Trust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol
summary
Reverse engineering of Apple Continuity reveals concrete privacy failures: protocol messages and handoff counters leak OS version, device type, battery and hotspot state and enable fingerprint and track across address rotations. Proof-of-concept uses Ubertooth One and a Wi‑Fi Tango to capture BLE and Wi‑Fi exchanges, correlate public and private MACs, and recover RK-related identifiers that break MAC rotation and link devices. A Linux reimplementation effort is ongoing, demos work end-to-end, and coordinated disclosure led to Apple fixes for some issues.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:02Continuity Overview
- 2:22Research Motivation
- 4:40Vulnerability Disclosure
- 6:52BLE Fundamentals
- 9:43Protocol Architecture
- 12:07Security Studies
- 15:13Reversing Encryption
- 20:26Attack Scenario
- 22:44Device Fingerprinting
- 25:49Breaking Randomization
- 27:29Handoff Vulnerabilities
- 30:30MAC Address Correlation
- 34:25Live Demo
- 37:01Defenses and Takeaways
- 39:21Q&A and Conclusion
related talks
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
40mAll Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
51mBluetooth Hacking: Tools And Techniques
40mIntroduction into Reverse Engineering and iOS Security
58mUncovering OWASP’s Mobile Risks in iOS Apps