{"id":37570,"date":"2022-11-04T17:34:34","date_gmt":"2022-11-04T21:34:34","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=37570"},"modified":"2023-12-06T14:20:45","modified_gmt":"2023-12-06T19:20:45","slug":"sirispy-bug","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2022\/11\/04\/sirispy-bug\/","title":{"rendered":"SiriSpy Bug"},"content":{"rendered":"<p><a href=\"https:\/\/rambo.codes\/posts\/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop\">Guilherme Rambo<\/a> (<a href=\"https:\/\/twitter.com\/_inside\/status\/1585319035708882954\">tweet<\/a>, <a href=\"https:\/\/news.ycombinator.com\/item?id=33348013\">Hacker News<\/a>):<\/p>\n<blockquote cite=\"https:\/\/rambo.codes\/posts\/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop\">\n<p>Any app with access to Bluetooth could record your conversations with Siri and audio from the iOS keyboard dictation feature when using AirPods or Beats headsets. This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone.<\/p>\n<p>[&#8230;]<\/p>\n<p>Knowing that the drop in output quality when using the microphone is a physical limitation of the Bluetooth standards used by AirPods and other similar headsets, how talk to Siri had been implemented on AirPods without disrupting audio quality had always been a bit of a mystery to me[&#8230;] I noticed that the AirPods included a service with the UUID 9bd708d7-64c7-4e9f-9ded-f6b6c4551967, and with characteristics that supported notifications. [&#8230;] As soon as I did that, a firehose of hex bytes started to stream down my Terminal window.<\/p>\n<p>[&#8230;]<\/p>\n<p><a href=\"https:\/\/rambo.codes\/posts\/2022-03-15-how-a-macos-bug-could-have-allowed-for-a-serious-phishing-attack-against-users\/\">You can probably see where this is going<\/a>: <code>BTLEServerAgent<\/code> did not have any entitlement checks or TCC prompts in place for its <code>com.apple.BTLEAudioController.xpc<\/code> service, so any process on the system could connect to it, send requests, and receive audio frames from AirPods.<\/p>\n<p>[&#8230;]<\/p>\n<p>I was told I&rsquo;ll be receiving a US$7000 bug bounty payment for reporting these issues<\/p>\n<\/blockquote>\n<p>I think he deserves a lot more.<\/p>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2022\/10\/27\/apple-security-research-blog\/\">Apple Security Research Blog<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2022\/02\/11\/bug-opted-users-back-in-to-sharing-siri-recordings\/\">Bug Opted Users Back In to Sharing Siri Recordings<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/07\/13\/more-trouble-with-the-apple-security-bounty\/\">More Trouble With the Apple Security Bounty<\/a><\/li>\n<\/ul>\n\n<p id=\"sirispy-bug-update-2022-11-30\">Update (2022-11-30): <a href=\"https:\/\/rambo.codes\/posts\/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop\">Guilherme Rambo<\/a> (<a href=\"https:\/\/twitter.com\/_inside\/status\/1590692132247203840\">tweet<\/a>):<\/p>\n<blockquote cite=\"https:\/\/rambo.codes\/posts\/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop\"><p>The original version of this article mentioned a bug bounty payment of US$7000. However, this was due to an issue with the way Apple&rsquo;s security team had communicated about the bounty. They broke down the two vulnerabilities discovered into separate CVEs, one of which was awarded a bounty of US$7000, while the other one was awarded US$22500. So the total bounty payment for the bugs described in this report was of US$29500. Apple&rsquo;s security team apologized for the confusion, and has since released a new web platform for bug submissions, which should make this a lot better going forward.<\/p><\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Guilherme Rambo (tweet, Hacker News): Any app with access to Bluetooth could record your conversations with Siri and audio from the iOS keyboard dictation feature when using AirPods or Beats headsets. This would happen without the app requesting microphone access permission and without the app leaving any trace that it was listening to the microphone. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2022-11-04T21:34:36Z","apple_news_api_id":"04f8c571-5016-46fe-bb37-a0eb1d8418c0","apple_news_api_modified_at":"2023-12-06T19:20:48Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAg==","apple_news_api_share_url":"https:\/\/apple.news\/ABPjFcVAWRv67N6DrHYQYwA","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[1422,2098,95,422,131,2518,31,2185,30,2077,355,247,1960],"class_list":["post-37570","post","type-post","status-publish","format-standard","hentry","category-technology","tag-airpods","tag-apple-security-bounty","tag-audio","tag-bluetooth","tag-bug","tag-entitlements","tag-ios","tag-ios-16","tag-mac","tag-macos-12","tag-privacy","tag-siri","tag-transparency-consent-and-control-tcc"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=37570"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37570\/revisions"}],"predecessor-version":[{"id":37775,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37570\/revisions\/37775"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=37570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=37570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=37570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}