A Worm in the Apple: Wormable Zero-Click RCE in AirPlay... (Avi Lumelsky, Uri Katz)
summary
Researchers report 23 AirPlay flaws that chain into a wormable zero-click RCE and demo full exploits on a MacBook, a Bose Wi‑Fi speaker and a Pioneer CarPlay head unit. Tools include simple Python fuzzing, dyld cache reverse engineering and a Raspberry Pi plus an MFi chip emulator to reproduce SDK devices. Notable specifics: a syslog disclosure via GET log, a use‑after‑free in FairPlay turned into write‑what‑where, and a stack overflow exploited on SDK devices. Attack vectors: Internet‑facing devices, same‑LAN, browser→localhost calls and AWDL physical proximity.
AI-written summary · about
chapters (19)
- 0:00Introduction and speakers
- 2:24Why research AirPlay
- 4:36AirPlay protocol overview
- 7:06AirPlay request structure
- 8:53Initial vulnerability findings
- 11:43Reverse engineering AirPlay
- 13:08Common vulnerability types
- 15:34AirPlay SDK differences
- 17:00Simulating AirPlay devices
- 19:48Stack overflow in CarPlay
- 21:35Mac OS use-after-free
- 24:28Bypassing user interaction
- 25:52Summary of vulnerabilities
- 26:55Attack vectors overview
- 28:41Physical proximity attacks
- 29:26Live exploit demonstrations
- 31:58Key takeaways and recommendations
- 33:44Collaboration with Apple
- 34:28Q&A session
related talks
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
50mFinding Vulnerabilities In iOS/MacOS Networking Code
27mNew Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
27mWIFI-Important Remote Attack Surface: Threat is Expanding
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS