123 2y ago
  Not sure if that’s the case here but typically it’s a combination of: * How frequently the advertising device is sending out a beacon (for WiFi the typical beacon is every 100ms which should be similar for BT but it’s been a while since I worked on either) * there may be multiple advertising channels (I think BT smartly picked 1 or a very small number but annoyingly WiFi didn’t restrict the channel the beacon could be sent on which is a disaster for 5ghz since there’s so many - not sure if they fixed it in 6ghz) * for back compat, the beacon is sent at the slowest speed of the protocol as is the handshake. So for example your 600mbps WiFi channel actually beacons and does the handshake at 10mbps (or whatever the negotiation speed is specified to be) because you need to start at the minimum speed to negotiate the higher speed while retaining back compat. Similar thing happens with USB3.0 which does a USB1 initial handshake. * noise in the environment can cause PHY retransmissions to be needed. So basically PHY handshaking to determine what capability exists on both sides to know which PHY protocol to talk to each other.
  - ricw 2y ago
    All of this above. The biggest contributing factor though is that the radio will be off for 99% or more of the time when not actively sending, in order to save energy. This means you also need to wait for that <1% beacon/listening window to connect. And it’s not unlikely that you get interference / a bad transmission just at that time, so double or triple the wait time. Or in short: It’s caused by saving energy and interference.
worstspotgain 2y ago
The Apple Support link given in the article is for what looks like the Indian version. Here's the US version: https://support.apple.com/en-us/106340 https://support.apple.com/en-us/106340 The US version shows different version numbers for the latest firmware, e.g. for the Airpods Pro 2nd Gen it's 6F8, while in India it's 6B34.
hsbauauvhabzb 2y ago
I’ve got numerous gripes with AirPods under Linux - range doesn’t seem as good as my phone (I’ve tried multiple dongles etc), I wasn’t aware that you could connect to two devices but now I want that, when the microphone is enabled audio sounds absolutely trash. Oddly enough, the connect speed annoyed me but not as much as the other issues. Are there any alternative headphones that solve all three of these well? I just want a headset that works.
- ungamedplayer 2y ago
  If you find something that sounds high quality while the microphone is in use, please document your findings. I feel like there are no good options.
  - hsbauauvhabzb 2y ago
    To be clear, the microphone sounds good, sound output is garbage.
    - ungamedplayer 2y ago
      Thanks for clarifying, I am seeing the same behaviour. I think the codec changes once the microphone is enabled.
- paulmd 2y ago
  how much do you know about bluetooth device and codec profiles? ooh, boy, I envy you, you see, the bluetooth connection was never about the bluetooth at all... https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles (absolutely there is some codec that apple licenses that you as a linux user don't and don't get etc, this is some profile thing they're doing and honestly that's just the price of linux. Free as in free from HDMI 2.1 support. And fraunhofer, and Dolby, and MPEG-LA licensing. Being willing to pay the $2 per device for the licenses has its perks.)
  - talldayo 2y ago
sebazzz 2y ago
So my Airpods 2 have an outdated firmware version, but as a user I can't explicitly have iOS update the firmware, and there is no indication when an update happens. I wish I would have more control.
- GeekyBear 2y ago
  > Firmware updates are delivered automatically while your AirPods are charging and in Bluetooth range of your iPhone, iPad, or Mac that's connected to Wi-Fi. https://support.apple.com/en-us/106340 https://support.apple.com/en-us/106340
  - cpncrunch 2y ago
    I dont think that is the full story, as my airpods didnt auto update when simply within range, as they werent connected to the device, so therefore no way to actually download the update. You need to connect to a device via bluetooth for 5 mins (e.g. just open case when close to device if it is configured to autoconnect). Then close the case and leave for 15 mins. Then connect again and check version.
- MuffinFlavored 2y ago
  I’d be down to invest time reverse engineering this. It would be fun.
  - Reubachi 2y ago
    Then get to it! Is this something you're capable of?
- recursive 2y ago
  > I wish I would have more control. Apple products may not be for you.
- alwillis 2y ago
  As more features get added to current and future AirPods, I'd like the ability to trigger an update or at least be notified if one happens. I get it—95%+ of AirPods users shouldn't have to know about firmware updates. But for those of us who do care about these things, there should be someway to monitor what's happening. It usually doesn't matter but I have experienced delays in getting AirPods firmware by a couple of days. There could be a time in the future when getting a firmware update ASAP does matter.
nubinetwork 2y ago
> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds Oh no, I'll never get that 0.5 seconds back... /s
resource_waste 2y ago
Hard to think of a company with as poor security as Apple. No one else hits the headlines as much and creates so much real world consequences.

312 points by memalign 2y ago

a1o 2y ago

Very nice write-up > ... see if I could get all the functionality working on Linux as well. ... I’ll talk about the specifics in another blog post ... I am super curious to read when you do write-up about implementation of this functionality in Linux! Thanks for that and I will refresh the blog until that is written :)

deleted 2y ago

[deleted]

deleted 2y ago
[deleted]

rock_artist 2y ago

> That’s because AirPods auto-update their firmware by themselves, but only when they’re used together with an iPhone or MacBook, so Android users have no easy way to update their firmware. From what I remember, advantage of affected Beats devices which also use same chip is they can actually be updated from the beats app on Android

nuccy 2y ago
I use Airpods Pro (1st before and now 2nd gen) with Android phones. And indeed no way to update firmware from Android, no way to check firmware version, no way to select modes, no way to change long press behaviour, no way to check battery level (there are third party apps but they work unreliably). Luckily all that can be done on Mac (except fitting test, which requires iPhone only), though the firmware upgrade process is as confusing as it can possibly be - a user has zero control whatsoever and zero information about status/progress. One of the support team members in an Apple Store once suggested: you need to leave AirPods connected to the Mac inserted into open case, which is plugged and charging for about 30 minutes to upgrade the firmware. Though in my experience there is definitely a random factor in play for such an upgrade. Moreover I have an impression that even Apple Store employees sometimes have very vague idea how Apple products interplay with any other Apple product excepting the iPhone. Two times I had hardware issue with 1st and 2nd gen Airpods they were very confused that I don't use those with iPhone but with a Mac and Android only.
- dbg31415 2y ago
  I had 3 sets of AirPods. 2 upgraded inside of an hour by leaving them connected to my MacBook, while they were charging and the AirPod cases were open. One didn't upgrade. Annoying. I left it for about 4 hours. Anyway, you can force an upgrade by hitting "forget this device" and then re-pairing it. As soon as you do, the firmware will upgrade.
  - Angostura 2y ago
    Useful tip. Thank you
  - geon 2y ago
    How do you even know when an upgrade needs to be done?
    - shzhdbi09gv8ioi 2y ago
      Compare firmware version of your AirPods with the advisory. Select the AirPods under Bluetooth on your iPhone, firmare version is shown as "Version".
- Rinzler89 2y ago
  >no way to update firmware from Android, no way to check firmware version To be fair, even on iOS you can't manually trigger a firmware update as Apple in their infinite wisdom decided that's too complicated for the average user, and to make things simpler for them, firmware updates just happen automagically™. When do they happen? Whenever they fee like it. Just keep your phoner and Airpods close to each other and it will happen eventually, some time. Or not, if you have an error that causes the process to silently fail and the user will have no idea and no way to manually trigger the update or debug it, because that would ruin the AM (Apple Magic™).
  - jen729w 2y ago
    > Apple in their infinite wisdom decided that's too complicated for the average user It absolutely is too complicated for the average user. No sarcasm whatsoever. 100% sincere comment. ‘The average user’ has utterly no clue about this sort of thing, and nor should they be expected to.

StrLght 2y ago

I understand that chances are pretty slim but I still hope that this will make Apple do something regarding AirPods updates on other OSes or at least on Android.

diebeforei485 2y ago

There is no manual update option. Auto-update is the only way to update, and it's unclear how to cajole it to auto-update.

Operyl 2y ago
If I recall correctly, removing/unpairing the AirPods and forcing a re-pair will forcibly trigger an update.

cjk2 2y ago

I didn't even know about this vulnerability and mine are updated. Just how I like things.

zeroz 2y ago

Settings > Bluetooth > Your AirPods (click on [i]) shows the version, even if AirPods are not actively connected. 6A326 seems to be the version including the fix. https://support.apple.com/en-us/HT214111 https://support.apple.com/en-us/HT214111

mh- 2y ago
>AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8 I'm on 6F8, which I presume is for AirPods Pro 2nd gen.

schrodinger 2y ago

Obviously any vulnerability is bad, but I'm trying to understand just how bad this one is. What "scary" things could an attacker do? It doesn't sound like they could listen in on a phone call you're having without your knowledge, or even an audio stream, since it breaks the original connection, right? So is the worst they could do is come within a pretty short distance of you, scan for your mac address, and the auto-connect and play some noise into your ears? Or is there more? I suppose you could do something like take over the airpods of a high-level celebrity or politician while they're on a video call, that could be bad (but caught instantly). Anything worse?

Gigachad 2y ago
Realistically the worst thing is just being annoying. If it was left unpatched, someone would make an airpod jammer app for the flipper zero and cause annoyance in public places killing the audio on everyones airpods.
etbebl 2y ago
A lot of people wear airpods around even if they're not actively using them, right? So if that's the case, you could use the microphone to eavesdrop on an in-person conversation. Although since it has to be within Bluetooth range, might be easier to just eavesdrop normally.
- anamexis 2y ago
  > A lot of people wear airpods around even if they're not actively using them, right? Do they?
  - stirlo 2y ago
    Yes. They’re easy to just leave in your ears and go about your day
    - cpuguy83 2y ago
      Especially with the loud noise suppression.

bagels 2y ago

One more advantage of wired headphones in addition to them not running out of batteries.

rwmj 2y ago
As well as being able to connect reliably. Bluetooth on Linux is a disaster.
- ku1ik 2y ago
  Have you tried PipeWire? As long as bt driver for you adapter is decent PipeWire makes using all sorts of bluetooth audio devices a breeze. At least for me it works great, all the time.

jessriedel 2y ago

> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds. > With this trick, they can establish that both devices are speaking the Fast Connect protocol without violating the Bluetooth specification, and then go on to exchange 3 more back-and-forth messages, negotiating all the things necessary to fully connect the two devices. > The fact that this only takes 4 messages back-and-forth in total is what makes Fast Connect fancy, because usually in Bluetooth the phase of wiring up the individual channels for a connection is quite a complex negotiation and involves sending various SDP descriptors that describe which protocols/features both sides support. Two devices in the same room communicating over even a very narrow slice of the electromagnetic spectrum could exchange many thousands of messages per second. What is it about Bluetooth that causes each message to take a hundred milliseconds rather than, say, a microsecond? What is setting the timescale for this process?

vlovich123 2y ago
Not sure if that’s the case here but typically it’s a combination of: * How frequently the advertising device is sending out a beacon (for WiFi the typical beacon is every 100ms which should be similar for BT but it’s been a while since I worked on either) * there may be multiple advertising channels (I think BT smartly picked 1 or a very small number but annoyingly WiFi didn’t restrict the channel the beacon could be sent on which is a disaster for 5ghz since there’s so many - not sure if they fixed it in 6ghz) * for back compat, the beacon is sent at the slowest speed of the protocol as is the handshake. So for example your 600mbps WiFi channel actually beacons and does the handshake at 10mbps (or whatever the negotiation speed is specified to be) because you need to start at the minimum speed to negotiate the higher speed while retaining back compat. Similar thing happens with USB3.0 which does a USB1 initial handshake. * noise in the environment can cause PHY retransmissions to be needed. So basically PHY handshaking to determine what capability exists on both sides to know which PHY protocol to talk to each other.
- ricw 2y ago
  All of this above. The biggest contributing factor though is that the radio will be off for 99% or more of the time when not actively sending, in order to save energy. This means you also need to wait for that <1% beacon/listening window to connect. And it’s not unlikely that you get interference / a bad transmission just at that time, so double or triple the wait time. Or in short: It’s caused by saving energy and interference.

worstspotgain 2y ago

The Apple Support link given in the article is for what looks like the Indian version. Here's the US version: https://support.apple.com/en-us/106340 https://support.apple.com/en-us/106340 The US version shows different version numbers for the latest firmware, e.g. for the Airpods Pro 2nd Gen it's 6F8, while in India it's 6B34.

hsbauauvhabzb 2y ago

I’ve got numerous gripes with AirPods under Linux - range doesn’t seem as good as my phone (I’ve tried multiple dongles etc), I wasn’t aware that you could connect to two devices but now I want that, when the microphone is enabled audio sounds absolutely trash. Oddly enough, the connect speed annoyed me but not as much as the other issues. Are there any alternative headphones that solve all three of these well? I just want a headset that works.

ungamedplayer 2y ago
If you find something that sounds high quality while the microphone is in use, please document your findings. I feel like there are no good options.
- hsbauauvhabzb 2y ago
  To be clear, the microphone sounds good, sound output is garbage.
  - ungamedplayer 2y ago
    Thanks for clarifying, I am seeing the same behaviour. I think the codec changes once the microphone is enabled.
paulmd 2y ago
how much do you know about bluetooth device and codec profiles? ooh, boy, I envy you, you see, the bluetooth connection was never about the bluetooth at all... https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles https://en.wikipedia.org/wiki/List_of_Bluetooth_profiles (absolutely there is some codec that apple licenses that you as a linux user don't and don't get etc, this is some profile thing they're doing and honestly that's just the price of linux. Free as in free from HDMI 2.1 support. And fraunhofer, and Dolby, and MPEG-LA licensing. Being willing to pay the $2 per device for the licenses has its perks.)
- talldayo 2y ago

sebazzz 2y ago

So my Airpods 2 have an outdated firmware version, but as a user I can't explicitly have iOS update the firmware, and there is no indication when an update happens. I wish I would have more control.

GeekyBear 2y ago
> Firmware updates are delivered automatically while your AirPods are charging and in Bluetooth range of your iPhone, iPad, or Mac that's connected to Wi-Fi. https://support.apple.com/en-us/106340 https://support.apple.com/en-us/106340
- cpncrunch 2y ago
  I dont think that is the full story, as my airpods didnt auto update when simply within range, as they werent connected to the device, so therefore no way to actually download the update. You need to connect to a device via bluetooth for 5 mins (e.g. just open case when close to device if it is configured to autoconnect). Then close the case and leave for 15 mins. Then connect again and check version.
MuffinFlavored 2y ago
I’d be down to invest time reverse engineering this. It would be fun.
- Reubachi 2y ago
  Then get to it! Is this something you're capable of?
recursive 2y ago
> I wish I would have more control. Apple products may not be for you.
alwillis 2y ago
As more features get added to current and future AirPods, I'd like the ability to trigger an update or at least be notified if one happens. I get it—95%+ of AirPods users shouldn't have to know about firmware updates. But for those of us who do care about these things, there should be someway to monitor what's happening. It usually doesn't matter but I have experienced delays in getting AirPods firmware by a couple of days. There could be a time in the future when getting a firmware update ASAP does matter.

nubinetwork 2y ago

> Its main purpose seems to be reducing the time it takes to establish a connection between two Apple devices from roughly 1 second down to about 0.5 seconds Oh no, I'll never get that 0.5 seconds back... /s

resource_waste 2y ago

Hard to think of a company with as poor security as Apple. No one else hits the headlines as much and creates so much real world consequences.