Protocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick...
summary
Reverses proprietary AirDrop and Quick Share stacks, reconstructs AirDrop’s seven-layer state machine and DVZip compression, and builds a protocol-aware over-the-air fuzzer called AIRFUZZ fuzzer with Frida instrumentation to mutate pre-compression representations. The study finds six vulnerabilities (V1–V6): V1 an HTTP path-router fatalError DoS, V2 unbounded XML plist recursion, V3 NULL dereference in Network.framework, V4 OfflineFrame dispatch, V5 D2D encryption bypass, and V6 a Google Quick Share for Windows heap use-after-free (bounty awarded).
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:51Proximity transfer overview
- 4:27Research contributions
- 6:21AirDrop protocol analysis
- 8:47AirDrop fuzzing methodology
- 12:50AirDrop vulnerability details
- 15:02Quick Share vulnerability analysis
- 17:15Cross-platform review and conclusion
related talks
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
50mFinding Vulnerabilities In iOS/MacOS Networking Code
27mWIFI-Important Remote Attack Surface: Threat is Expanding
01h 16mClassic Vulnerabilities
53mResearching New Attack Interfaces On iOS And OSX
43mDebug for Bug: Crack and Hack Apple Core by Itself