Discontinued Privacy: Personal Data Leaks in Apple Bluetooth-Low-Energy Continuity Protocols - Archive ouverte HAL Access content directly
Journal Articles Proceedings on Privacy Enhancing Technologies Year : 2020

Discontinued Privacy: Personal Data Leaks in Apple Bluetooth-Low-Energy Continuity Protocols

(1) , (1)
1

Abstract

Apple Continuity protocols are the underlying network component of Apple Continuity services which allow seamless nearby applications such as activity and file transfer, device pairing and sharing a network connection. Those protocols rely on Bluetooth Low Energy (BLE) to exchange information between devices: Apple Continuity messages are embedded in the pay-load of BLE advertisement packets that are periodically broadcasted by devices. Recently, Martin et al. identified [1] a number of privacy issues associated with Apple Continuity protocols; we show that this was just the tip of the iceberg and that Apple Continuity protocols leak a wide range of personal information. In this work, we present a thorough reverse engineering of Apple Continuity protocols that we use to uncover a collection of privacy leaks. We introduce new artifacts, including identifiers, counters and battery levels, that can be used for passive tracking, and describe a novel active tracking attack based on Handoff messages. Beyond tracking issues, we shed light on severe privacy flaws. First, in addition to the trivial exposure of device characteristics and status, we found that HomeKit accessories betray human activities in a smarthome. Then, we demonstrate that AirDrop and Nearby Action protocols can be leveraged by passive observers to recover e-mail addresses and phone numbers of users. Finally, we exploit passive observations on the advertising traffic to infer Siri voice commands of a user.
Fichier principal
Vignette du fichier
popets-2020-0003.pdf (1.28 Mo) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-02394619 , version 1 (04-12-2019)

Identifiers

Cite

Guillaume Celosia, Mathieu Cunche. Discontinued Privacy: Personal Data Leaks in Apple Bluetooth-Low-Energy Continuity Protocols. Proceedings on Privacy Enhancing Technologies, 2020, 2020, pp.26 - 46. ⟨10.2478/popets-2020-0003⟩. ⟨hal-02394619⟩
968 View
1986 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More