AirDrop vulnerabilities can let someone standing 10 to 30 meters away cause nearby devices’ sharing services to repeatedly crash, researchers said.
How AirDrop vulnerabilities work
Researchers at the CISPA Helmholtz Center for Information Security examined the application layer protocols used by Apple AirDrop and Samsung and Google Quick Share, and found both systems spend time in the background listening for nearby devices before authentication or user confirmation occurs.
In a paper posted to arXiv, CISPA researchers Arash Ale Ebrahim and Nils Ole Tippenhauer said an attacker carrying a laptop or other wireless capable device within about 10 to 30 meters can trigger repeated short requests that make receiving services unstable.
No pairing required to trigger
The team found Apple devices set to receive from “Everyone” respond during early protocol stages, before the recipient user has authenticated or confirmed a transfer. Quick Share replies when it is visible to nearby devices, even before a completed pairing.
Those behaviors mean an attacker does not need to complete a pairing or steal files to cause disruption. Instead, simply generating repeated protocol exchanges from nearby wireless hardware is sufficient to create repeated failures on target devices.
Impact beyond file sharing
The researchers reported that the three AirDrop bugs they analyzed eventually crash a macOS system service called sharingd. sharingd supports AirPlay, Handoff, Universal Clipboard and Continuity Camera, so those features can stop working while the attack is ongoing.
During the research team’s tests, legitimate connections failed while the attack was running and resumed only after the repeated requests stopped. That means the outage is temporary, but it can affect multiple continuity features at once.
Quick Share risks and implementation gaps
Quick Share vulnerabilities focused on protocol logic and a Windows client memory handling error, the paper said. In Samsung’s implementation, parts of some protocol frames can be parsed before a UKEY2 key exchange completes. In another case, some frames were handled in unencrypted form even after the key exchange.
Google has paid a bounty to the researchers and submitted a Windows fix into the codebase, according to Help Net Security and 9to5Mac coverage of the disclosures. The researchers also published their technical paper on arXiv.
Fixes, CVEs and practical advice
Apple told the researchers that one of the AirDrop vulnerabilities has been fixed and assigned a CVE number, the researchers said. Apple has not yet posted a public security advisory for that fix, and other reported Apple issues remain under coordinated disclosure.
Google and Samsung have acted on the Quick Share findings, the researchers and reporting outlets said. Windows related fixes have been submitted, and Google confirmed a bounty was awarded, though public CVE listings for all issues were still being finalized at the time of reporting.
Security researchers and reporting outlets said this is not a reason to disable AirDrop or Quick Share in all cases. As a precaution, avoid leaving AirDrop set to receive from “Everyone” for long periods in crowded or unfamiliar public places.
For more technical details, see the CISPA arXiv paper and reporting by Help Net Security and 9to5Mac. The researchers listed test cases showing repeated short protocol requests as the mechanism that can cause the service crashes.
