AirXren' – No one knows how it works The report will focus on Apple's wireless technologies in the ecosystem among its devices, the little information that there is about how it works, the privacy and bugs that were encountered earlier. В докладе речь пойдет о беспроводной технологии используемой Apple в экосистеме среди своих устройств, той немногой информации что есть и о том как это работает, приватности и багах что встречались ранее.

1. AirXren’
No one knows how it works
1

2. AGENDA
• Non tech intro (for non  users)
• How does it work
• Logging
• Privacy
• Vuln?
• PreResult
2

3. 3

4. AirX****
• Handoff + Continuity
•  Watch
• AirDrop
• AirPlay
• Bonjour
• Password Sharing
4

5. Handoff + Continuity
• Start on iOS continue on
macOS and vice versa
• Syncronize basic process
(e.g. common clipboard)
5

6. 6

7. 7

8. 8

9.  Watch
• Pairing with iOS
• Receive Notifications and etc.
• Unlock macOS devices
9

10. 10

11. 11

12. AirDrop
• Share files, text and other
between macOS and iOS
12

13. 13

14. 14

15. 15

16. AirPlay
• Stream content to displays
and audio systems
• Media Player APIs support
AirPlay
16

17. 17

18. Bonjour
• Zero-configuration networking,
enables automatic discovery of
devices and services on a local
network using industry
standard IP protocols
• Bonjour makes it easy to
discover, publish, and resolve
network services
• For sharing: Files, Printers, etc.
18

19. 19

20. NB: removed from last macOS20

21. 21

22. Password sharing
• Share password from:
• Wi-Fi
• Hotspot
• Between iOS and macOS with
people from contacts nearby
• iOS 11+
22

23. 23

24. 24

25. 25

26. Intro is over
26

27. How does it work?
27

28. How does it work?
I don’t know
rashodimsya
28

29. AirDrop
• Requirements:
• Turn on Wi-Fi
• Turn on Bluetooth
• macOS / iOS
• Just drag and drop %any% to
nearby contact
• Magic
• Profit !
29

30. Questions?
• How to discover nearby contacts?
• What interface is used?
• Logging actions?
• Privacy?
• Vuln?
30

31. Nearby discovering
• Case 1
– Anonymous both
– Privacy: Everyone (Receiver)
• Case 2
– 1 Anonymous
– Privacy: Everyone (Receiver)
• Case 3
– Contact friends
– Privacy: Contacts, Everyone
31

32. Nearby discovering
• Case X:
– Both owner devices
– Privacy: Contacts or higher
– Sharing without request
32

33. Nearby discovering
• Contacts only
– Any identity at contact list
(e.g. email, phone, etc..)
33

34. What interface is used?
• Physical:
– WiFi
– Bluetooth
• Software:
– AWDL
(Apple Wireless Direct Linking)
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu
1484
ether 6c:ab:16:21:b2:0a
inet6 fe50::4cfb:22ff:fe34:a1da%awdl0 prefixlen 64 scopeid 0x7
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
34

35. AWDL
• IPv6
• mDNS
• Process / Framework: com.apple.sharing (CoreUtils)
/usr/libexec/sharingd
/System/Library/PrivateFrameworks/CoreUtils.framework/CoreUtils
35

36. Console.app
• Track iOS, macOS, watchOS
AirDrop activity
/Applications/Utilities/Console.app
36

37. 37

38. What?
• I can ping AirDrop devices (achievement sound)
ping6 -I awdl0 ee90::c4e2:22ef:ff2e:4cf2
• See discovered devices
OS version, Hardware model, etc..
• AidDrop (sharingd) use Contact.app and fetch data like:
– Emails
– Name
– Phone number
– …
38

39. Privacy?
• iOS 11 – WiFi/BT
• WiFried
39

40. Vulnerabilities
• iOS 8.4.1 and lower
• Directory traversal attack
!
40

41. Fun
“Sitting in a cafe, air dropping
trollfaces to random people.
That’s how I spent my
Saturdays.”
— NeoGazpatchOS
(@NeoNacho) April 30, 2016
NB: can’t compile at last macOS41

42. vmesto zaklu4enia
• Too old bug (iOS 8.4 – 2015)
• Not enough research on this topic (only support.apple.com lol)
• iOS 11 Control Center
• Privacy?
42

43. Topic links
• WiFried
www.intelliborn.com/wifriedx/WiFriedX_1_2.dmg
• WiFried research
1. medium.com/@mariociabarra/wifriedx-in-depth-look-at-yosemite-wifi-and-awdl-
airdrop-41a93eb22e48
2. medium.com/@mariociabarra/wifried-ios-8-wifi-performance-issues-3029a164ce94
• AirDrop Vulns
1. arstechnica.com/information-technology/2015/09/apple-mitigates-but-doesnt-fully-fix-
critical-ios-airdrop-vulnerability/
1.2. www.cultofmac.com/389113/airdrop-vulnerability-is-the-best-reason-yet-to-upgrade-to-
ios-9/
• TrollDrop
github.com/neonichu/trolldrop
• AirDrop Verge
www.theverge.com/tldr/2014/11/10/7171345/the-best-use-for-apple-airdrop-is-space-sloths
43

44. What am I doing?
• Researching this thing
• Trying to figure out how it works (iOS/macOS/watchOS)
• Search for bugs?
44

45. Thank you
Questions?
GitHub, Twitter and so on: @ANSJDNAKJDNAJKD
45