Discovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
summary
Systematic reverse engineering shows Apple ZeroConf components — Bonjour impersonation, Multipeer Connectivity PID spoofing, AirDrop over the private aw0 interface and Handoff BLE pairing — allow device-in-network attackers to perform impersonation or MitM, steal print jobs, AirDrop files, QQ transfers and iPhone notifications. Demos use a compromised local device to claim service instance names, hostnames or IPs and to intercept TLS because Apple issues non-identifying AppleID certs. A measurement of 61 popular apps finds about 90% of 61 apps vulnerable. A proposed fix uses a spoken biometric-to-certificate linking (SPACy) and is usability-tested.
AI-written summary · about
chapters (15)
- 0:00Introduction and announcements
- 1:07Understanding Apple ZeroConf
- 2:34Bonjour protocol explained
- 5:18Device discovery and resolution
- 9:15Printer vulnerability exploit
- 12:11PhotoSync application attack
- 15:45AirDrop security analysis
- 18:59AirDrop man-in-the-middle
- 24:40Reverse engineering AirDrop
- 27:17Multipeer connectivity attack
- 30:15Attacking QQ file transfer
- 34:17Bluetooth handoff exploit
- 38:36Measurement study results
- 39:42Secure authentication solution
- 41:36Conclusion
related talks
40mTrust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
41mA Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
59mD1T1 - Real World Attacks Against Secure Elements
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
20mProtocol Prying: Systematic Vulnerability Research in the AirDrop and Android Quick...
50mFinding Vulnerabilities In iOS/MacOS Networking Code
30mIt Just (Net)works: The Truth About iOS 7's Multipeer Connectivity Framework