Apple’s AirDrop and password sharing fea tures can leak iPhone numbers

'Apple makes it easy for people to locate lost iPhones, share Wi-Fi
passwords, and use AirDrop to send files to other nearby devices. A
recently published report demonstrates how snoops can capitalize on
these features to scoop up a wealth of potentially sensitive data that
in some cases includes phone numbers.

Simply having Bluetooth turned on broadcasts a host of device details,
including its name, whether it's in use, if Wi-Fi is turned on, the OS
version it’s running, and information about the battery. More
concerning: using AirDrop or Wi-Fi password sharing broadcasts a
partial cryptographic hash that can easily be converted into an
iPhone’s complete phone number. The information—which in the case of a
Mac also includes a static MAC address that can be used as a unique
identifier—is sent in Bluetooth Low Energy packets.

The information disclosed may not be a big deal in many settings, such
as work places where everyone knows everyone anyway. The exposure may
be creepier in public places, such as a subway, a bar, or a department
store, where anyone with some low-cost hardware and a little know-how
can collect the details of all Apple devices that have BLE turned on.
The data could also be a boon to companies that track customers as
they move through retail outlets.

As noted above, in the event someone is using AirDrop to share a file
or image, they’re broadcasting a partial SHA256 hash of their phone
number. In the event Wi-Fi password sharing is in use, the device is
sending partial SHA256 hashes of its phone number, the user’s email
address, and the user’s Apple ID. While only the first three bytes of
the hash are broadcast, researchers with security firm Hexway (which
published the research) say those bytes provide enough information to
recover the full phone number.'

-- source: https://arstechnica.com/information-technology/2019/08/apples-airdrop-and-password-sharing-features-can-leak-iphone-numbers/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug