AirDrop Log Dehashing
A Chinese state-backed research institute claims to have discovered how to decrypt device logs for Apple’s AirDrop feature, allowing the government to identify phone numbers or email addresses of those who shared content.
[…]
To get around censorship in the country, people turned to Apple’s AirDrop feature, which doesn’t require cellular service and uses Bluetooth and a private Wi-Fi network to send images and photos between devices.
[…]
The research institute says the sender’s device name, email address, and mobile phone number are hashed in the iOS device logs.
Using rainbow tables, the researchers claim to have been able to dehash these fields to gain access to the sender’s information.
It’s not clear to me why this information needs to be logged at all, nor why the government would want to alert Apple to fix this.
To make a long story short: a Private Set Intersection protocol takes a set of strings from the Sender and a set from the Receiver. It gives one (or both parties) the intersection of both sets: that is, the set of entries that appear on both lists. Most critically, a good PSI protocol doesn’t reveal any other information about either of the sets.
[…]
For a variety of mildly defensible reasons — which I will come back to in a moment — Apple does not use a secure PSI protocol to solve their AirDrop problem. Instead they did the thing that every software developer does when faced with the choice of doing complicated cryptography or “hacking something together in time for the next ship date”: they threw together their own solution using hash functions.
[…]
A second important issue here is that the hash identifiers are apparently stored in logs within the recipient’s phone, which means that to obtain them you don’t have to be physically present when the transfer happens. You can potentially scoop them out of someone else’s phone after the fact.
[…]
Hence there is a legitimate question about whether it’s politically wise for Apple to make a big technical improvement to their AirDrop privacy, right at the moment that the lack of privacy is being viewed as an asset by authorities in China. Even if this attack isn’t really that critical to law enforcement within China, the decision to “fix” it could very well be seen as a slap in the face.
Previously:
Update (2024-01-30): Jason Snell:
To a certain degree, Apple relies on stories like this staying under the radar. Inaction can be presented as either ignorance or tacit compliance, whereas taking steps to improve the privacy of AirDrop might be construed by Beijing as a challenge to its authority—a stick situation for Apple, given how much it relies upon its relationship with the country for the production of its devices. But Apple also makes privacy a huge selling point of its devices—a subject of ad campaigns, a highlighted section in virtually every keynote—and the company surely doesn’t want to have to append an asterisk to all of those claims with the footnote “Except in China.”
Sean Lyngaas and Brian Fung (via Hacker News):
Security researchers warned Apple as early as 2019 about vulnerabilities in its AirDrop wireless sharing function that Chinese authorities claim they recently used to track down users of the feature, the researchers told CNN, in a case that experts say has sweeping implications for global privacy.
2 Comments RSS · Twitter · Mastodon
MacOS logs are incredibly detailed, as everyone who has tried to get some useful information out of them surely knows. Regular logs are not kept for very long, though. On macOS, usually only a couple of days at most. It would be interesting to know if AirDrop has a separate log that is more permanent.
I turned off AirDrop ever since they disabled it for everyone. Anyone I know already has my iMessage handle, so what's the point of AirDrop really, other than perhaps as a tool for sending between one's own devices?
And the fact that you can perform a trivial rainbow table lookup to figure out the identity of senders is just icing on the cake. Sure, maybe it helps if you're an authoritarian regime with a penchant for building supercomputers to run attacks that bypass receiving restrictions that are only there for political reasons and not technical ones, but it's always going to be a risk to privacy and security to have a feature like this no matter what you do. Perhaps Apple should just move AirDrop into a dedicated interface that you must explicitly visit to make yourself available, in order to make absolutely sure that it won't be used unless it's absolutely necessary.
