So don’t go to China and if you do don’t send any important but unencrypted files via short-distance signal from one iPhone to another iPhone, gotcha.
China claims it has cracked Apple Airdrop’s encryption to identify senders | CNN Business
Submitted 10 months ago by fne8w2ah@lemmy.world to technology@lemmy.world
https://www.cnn.com/2024/01/10/tech/china-apple-airdrop-encryption-hnk-intl/index.html
Comments
Vub@lemmy.world 10 months ago
jonne@infosec.pub 10 months ago
AirDrop has been used in China by pro-democracy activists to spread their message relatively safely (as you can’t get away with that using the internet). Apple has already made AirDrop useless for that purpose in a recent update, but I guess China is still working on cracking down on it.
Ghostalmedia@lemmy.world 10 months ago
You can still use airdrop to send shit to people about how much the CCP sucks. Airdropping to non-contacts still exists, but when you enable receiving from any rando, that door only remains open for 10 minutes, then you have to open it again.
I guess the question is, do Chinese people keep tapping “everyone for 10 minutes” multiple times in certain public places?
joyjoy@lemm.ee 10 months ago
Apple disabled AirDrop in the China region, then later globally, for people not in your contacts.
In November 2022, […] Apple began to limit AirDrop sharing with non-contacts for devices in China, which made it harder for users to share files with people they didn’t know. That feature was later expanded globally.
Ghostalmedia@lemmy.world 10 months ago
Correct, reviving files from everyone is now only open for 10 min. It was launched in China to appease the CCP, but in western nations where using airdrop to voice government dissent isn’t popular, it was released to stop people from airdropping dick pics on the subway.
Ghostalmedia@lemmy.world 10 months ago
Thing is, the actual airdrop file transfer should be gated behind a 2048-bit RSA hash.
I’m curious to see what the security vulnerability is and how long it will remain open. China has been thirsting to find one for years.
Vub@lemmy.world 10 months ago
I haven’t read anything about cracking the data itself though, just being able to identify the phone number of a sender. The infos they give is just too vague at this point.
Nomad@infosec.pub 10 months ago
No shit Sherlock. The encryption uses the phone number of the user for hashing. Building a rainbow table for all phone numbers is childsplay.
They use a weakness in the protocol to identify the senders number. They can’t see what they send, but who sent something and when and to who.
Ghostalmedia@lemmy.world 10 months ago
Someone correct me if I’m wrong, but it looks like there are two hashes. A short one based on the iCloud account’s email address or phone number, and a long 2048-bit RSA identity that gets stored on the device after logging into iCloud.
It looks like the short identity is basically just used for that initial airdrop screen where you find available targets to airdrop to, but the actual longer, more secure, hash is required for the actual file transfer.
That might explain why finding airdrop contacts is kind of snappy, but there is a bit of a delay after you initiate a transfer.
ripcord@lemmy.world 10 months ago
Thank you, incidentally, for contributing so much to Lemmy. You are great.
Nomad@infosec.pub 10 months ago
Sounds about right. Might be they have some man in the middle shenannigans going on with permanently installed hardware in the subway, but I doubt it. That would be a race condition that you might win with a lot more signal strength, but still…
JCreazy@midwest.social 10 months ago
I had someone tell me that when they were on campus people would airdrop entire movies to either.
Ghostalmedia@lemmy.world 10 months ago
Hot take - I’ll wager China is publicly announcing this so Chinese citizens stop trusting Airdrop. Intelligence organizations usually like to keep uncovered vulnerabilities private so they don’t get patched. And if there is a vulnerability, Apple will 100% patch that shit.
By sowing doubt in AirDrop’s security, that might be enough to get Chinese citizens to stop using it. And if enough people stop sharing or receiving, then that is going to kneecap it as a channel for dissent.