IPhone users should pay attention to: there is a security loophole in airdrop delivery, which may reveal the phone number.

Airdrop delivery is a wireless transmission function launched by Apple. Users can use this function to quickly transfer photos and files between different Apple devices. However, researchers at darmstadt University of Technology recently found that using this function to find and verify someone may expose the user's contact information, and may disclose the phone number and email address bound to the user's Apple account to nearby Apple devices.

Apple airdrop delivery has three modes: off, contact only, and everyone. The default selection is Contacts Only. The researchers said that every other airdrop uses a mutual authentication mechanism, which compares the user's phone number and email with the entries in other users' address books. In this process, strangers can crack the verified data to obtain the user's phone number and email.

The specific impact has the following two aspects:

1. Phone number that hackers may get:

When the user starts the airdrop function, Apple will spread the user's phone number and email address to its Wi-Fi and Bluetooth range in encrypted form to detect nearby connectable devices. If the user and another device are successfully matched by airdrop, the two parties will exchange the complete encrypted hash (SHA-256 hash) of telephone and email information.

Although this encryption hash will not directly disclose personal information, hackers can steal users' personal information by calculating the encryption hash. Hackers can put a pre-compiled hash list of phone numbers on their laptops, then sit near public places, try to establish airdrop connections, and passively or actively collect information about nearby iPhones.

E-mail has no preset length and can contain both letters and numbers, so it is more difficult to crack than phone numbers. But hackers can also use billions of email addresses that have appeared in database vulnerabilities in the past 20 years to crack them.

2. Possible active or passive attacks:

When hackers can master the personal information of Apple users, this information may be abused and defrauded, phishing attacks or information trafficking.

One is the simplest and most powerful passive attack. Without knowing any information in advance, the attacker can get their phone numbers and e-mail addresses only by monitoring the users who open the next airdrop nearby.

The other is active attack. Attackers can turn on the next airdrop to see if nearby devices respond to their connection requests. This method is not as powerful as passive attack, because it can only work if the attacker's phone number or email address is already in the receiver's address book.

Especially when the attacker is an acquaintance, this purposeful attack will be very effective.

Apple officials already know that this problem exists:

Researchers at darmstadt University of Technology said that they had informed Apple of the airdrop vulnerability they discovered in May 20 19. A year and a half later, they showed Apple a redesigned airdrop delivery: "Private Airdrop". The new design uses private set intersection encryption technology, which allows both parties to find contacts without displaying encrypted hashes. PrivateDrop is currently publicly available on the open source community GitHub.

But as of now, Apple has not stated whether it plans to use PrivateDrop or fix the vulnerability in other ways. In other words, at present, as long as someone turns on the airdrop delivery function, the phone number and email address may be leaked.

At present, the only way to prevent leakage is to set the function option of "every airdrop" to "receiving off" in the system setting menu. I hope that Apple can take measures as soon as possible to ensure the privacy and safety of users. Before Apple completely fixes the problem, users need to avoid using airdrop delivery in public places as much as possible.