14 ms·

Bypassing regulatory locks, hacking AirPods and Faraday cages

591 points by rithvikvibhu 2y ago

josephcsible 2y ago
[flagged]
- sneak 2y ago
  It would be illegal for them to sell AirPods in many countries without these lockouts. The sale of medical devices is heavily regulated in most places. Headphones: legal. Hearing aids: not. Blame the government, not the company that's following the rules laid down.
  - nixosbestos 2y ago
    Completely ignorant question, but what does it come down to? What if I released this feature but didn't call it "hearing aid", nor positioned it as medical device? Is a phone with optical zoom, a "vision-enhancing device" and regulated like eye wear?
    - sneak 2y ago
      Does it look like a duck? Does it quack like duck? In-ear devices with speaker and mic that look like hearing aids that perform hearing aid function for those with hearing loss? Hearing aids. Phones, that look nothing like glasses or contacts, and don't serve the same purpose? Obviously not. Don't be silly. Judges aren't.
      - nixosbestos 2y ago
        I really wasn't trying to be silly. I feel like other medical things in the US are regulated differently based purely on how they're marketed. How about an Apple Vision Pro with optical zoom on the exterior cameras?
        kube-system 2y ago
        > I feel like other medical things in the US are regulated differently based purely on how they're marketed. They aren't. Different classes of medical or medical-adjacent products in the US have to be careful how they market so they aren't making claims that they are not allowed to make, but the absence of those claims alone doesn't make a regulated device unregulated.
      - luqtas 2y ago
        we could all use some civil disobedience for the good of our kind; “The only obligation which I have a right to assume is to do at any time what I think right.”
      - userbinator 2y ago
        In-ear devices with speaker and mic that look like hearing aids that perform hearing aid function for those with hearing loss? Hearing aids. By that definition every TWS with transparency mode and parametric EQ is a hearing aid.
    - NightMKoder 2y ago
      Presumably depends on the country and the laws. Keep in mind that Apple considers this a new interesting use case - not a killer feature for AirPods. They wouldn’t risk AirPod sales with a gray interpretation of the law.
    - K0balt 2y ago
      Regulated devices have very specific definitions like is represented as O, or does x or z and a and b, or x and b. Things like that. The definition typically hinges on very specific parameters and ALSO what it is called. That way no one can sell an inert plug as a “hearing aid”, and no one can sell a hearing aids as “conversation enhancing devices “ to evade certification requirements if they meet the bar feature-wise to be a hearing aid.
    - bongodongobob 2y ago
      A malfunctioning hearing aid/earbud can potentially cause permanent hearing damage. Unless it explodes, a misbehaving phone can't damage your vision.
      - NavinF 2y ago
        Non sequitur. You could say that about any high quality set of headphones since they're capable of much higher power output than hearing aids.
        bongodongobob 2y ago
        I'm not saying it makes sense, but that's the idea.
        Retr0id 2y ago
        It's still a non-sequitur because regular earphones are not subject to such regulations.
        kube-system 2y ago
        No, medical devices are regulated because society demands a certain degree of certainty from those who claim to treat medical issues. Most societies don't want it to be legal to sell snake oil to vulnerable people suffering from a health issue. There are many dangerous unregulated things that can destroy your hearing or vision. But they don't claim to protect them.
      - deleted 2y ago
        [deleted]
      - deleted 2y ago
        [deleted]
  - Krasnol 2y ago
    Why should anyone blame the government when it's obvious that Apple cared about those regulations and filed the paperwork in some countries but not in others? OP is still right here. The argument stands.
  - enjaydee 2y ago
    Blame governments for regulating medical devices? You're going to need a better argument than that. This is entirely on Apple not applying for regulatory approval.
    - kube-system 2y ago
      Is that even the case? Did they not apply anywhere else? Do they even qualify anywhere else? This wouldn't even have been possible under US law until recently. If Apple tried to do this in the past in the US, they would have made it illegal to buy AirPods without a prescription, which is obviously a regulatory nonstarter.
- elzbardico 2y ago
  This is a regulatory issue, so you can stop the baseless hating.
  - capitainenemo 2y ago
    Is it a regulatory issue? Could it be the hearing aid feature has an AI/voice recognition component trained on certain languages when it runs the "enhancement"? (no idea, just wondering, since the apple page had zero details)
    - resonanttoe 2y ago
      The FDA has to certify the devices for use as hearing aids in the U.S Other countries have similar regulatory bodies the certify the use of a medical device. Hearing aids (and things sold as it) are medical devices.
      - Krasnol 2y ago
        So what? You file the paperwork, pay for it and you get the certification. They decided that they won't do that in India. This is all. They even did that in Germany and the whole world know how much of a hassle it had to be...but Germany has a more significant market share and potential than India so....we all know it's just about the money.
        elzbardico 2y ago
        It is all just about the money. Or India's government could have given a special waive. But Apple is a private company, private companies usually do things for money.
        Krasnol 2y ago
        Oh yeah, please give the poor fruit company an SPECIAL waive so they don't have to be treated like all the peasant companies.
      - 2y ago
- samatman 2y ago
  So your theory is what, malice? Apple makes AirPods the cheapest hearing aids by a long shot, except for some customers that they hate? The problem is simple: hearing aids are regulated products, and countries tend to insist on individually certifying them. Getting the right to market AirPods as hearing aids in the US wasn't cheap, I'm sure. There needs to be international harmonization of these regulations. It isn't just hurting Apple and Apple's customers, it hurts everyone. Perhaps Apple has decided that it's too expensive to pass those regulations in certain markets, but my bet is that it just takes longer in the EU and India. I guess we'll see.
  - Krasnol 2y ago
    OP didn't say it's about hate, and why would you assume OP meant hate? There are many other obvious reasons. Like the market share for example. To hate requisites that you care enough...and that you are not a corporation...
  - blkhawk 2y ago
    Then don't bloody call it a hearing aid then in those countries - call it "adjusted transparent mode with equalizer". Stuff that coincidentally works as a hearing aid is not regulated as far as I can tell anyway simply because I never heard of a government that would confiscate an amplifier with an equalizer function build in as soon as somebody plugged headphones and a microphone into it.
- kube-system 2y ago
  > It couldn't have been easy or cheap for them to add all these antifeatures. It was definitely cheap to add this region lock: it's a single `if` statement calling existing system libraries. The regulatory side of this is the expensive part, and it varies by country, and many places make it illegal for hearing aids to be sold over the counter no matter how much Apple wants to release it there. Even the US would have prohibited this feature until regulatory changes that happened in 2022.
post_break 2y ago
Does this reset itself after a certain amount of time or is it one and done? I'd be worried about the feature being removed when the iPad or airpods decide they've been in India for too long.
- thel3l 2y ago
  Heya! One of the authors here. Nope, its a one time thing. When the feature is enabled, a flag is set on the iCloud account, so you can travel anywhere and have it work. At the same time, a EQ profile is pushed to the transparency mode of the Airpods, enabling the hearing aid features. Once done, it sticks with the Airpods, unless you reset them. However, an interesting quirk is that if you enable this on someone's airpods, and _their_ device/account does not have it 'available', they wont be able to tweak the settings on their device.
  - post_break 2y ago
    Very cool, glad it sticks.
  - ilt 2y ago
    I live in India and I have been using hearing aid feature since at least March when I bought Airpods Pro. Only that it wasn’t called as such earlier. It uses the audiogram I had provided it which it used to create a customized equalizer for my hearing disability. I am sure they must have improved upon the capability in new OS versions but functionally it has been present for a while now.
    - _rs 2y ago
      I suppose the difference is 1st party support for creating the audiogram, plus the clearance from the US gov to market it the way they want as OTC hearing aids
      - lathiat 2y ago
        It also applied the same profile to both ears, which matters for some. My hearing loss is highly asymmetric.
pomian 2y ago
Looking forward to further write ups on faraday cages, design and uses. That was great what you did with the air pods.
thel3l 2y ago
Hey! I'm Rithwik, one of the authors of the article, happy to answer questions etc!
- carbonguy 2y ago
  Mainly just wanted to say, this is an absolutely fantastic hack and I loved reading about it - thank you for sharing! I guess if I have one question, it would be... what else are you planning to do with your new Faraday cage?
  - thel3l 2y ago
    Thank you for reading and the kind words! We're almost looking forward to this loophole being shut down to really make things a tad bit more challenging haha We've got some ideas for the Faraday cage—a whole bunch of networks research and hacking that we can do without messing up live systems! It's also really nice to be able to test a device in isolation, without worrying about whether it's phoning back home in some way.
    - ryandrake 2y ago
      > We're almost looking forward to this loophole being shut down to really make things a tad bit more challenging haha This is a great attitude in the face of a pretty sad 2024 reality: that the manufacturer of a device is expected to intentionally go out of its way to remotely stop users from using the device they bought in the way they want to use it.
  - itsarnavb 2y ago
    I'm thinking of making it easy to "teleport" to any location within the cage Imagine typing in coordinates or picking a location on a map, and then suddenly your phone or any other device is at that location inside the cage, by a combination of GPS, cellular and WiFi spoofing My former manager called it a portal haha: https://x.com/masadfrost/status/1856467695606345756 https://x.com/masadfrost/status/1856467695606345756
- vintagedave 2y ago
kristofferR 2y ago
Does anyone know what the Hearing Protection mode does? It's not available in Norway (or anywhere outside of NAmerica). I've used the AirPods Pro 2 as hearing protection for some stuff before, it works fine. Is it just due to the words ("Hearing Protection") which they are only allowed to use only in America or is it actually better than regular Pro 2 noise-cancelling?
- grahamj 2y ago
  I'm pretty sure all that's new is the hearing test app and marketing. AirPods already had these features. From listening to it work HP sounds to me like multiband compression, in other words divide up the audible spectrum into multiple bands and apply compression on each one individually. Again it was already doing this though.
tzs 2y ago
> Hearing aids typically cost anywhere from ₹ 50,000 to upwards of ₹ 8L depending on the correction capability For those who don't recognize the ₹ symbol it is the symbol for the Indian Rupee and an "L" after a number means 100,000, so ₹ 8L is ₹ 800,000. At current exchange rates that puts hearing aids in India from $600 to upwards of $9,500. AirPods Pro 2 are ₹ 24,900 ($295).
- hoistbypetard 2y ago
  Thanks for posting this. I recognized the currency symbol but was confused by the "L".
  - JumpCrisscross 2y ago
    The Indian numbering system marks odd power of ten, i.e. 10 ^ {1, 3, 5, 7}. Unit, thousand, lakh, crore [1]. Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3, 6, 9}. Thousands, millions, billions, et cetera. [1] https://en.m.wikipedia.org/wiki/Indian_numbering_system https://en.m.wikipedia.org/wiki/Indian_numbering_system
    - eru 2y ago
      > Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3, 6, 9}. Thousands, millions, billions, et cetera. To make matters more confusing, for American English it goes millions, billions, trillions. For British English it used to go millions, milliards, billions, billiards, trillions, trilliards. (That 'long scale' is still the way German used to work ten years ago. No clue if it changed in the meantime.)
      - andreareina 2y ago
        I still mourn the long scale. A billion is obviously a million millions.
        SushiHippie 2y ago
xxxuuhshhjwuu 2y ago
[flagged]
userbinator 2y ago
It appears that the Hearing Aid feature is actually an equalizer preset that is pushed to the AirPods and will replace your transparency mode. Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but perhaps that was a huge calculated risk. There's an incredible amount of processing power and flexibility in these things. Even the sub-$10 ones using the infamous JieLi SoCs - a 160MHz 32-bit computer in each ear. I'm surprised there hasn't yet been any TWS advertised with open-source firmware, although there's been some work in the usual Chinese (and Russian) communities on customisations.
- nfriedly 2y ago
  > I'm surprised there hasn't yet been any TWS advertised with open-source firmware Let me introduce you to the PineBuds Pro: https://pine64.com/product/pinebuds-pro-open-firmware-capable-anc-wireless-earbuds/ https://pine64.com/product/pinebuds-pro-open-firmware-capabl...
  - userbinator 2y ago
    User can flash in PINE64 community open firmware when becomes[sic] available. I did manage to find the firmware, but it says that it doesn't have ANC, which the factory firmware does. Good start nonetheless.
  - aftbit 2y ago
    >Excessive flashing Pinebuds can potentially brick the device. Jeez that's not great. Hard to develop on these devices when too many flashes kills them.
    - userbinator 2y ago
      The flash on these SoCs is usually designed to be programmed once at the factory, and then perhaps the occasional firmware update. Endurance is in the ~100 cycles range.
myself248 2y ago
This is fantastic! We're building a walk-in-closet-sized Faraday cage at i3Detroit, though of course we're in the US so we won't need it for this specific hack, there's a zillion reasons it's fun to have one! Off the top of my head: The biggie is that we're right down the street from WOMC's transmitter, which is 135,000 watts EIRP. It gets into EVERYTHING and makes other RF measurements more difficult, so if you're trying to align an amplifier or something, it's nice to start from a quiet place and get the basics solid, and only THEN add sources of potential intermod and stuff. Debugging wifi, bluetooth, and other wireless stuff without a zillion other nodes in view. Yes you can filter the output of a sniffer, but it's more fun to filter the input. ;) Lighting up a 1G or 2G cellular network without worrying about spectrum licensing. Practicing offensive wifi techniques or other stuff that might interfere with the hackerspace's existing network. Playing with GPS spoofers in an FCC-free zone. Or anything else you might find amusing but want to do responsibly. Locking an iPhone in there to see if it reboots itself... (rofl)
- thel3l 2y ago
  Yes!! Shocked we made it this far in life without one! Itching to put devices inside and light the air inside up without worrying about licensing! We actually ended up seeing a life size Faraday cage at Indian Institute of Science—felt good to see that the construction was similar to our approach
  - myself248 2y ago
    Oh sweet! I've used little tabletop ones at work, and ended up building myself one using the housing of some scrapped microwave equipment (it got hit by lightning so the circuits were junk, but the RF-gasketed housing was in great shape.) It worked but I never built many passthroughs for it. The trouble with the tabletop ones is that it's such a pain to set up all the I/O passthroughs and stuff, often it's just not justifiable to go through the hassle, and it just doesn't get used. Being able to walk in and just use your own hands to manipulate the DUT is huge. If you're not dealing with high power, it's plenty safe, and it just saves a ton of time.
rkagerer 2y ago
Is the hearing aid feature unavailable if you use the AirPods with an Android?
- geku3 2y ago
  You need to set it up using Apple device, then it works with Android.
- jijji 2y ago
  I'm not a genius but it seems pretty trivial to take the input from a microphone and pipe it to the output of a speaker, the hardest part probably is the device drivers for the airpods (or any bluetooth ear buds for that matter). It looks like others have already done this in hardware [0] for $84.99 on amazon.com. There is also "Sound Amplifier" app for Apple iPhone [1] that amplifies the surrounding voice near the phone. [0] https://www.amazon.com/Hearing-Seniors-Rechargeable-Bluetooth-Amplifier/dp/B0D62L2GJ3 https://www.amazon.com/Hearing-Seniors-Rechargeable-Bluetoot... [1] https://apps.apple.com/us/app/sound-amplifier/id1615079093 https://apps.apple.com/us/app/sound-amplifier/id1615079093
  - ilt 2y ago
    It’s really not that simple. AirPods settings where you can tune audio for vocal range, balanced tone, brightness or your audiogram - which does much more fine tuning to the sounds you hear than just amplification.
  - grahamj 2y ago
    It sounds like they also do multiband compression (hearing protection) and multiband transparency/cancelling mixing (adaptive mode) on top of applying EQ (audiogram support) and things like accelerometer and wideband tracking for spatial audio. There's quite a bit of processing going on on-device.
RobMurray 2y ago
Is this actually different from the custom transparency mode in accessibility / headphone accommodations that existed before they even announced the hearing aid feature? It can use an audiogram stored in the health app. sounds pretty terrible with custom transparency mode though, a bit like a comb filter.
- ilt 2y ago
  Exactly. I don’t think it’s different. I have been its user since March.
sagz 2y ago
Can this be used to get EU specific features too? (AltStore and such)
- nsokolsky 2y ago
  Don't see any reason why it wouldn't work. I suspect you don't even need a microwave in most places.
- thel3l 2y ago
  Probably would work, however I suspect the changes would not be as sticky. Apple has some slightly more complex checks that they have used in the past to georestrict stuff like ECG, by using MCC/MNC codes from your mobile network. I suspect that the alt stores would be region locked and stop working outside the EU—but that remains to be tested, and seems like a fun thing to experiment with.
notpushkin 2y ago
Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.
- nimih 2y ago
  You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.
  - notpushkin 2y ago
    Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS. There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.
    - NavinF 2y ago
      He tried that. The phone knows its location using GPS and wifi. Apple doesn't care about your IP
  - tim-- 2y ago
    You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP. The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.
    - dmcc365 2y ago
      Have you seen success with this method?
auspbro 2y ago
awesome hacking...
jrockway 2y ago
> Since WiFi and a microwave operate at the same frequency (2.4GHz), we ran our leaky microwave at full power to block out any persistent network signals in the air. Incidentally, WiFi tries to intentionally avoid this interference. Microwaves output no power during the zero crossing of the AC line that's driving it, and in this interval, there is no signal in the air to jam things. WiFi listens before sending (so as to avoid stepping on other stations), and the microwave's signal is enough to trigger this. (I forget if microwave ovens are "half wave" and you get 1/120th of a second 60 times a second, or if there is just a threshold near the zero crossing where there isn't enough power to interfere.) I would say it's likely that the microwave oven didn't really do much here.
- subarctic 2y ago
  Whatever the theoretical analysis tells you, I've been able to reproduce a microwave interfering with a wifi signal with at least one microwave and router. I've had other times where it didn't have a noticeable effect though.
  - jrockway 2y ago
    The key to happiness in WiFi is that all the stations have to "hear" each other, or the listen-before-talk algorithm can't work and you end up stepping on valid transmissions that you can't hear. This ruins it for the stations that are the targets of that transmission but can also hear the first station. This is why WiFi tends to degrade at longer ranges; with a topology like <computer A> <---> <access point> <----> <computer B>, both computers can hear the access point, but can't hear each other. This means that they step on each other when talking to the access point; when this happens, the access point sees the sum of the two signals which is has to discard as garbage. As a result, whenever you see enterprise WiFi that actually works, you'll probably be able to see a ton of access points covering a large room. This is so that they can transmit at low power, causing devices in the above topology to roam to a different access point before they enter the failure mode of not hearing other stations connected to that access point. Now that I think about it, in OP's case, it's quite possible that the iPad can "hear" the microwave, but the access point can't, so the access point will send out its SSID broadcast while the microwave is interfering. This is great because you WANT that packet to get corrupted. So maybe the microwave does help!
tanvach 2y ago
Don’t know if running the microwave does much, since there are plenty of 5Ghz access points around too.
- thel3l 2y ago
  5GHz has quite low penetrating power, so for the most part our issue was 2.4GHz.
eliasdaler 2y ago
This showcases why free software is important. Geo-locking is a such hostile practice which makes zero sense here. If the software/firmware was free and open, you’d be able to patch out/disable the geo-lock. But it probably wouldn’t be there in the first place…
- pasc1878 2y ago
  Yes it does make sense in the general case. In the approved countries a regulatory body has had to approve this as a medical aid. If medical aids etc did not have to be approved then things that actually hurt and kill people could be sold as medical aids. The issue here is that this case appears to be a non damaging aid and so it looks silly to ban it. But regulations have to work otherwise they are of no use. The issue here is either regulators in other countries are slow or in the worst case Apple has not applied for approval.
  - deleted 2y ago
    [deleted]
  - afh1 2y ago
    Thank God for regulators! How dangerous would life be otherwise. How could we live without them?
    - pasc1878 2y ago
      Look at 19th Century deaths in places like coal mines, deaths due to poisonous medicines, asbestos, lack of sewage. Public health has had more effect than anyother medical change.
      - afh1 2y ago
        Constructing sewage, the evolving history of work, and regulating hearing aids have very little in common, and apart from the last very little to do with regulators.
PeterStuer 2y ago
Reminds me on how I setup laptops these days for geodisplaced vpn enjoyment. Have the laptop on the vpn even during OS install. Never run the vpn client on the laptop. Never connect to any other network. Use the target's localisation (language, kb, timezone) during install. Have a dedicated browser with detailed location features turned off for your target sites.
biosboiii 2y ago
Does anyone know which decompilation tool produces these graphs, as shown in the blog post?
- biosboiii 2y ago
  Found it out myself, https://binary.ninja/ https://binary.ninja/
  - thel3l 2y ago
    Yep, sorry! It is Binary Ninja
ryanmccullagh 2y ago
I bought AirPods Pro this year and it has been disappointing compared to the first gen non pro I had previously. Somehow they fall out of my if i adjust my head down. Battery life is good though
- udp 2y ago
  I’ve found that aftermarket memory foam eartips work much better than the stock ones for keeping them in my ears.
  - grahamj 2y ago
    Yep. I'm kind of shocked Apple doesn't offer these as they must be a huge moneymaker.
  - astrange 2y ago
    SednaEarFit Crystal work best for me - they're sticky and sound better than the foam ones.
trhway 2y ago
>modern devices position you within cities by using a combination of WiFi SSIDs + MAC addresses of routers and devices around you as well as GPS to triangulate your location. This was also the reason that our WiFi only iPad was able to display an accurate location in apps even though it had neither GPS nor cellular. can't wait for this to find its way into Tomahawk missiles as a fallback for the jammed GPS environment
- beardyw 2y ago
  Google street view cars have been collecting this data since the beginning. Google have, or at least had, an api where you can feed in mac addresses (SSIDs are an irrelevance) and get a location.
- rtkwe 2y ago
  They can already perform accurate strikes without GPS with terrain following and INS so not sure this would actually help it that much.
  - trhway 2y ago
    My point wasn't about it being necessary. The point is what it may happen as part of complex engineering involving multiple components and large organizations. And/or by integrating consumer tech - the cheap consumer drones are actively used in the modern war and they may have such fallback mode which would be fine for civilian drone, until of course the drone gets a real warhead attached :)
    - rtkwe 2y ago
      For something slow moving like a quadcopter drone munition it might be viable but it seems like you'd not get good signal until it was too late to maneuver if it were in something fast moving like a guided bomb or cruise missile flying down. Also the probability that power is still functioning long into a conflict is pretty low so it may only really be useful for early strikes.
shawa_a_a 2y ago
A commenter on Reddit [1] pointed out that you can access the hearing test feature directly by using a special URL: x-apple-health://HearingAppPlugin.healthplugin/HearingTest I wonder if there’s a similar deep link to be found to enable Hearing Aid mode? 1: https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_hearing_aid_test_available_in_the_uk/ https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_...
- thel3l 2y ago
  This was one of the rabbitholes I chased down, but didn't find anything. At some level, this was just the easier approach :) I'm sure there's something though. Apple changed the URL handler schemes for iOS 18, so a lot of old repos that reference that don't work anymore.
supersing 2y ago
Some Chinese users have discovered a more effective way to bypass geo-locking, even on iPhones (some Apple Health features require approval and can only be enabled on iPhone, not iPad). TLDR, iPhones prioritize external GPS devices over internal ones. All you need is a "fake" lightning or USB-C external GPS device that tells your device where you want it to think it is. Source: https://www.v2ex.com/t/1075937 https://www.v2ex.com/t/1075937
- thel3l 2y ago
  Yeah, Apple sometimes checks MCC/MNC on the cellular network as well, for some reason they chose not to lock it down that way here. However, if they did lock it to require an iPhone, the way we would activate would be by using our Faraday cage to spoof GPS inside it, and maybe a spoofed base station.
kuon 2y ago
How can the GET request be modified if it uses HTTPS? You can spoof certificates on iOS devices with dev tools?
sheerun 2y ago
This is just low point for Apple and any company who does something like this

591 points by rithvikvibhu 2y ago

josephcsible 2y ago

[flagged]

sneak 2y ago
It would be illegal for them to sell AirPods in many countries without these lockouts. The sale of medical devices is heavily regulated in most places. Headphones: legal. Hearing aids: not. Blame the government, not the company that's following the rules laid down.
- nixosbestos 2y ago
  Completely ignorant question, but what does it come down to? What if I released this feature but didn't call it "hearing aid", nor positioned it as medical device? Is a phone with optical zoom, a "vision-enhancing device" and regulated like eye wear?
  - sneak 2y ago
    Does it look like a duck? Does it quack like duck? In-ear devices with speaker and mic that look like hearing aids that perform hearing aid function for those with hearing loss? Hearing aids. Phones, that look nothing like glasses or contacts, and don't serve the same purpose? Obviously not. Don't be silly. Judges aren't.
    - nixosbestos 2y ago
      I really wasn't trying to be silly. I feel like other medical things in the US are regulated differently based purely on how they're marketed. How about an Apple Vision Pro with optical zoom on the exterior cameras?
      - kube-system 2y ago
        > I feel like other medical things in the US are regulated differently based purely on how they're marketed. They aren't. Different classes of medical or medical-adjacent products in the US have to be careful how they market so they aren't making claims that they are not allowed to make, but the absence of those claims alone doesn't make a regulated device unregulated.
    - luqtas 2y ago
      we could all use some civil disobedience for the good of our kind; “The only obligation which I have a right to assume is to do at any time what I think right.”
    - userbinator 2y ago
      In-ear devices with speaker and mic that look like hearing aids that perform hearing aid function for those with hearing loss? Hearing aids. By that definition every TWS with transparency mode and parametric EQ is a hearing aid.
  - NightMKoder 2y ago
    Presumably depends on the country and the laws. Keep in mind that Apple considers this a new interesting use case - not a killer feature for AirPods. They wouldn’t risk AirPod sales with a gray interpretation of the law.
  - K0balt 2y ago
    Regulated devices have very specific definitions like is represented as O, or does x or z and a and b, or x and b. Things like that. The definition typically hinges on very specific parameters and ALSO what it is called. That way no one can sell an inert plug as a “hearing aid”, and no one can sell a hearing aids as “conversation enhancing devices “ to evade certification requirements if they meet the bar feature-wise to be a hearing aid.
  - bongodongobob 2y ago
    A malfunctioning hearing aid/earbud can potentially cause permanent hearing damage. Unless it explodes, a misbehaving phone can't damage your vision.
    - NavinF 2y ago
      Non sequitur. You could say that about any high quality set of headphones since they're capable of much higher power output than hearing aids.
      - bongodongobob 2y ago
        I'm not saying it makes sense, but that's the idea.
        Retr0id 2y ago
        It's still a non-sequitur because regular earphones are not subject to such regulations.
        kube-system 2y ago
        No, medical devices are regulated because society demands a certain degree of certainty from those who claim to treat medical issues. Most societies don't want it to be legal to sell snake oil to vulnerable people suffering from a health issue. There are many dangerous unregulated things that can destroy your hearing or vision. But they don't claim to protect them.
    - deleted 2y ago
      [deleted]
    - deleted 2y ago
      [deleted]
- Krasnol 2y ago
  Why should anyone blame the government when it's obvious that Apple cared about those regulations and filed the paperwork in some countries but not in others? OP is still right here. The argument stands.
- enjaydee 2y ago
  Blame governments for regulating medical devices? You're going to need a better argument than that. This is entirely on Apple not applying for regulatory approval.
  - kube-system 2y ago
    Is that even the case? Did they not apply anywhere else? Do they even qualify anywhere else? This wouldn't even have been possible under US law until recently. If Apple tried to do this in the past in the US, they would have made it illegal to buy AirPods without a prescription, which is obviously a regulatory nonstarter.
elzbardico 2y ago
This is a regulatory issue, so you can stop the baseless hating.
- capitainenemo 2y ago
  Is it a regulatory issue? Could it be the hearing aid feature has an AI/voice recognition component trained on certain languages when it runs the "enhancement"? (no idea, just wondering, since the apple page had zero details)
  - resonanttoe 2y ago
    The FDA has to certify the devices for use as hearing aids in the U.S Other countries have similar regulatory bodies the certify the use of a medical device. Hearing aids (and things sold as it) are medical devices.
    - Krasnol 2y ago
      So what? You file the paperwork, pay for it and you get the certification. They decided that they won't do that in India. This is all. They even did that in Germany and the whole world know how much of a hassle it had to be...but Germany has a more significant market share and potential than India so....we all know it's just about the money.
      - elzbardico 2y ago
        It is all just about the money. Or India's government could have given a special waive. But Apple is a private company, private companies usually do things for money.
        Krasnol 2y ago
        Oh yeah, please give the poor fruit company an SPECIAL waive so they don't have to be treated like all the peasant companies.
    - 2y ago
samatman 2y ago
So your theory is what, malice? Apple makes AirPods the cheapest hearing aids by a long shot, except for some customers that they hate? The problem is simple: hearing aids are regulated products, and countries tend to insist on individually certifying them. Getting the right to market AirPods as hearing aids in the US wasn't cheap, I'm sure. There needs to be international harmonization of these regulations. It isn't just hurting Apple and Apple's customers, it hurts everyone. Perhaps Apple has decided that it's too expensive to pass those regulations in certain markets, but my bet is that it just takes longer in the EU and India. I guess we'll see.
- Krasnol 2y ago
  OP didn't say it's about hate, and why would you assume OP meant hate? There are many other obvious reasons. Like the market share for example. To hate requisites that you care enough...and that you are not a corporation...
- blkhawk 2y ago
  Then don't bloody call it a hearing aid then in those countries - call it "adjusted transparent mode with equalizer". Stuff that coincidentally works as a hearing aid is not regulated as far as I can tell anyway simply because I never heard of a government that would confiscate an amplifier with an equalizer function build in as soon as somebody plugged headphones and a microphone into it.
kube-system 2y ago
> It couldn't have been easy or cheap for them to add all these antifeatures. It was definitely cheap to add this region lock: it's a single `if` statement calling existing system libraries. The regulatory side of this is the expensive part, and it varies by country, and many places make it illegal for hearing aids to be sold over the counter no matter how much Apple wants to release it there. Even the US would have prohibited this feature until regulatory changes that happened in 2022.

post_break 2y ago

Does this reset itself after a certain amount of time or is it one and done? I'd be worried about the feature being removed when the iPad or airpods decide they've been in India for too long.

thel3l 2y ago
Heya! One of the authors here. Nope, its a one time thing. When the feature is enabled, a flag is set on the iCloud account, so you can travel anywhere and have it work. At the same time, a EQ profile is pushed to the transparency mode of the Airpods, enabling the hearing aid features. Once done, it sticks with the Airpods, unless you reset them. However, an interesting quirk is that if you enable this on someone's airpods, and _their_ device/account does not have it 'available', they wont be able to tweak the settings on their device.
- post_break 2y ago
  Very cool, glad it sticks.
- ilt 2y ago
  I live in India and I have been using hearing aid feature since at least March when I bought Airpods Pro. Only that it wasn’t called as such earlier. It uses the audiogram I had provided it which it used to create a customized equalizer for my hearing disability. I am sure they must have improved upon the capability in new OS versions but functionally it has been present for a while now.
  - _rs 2y ago
    I suppose the difference is 1st party support for creating the audiogram, plus the clearance from the US gov to market it the way they want as OTC hearing aids
    - lathiat 2y ago
      It also applied the same profile to both ears, which matters for some. My hearing loss is highly asymmetric.

pomian 2y ago

Looking forward to further write ups on faraday cages, design and uses. That was great what you did with the air pods.

thel3l 2y ago

Hey! I'm Rithwik, one of the authors of the article, happy to answer questions etc!

carbonguy 2y ago
Mainly just wanted to say, this is an absolutely fantastic hack and I loved reading about it - thank you for sharing! I guess if I have one question, it would be... what else are you planning to do with your new Faraday cage?
- thel3l 2y ago
  Thank you for reading and the kind words! We're almost looking forward to this loophole being shut down to really make things a tad bit more challenging haha We've got some ideas for the Faraday cage—a whole bunch of networks research and hacking that we can do without messing up live systems! It's also really nice to be able to test a device in isolation, without worrying about whether it's phoning back home in some way.
  - ryandrake 2y ago
    > We're almost looking forward to this loophole being shut down to really make things a tad bit more challenging haha This is a great attitude in the face of a pretty sad 2024 reality: that the manufacturer of a device is expected to intentionally go out of its way to remotely stop users from using the device they bought in the way they want to use it.
- itsarnavb 2y ago
  I'm thinking of making it easy to "teleport" to any location within the cage Imagine typing in coordinates or picking a location on a map, and then suddenly your phone or any other device is at that location inside the cage, by a combination of GPS, cellular and WiFi spoofing My former manager called it a portal haha: https://x.com/masadfrost/status/1856467695606345756 https://x.com/masadfrost/status/1856467695606345756
vintagedave 2y ago

kristofferR 2y ago

Does anyone know what the Hearing Protection mode does? It's not available in Norway (or anywhere outside of NAmerica). I've used the AirPods Pro 2 as hearing protection for some stuff before, it works fine. Is it just due to the words ("Hearing Protection") which they are only allowed to use only in America or is it actually better than regular Pro 2 noise-cancelling?

grahamj 2y ago
I'm pretty sure all that's new is the hearing test app and marketing. AirPods already had these features. From listening to it work HP sounds to me like multiband compression, in other words divide up the audible spectrum into multiple bands and apply compression on each one individually. Again it was already doing this though.

tzs 2y ago

> Hearing aids typically cost anywhere from ₹ 50,000 to upwards of ₹ 8L depending on the correction capability For those who don't recognize the ₹ symbol it is the symbol for the Indian Rupee and an "L" after a number means 100,000, so ₹ 8L is ₹ 800,000. At current exchange rates that puts hearing aids in India from $600 to upwards of $9,500. AirPods Pro 2 are ₹ 24,900 ($295).

hoistbypetard 2y ago
Thanks for posting this. I recognized the currency symbol but was confused by the "L".
- JumpCrisscross 2y ago
  The Indian numbering system marks odd power of ten, i.e. 10 ^ {1, 3, 5, 7}. Unit, thousand, lakh, crore [1]. Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3, 6, 9}. Thousands, millions, billions, et cetera. [1] https://en.m.wikipedia.org/wiki/Indian_numbering_system https://en.m.wikipedia.org/wiki/Indian_numbering_system
  - eru 2y ago
    > Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3, 6, 9}. Thousands, millions, billions, et cetera. To make matters more confusing, for American English it goes millions, billions, trillions. For British English it used to go millions, milliards, billions, billiards, trillions, trilliards. (That 'long scale' is still the way German used to work ten years ago. No clue if it changed in the meantime.)
    - andreareina 2y ago
      I still mourn the long scale. A billion is obviously a million millions.
      - SushiHippie 2y ago

xxxuuhshhjwuu 2y ago

[flagged]

userbinator 2y ago

It appears that the Hearing Aid feature is actually an equalizer preset that is pushed to the AirPods and will replace your transparency mode. Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but perhaps that was a huge calculated risk. There's an incredible amount of processing power and flexibility in these things. Even the sub-$10 ones using the infamous JieLi SoCs - a 160MHz 32-bit computer in each ear. I'm surprised there hasn't yet been any TWS advertised with open-source firmware, although there's been some work in the usual Chinese (and Russian) communities on customisations.

nfriedly 2y ago
> I'm surprised there hasn't yet been any TWS advertised with open-source firmware Let me introduce you to the PineBuds Pro: https://pine64.com/product/pinebuds-pro-open-firmware-capable-anc-wireless-earbuds/ https://pine64.com/product/pinebuds-pro-open-firmware-capabl...
- userbinator 2y ago
  User can flash in PINE64 community open firmware when becomes[sic] available. I did manage to find the firmware, but it says that it doesn't have ANC, which the factory firmware does. Good start nonetheless.
- aftbit 2y ago
  >Excessive flashing Pinebuds can potentially brick the device. Jeez that's not great. Hard to develop on these devices when too many flashes kills them.
  - userbinator 2y ago
    The flash on these SoCs is usually designed to be programmed once at the factory, and then perhaps the occasional firmware update. Endurance is in the ~100 cycles range.

myself248 2y ago

This is fantastic! We're building a walk-in-closet-sized Faraday cage at i3Detroit, though of course we're in the US so we won't need it for this specific hack, there's a zillion reasons it's fun to have one! Off the top of my head: The biggie is that we're right down the street from WOMC's transmitter, which is 135,000 watts EIRP. It gets into EVERYTHING and makes other RF measurements more difficult, so if you're trying to align an amplifier or something, it's nice to start from a quiet place and get the basics solid, and only THEN add sources of potential intermod and stuff. Debugging wifi, bluetooth, and other wireless stuff without a zillion other nodes in view. Yes you can filter the output of a sniffer, but it's more fun to filter the input. ;) Lighting up a 1G or 2G cellular network without worrying about spectrum licensing. Practicing offensive wifi techniques or other stuff that might interfere with the hackerspace's existing network. Playing with GPS spoofers in an FCC-free zone. Or anything else you might find amusing but want to do responsibly. Locking an iPhone in there to see if it reboots itself... (rofl)

thel3l 2y ago
Yes!! Shocked we made it this far in life without one! Itching to put devices inside and light the air inside up without worrying about licensing! We actually ended up seeing a life size Faraday cage at Indian Institute of Science—felt good to see that the construction was similar to our approach
- myself248 2y ago
  Oh sweet! I've used little tabletop ones at work, and ended up building myself one using the housing of some scrapped microwave equipment (it got hit by lightning so the circuits were junk, but the RF-gasketed housing was in great shape.) It worked but I never built many passthroughs for it. The trouble with the tabletop ones is that it's such a pain to set up all the I/O passthroughs and stuff, often it's just not justifiable to go through the hassle, and it just doesn't get used. Being able to walk in and just use your own hands to manipulate the DUT is huge. If you're not dealing with high power, it's plenty safe, and it just saves a ton of time.

rkagerer 2y ago

Is the hearing aid feature unavailable if you use the AirPods with an Android?

geku3 2y ago
You need to set it up using Apple device, then it works with Android.
jijji 2y ago
I'm not a genius but it seems pretty trivial to take the input from a microphone and pipe it to the output of a speaker, the hardest part probably is the device drivers for the airpods (or any bluetooth ear buds for that matter). It looks like others have already done this in hardware [0] for $84.99 on amazon.com. There is also "Sound Amplifier" app for Apple iPhone [1] that amplifies the surrounding voice near the phone. [0] https://www.amazon.com/Hearing-Seniors-Rechargeable-Bluetooth-Amplifier/dp/B0D62L2GJ3 https://www.amazon.com/Hearing-Seniors-Rechargeable-Bluetoot... [1] https://apps.apple.com/us/app/sound-amplifier/id1615079093 https://apps.apple.com/us/app/sound-amplifier/id1615079093
- ilt 2y ago
  It’s really not that simple. AirPods settings where you can tune audio for vocal range, balanced tone, brightness or your audiogram - which does much more fine tuning to the sounds you hear than just amplification.
- grahamj 2y ago
  It sounds like they also do multiband compression (hearing protection) and multiband transparency/cancelling mixing (adaptive mode) on top of applying EQ (audiogram support) and things like accelerometer and wideband tracking for spatial audio. There's quite a bit of processing going on on-device.

RobMurray 2y ago

Is this actually different from the custom transparency mode in accessibility / headphone accommodations that existed before they even announced the hearing aid feature? It can use an audiogram stored in the health app. sounds pretty terrible with custom transparency mode though, a bit like a comb filter.

ilt 2y ago
Exactly. I don’t think it’s different. I have been its user since March.

sagz 2y ago

Can this be used to get EU specific features too? (AltStore and such)

nsokolsky 2y ago
Don't see any reason why it wouldn't work. I suspect you don't even need a microwave in most places.
thel3l 2y ago
Probably would work, however I suspect the changes would not be as sticky. Apple has some slightly more complex checks that they have used in the past to georestrict stuff like ECG, by using MCC/MNC codes from your mobile network. I suspect that the alt stores would be region locked and stop working outside the EU—but that remains to be tested, and seems like a fun thing to experiment with.

notpushkin 2y ago

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

nimih 2y ago
You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.
- notpushkin 2y ago
  Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS. There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.
  - NavinF 2y ago
    He tried that. The phone knows its location using GPS and wifi. Apple doesn't care about your IP
- tim-- 2y ago
  You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP. The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.
  - dmcc365 2y ago
    Have you seen success with this method?

auspbro 2y ago

awesome hacking...

jrockway 2y ago

> Since WiFi and a microwave operate at the same frequency (2.4GHz), we ran our leaky microwave at full power to block out any persistent network signals in the air. Incidentally, WiFi tries to intentionally avoid this interference. Microwaves output no power during the zero crossing of the AC line that's driving it, and in this interval, there is no signal in the air to jam things. WiFi listens before sending (so as to avoid stepping on other stations), and the microwave's signal is enough to trigger this. (I forget if microwave ovens are "half wave" and you get 1/120th of a second 60 times a second, or if there is just a threshold near the zero crossing where there isn't enough power to interfere.) I would say it's likely that the microwave oven didn't really do much here.

subarctic 2y ago
Whatever the theoretical analysis tells you, I've been able to reproduce a microwave interfering with a wifi signal with at least one microwave and router. I've had other times where it didn't have a noticeable effect though.
- jrockway 2y ago
  The key to happiness in WiFi is that all the stations have to "hear" each other, or the listen-before-talk algorithm can't work and you end up stepping on valid transmissions that you can't hear. This ruins it for the stations that are the targets of that transmission but can also hear the first station. This is why WiFi tends to degrade at longer ranges; with a topology like <computer A> <---> <access point> <----> <computer B>, both computers can hear the access point, but can't hear each other. This means that they step on each other when talking to the access point; when this happens, the access point sees the sum of the two signals which is has to discard as garbage. As a result, whenever you see enterprise WiFi that actually works, you'll probably be able to see a ton of access points covering a large room. This is so that they can transmit at low power, causing devices in the above topology to roam to a different access point before they enter the failure mode of not hearing other stations connected to that access point. Now that I think about it, in OP's case, it's quite possible that the iPad can "hear" the microwave, but the access point can't, so the access point will send out its SSID broadcast while the microwave is interfering. This is great because you WANT that packet to get corrupted. So maybe the microwave does help!

tanvach 2y ago

Don’t know if running the microwave does much, since there are plenty of 5Ghz access points around too.

thel3l 2y ago
5GHz has quite low penetrating power, so for the most part our issue was 2.4GHz.

eliasdaler 2y ago

This showcases why free software is important. Geo-locking is a such hostile practice which makes zero sense here. If the software/firmware was free and open, you’d be able to patch out/disable the geo-lock. But it probably wouldn’t be there in the first place…

pasc1878 2y ago
Yes it does make sense in the general case. In the approved countries a regulatory body has had to approve this as a medical aid. If medical aids etc did not have to be approved then things that actually hurt and kill people could be sold as medical aids. The issue here is that this case appears to be a non damaging aid and so it looks silly to ban it. But regulations have to work otherwise they are of no use. The issue here is either regulators in other countries are slow or in the worst case Apple has not applied for approval.
- deleted 2y ago
  [deleted]
- afh1 2y ago
  Thank God for regulators! How dangerous would life be otherwise. How could we live without them?
  - pasc1878 2y ago
    Look at 19th Century deaths in places like coal mines, deaths due to poisonous medicines, asbestos, lack of sewage. Public health has had more effect than anyother medical change.
    - afh1 2y ago
      Constructing sewage, the evolving history of work, and regulating hearing aids have very little in common, and apart from the last very little to do with regulators.

PeterStuer 2y ago

Reminds me on how I setup laptops these days for geodisplaced vpn enjoyment. Have the laptop on the vpn even during OS install. Never run the vpn client on the laptop. Never connect to any other network. Use the target's localisation (language, kb, timezone) during install. Have a dedicated browser with detailed location features turned off for your target sites.

biosboiii 2y ago

Does anyone know which decompilation tool produces these graphs, as shown in the blog post?

biosboiii 2y ago
Found it out myself, https://binary.ninja/ https://binary.ninja/
- thel3l 2y ago
  Yep, sorry! It is Binary Ninja

ryanmccullagh 2y ago

I bought AirPods Pro this year and it has been disappointing compared to the first gen non pro I had previously. Somehow they fall out of my if i adjust my head down. Battery life is good though

udp 2y ago
I’ve found that aftermarket memory foam eartips work much better than the stock ones for keeping them in my ears.
- grahamj 2y ago
  Yep. I'm kind of shocked Apple doesn't offer these as they must be a huge moneymaker.
- astrange 2y ago
  SednaEarFit Crystal work best for me - they're sticky and sound better than the foam ones.

trhway 2y ago

>modern devices position you within cities by using a combination of WiFi SSIDs + MAC addresses of routers and devices around you as well as GPS to triangulate your location. This was also the reason that our WiFi only iPad was able to display an accurate location in apps even though it had neither GPS nor cellular. can't wait for this to find its way into Tomahawk missiles as a fallback for the jammed GPS environment

beardyw 2y ago
Google street view cars have been collecting this data since the beginning. Google have, or at least had, an api where you can feed in mac addresses (SSIDs are an irrelevance) and get a location.
rtkwe 2y ago
They can already perform accurate strikes without GPS with terrain following and INS so not sure this would actually help it that much.
- trhway 2y ago
  My point wasn't about it being necessary. The point is what it may happen as part of complex engineering involving multiple components and large organizations. And/or by integrating consumer tech - the cheap consumer drones are actively used in the modern war and they may have such fallback mode which would be fine for civilian drone, until of course the drone gets a real warhead attached :)
  - rtkwe 2y ago
    For something slow moving like a quadcopter drone munition it might be viable but it seems like you'd not get good signal until it was too late to maneuver if it were in something fast moving like a guided bomb or cruise missile flying down. Also the probability that power is still functioning long into a conflict is pretty low so it may only really be useful for early strikes.

shawa_a_a 2y ago

A commenter on Reddit [1] pointed out that you can access the hearing test feature directly by using a special URL: x-apple-health://HearingAppPlugin.healthplugin/HearingTest I wonder if there’s a similar deep link to be found to enable Hearing Aid mode? 1: https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_hearing_aid_test_available_in_the_uk/ https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_...

thel3l 2y ago
This was one of the rabbitholes I chased down, but didn't find anything. At some level, this was just the easier approach :) I'm sure there's something though. Apple changed the URL handler schemes for iOS 18, so a lot of old repos that reference that don't work anymore.

supersing 2y ago

Some Chinese users have discovered a more effective way to bypass geo-locking, even on iPhones (some Apple Health features require approval and can only be enabled on iPhone, not iPad). TLDR, iPhones prioritize external GPS devices over internal ones. All you need is a "fake" lightning or USB-C external GPS device that tells your device where you want it to think it is. Source: https://www.v2ex.com/t/1075937 https://www.v2ex.com/t/1075937

thel3l 2y ago
Yeah, Apple sometimes checks MCC/MNC on the cellular network as well, for some reason they chose not to lock it down that way here. However, if they did lock it to require an iPhone, the way we would activate would be by using our Faraday cage to spoof GPS inside it, and maybe a spoofed base station.

kuon 2y ago

How can the GET request be modified if it uses HTTPS? You can spoof certificates on iOS devices with dev tools?

sheerun 2y ago

This is just low point for Apple and any company who does something like this