AirDrop is a popular feature that allows Apple devices to securely and conveniently transfer files, photos, and more among them wirelessly. Users can share items with their own devices, friends, family, or even strangers. The convenience and ease of use, however, may be undermined by a newly discovered security flaw.
Researchers at TU Darmstadt (Technical University Darmstadt, Germany) have discovered there’s a flaw in Airdrop, and it might reveal all the private data of the user who is using it. AirDrop includes three modes; Receiving Off, Contacts Only, Everyone. The default setting is Contacts Only, which means only people within your address book can AirDrop photos, files, and more to your device.
According to the security researchers, “Apple AirDrops shares more than files,” and the team has explained how it happens even when not using the feature. As simple as leaving it turned on for “Everyone” to send users any file, it can be vulnerable to the attack.
Currently, there are 1.5 billion users of Apple devices with AirDrop, and according to the researchers, almost all of them are vulnerable to cyber-attacks via AirDrop. The security researchers have also claimed that Apple has not yet “closed” this privacy vulnerability, leaving these users exposed as of the moment.
“This means that the users of more than 1.5 billion Apple devices are still vulnerable to the outlined privacy attacks. Users can only protect themselves by disabling AirDrop discovery in the system settings and by refraining from opening the sharing menu,” the researchers say.
The researchers discovered that the mutual authentication mechanism that confirms both the receiver and sender are on each other’s address book could be used to expose private information. The researchers claim that a stranger can use the mechanism and its process within the range of an iOS or macOS device with the share panel open to obtain private information. As the researchers explain:
“As an attacker, it is possible to learn the phone numbers and email addresses of AirDrop users even as a complete stranger. All they require is a Wi-Fi- capable device and physical proximity to a target that initiates the discovery process by opening…