Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol
Handoff All Your Privacy – A Review of Apple’s Bluetooth Low Energy Continuity Protocol
复制标题
移交你的所有隐私——苹果蓝牙低功耗连续性协议回顾
DOI：
10.2478/popets-2019-0057
复制
发表时间：
2019
影响因子：
--
通讯作者：
Sam Teplov
中科院分区：
文献类型：
--
作者：
Jeremy Martin;Douglas Alpuche;Kristina Bodeman;Lamont Brown;Ellis Fenske;Lucas Foppe;Travis Mayberry;Erik C. Rye;Brandon Sipes;Sam Teplov
我们研究了苹果公司的蓝牙低功耗（BLE）连续性协议，该协议旨在支持iOS和macOS设备之间的互操作性和通信，并表明这种无缝体验的代价是将身份信息和行为数据泄露给被动对手。首先，我们对许多连续性协议消息类型进行逆向工程，并识别未加密传输的数据字段。我们展示了连续性消息通过BLE广播，以响应诸如锁定和解锁设备屏幕，复制和粘贴信息，拨打和接听电话以及在解锁时轻敲屏幕等操作。实验室实验揭示了最新版本macOS中的一个重大缺陷，该缺陷通过导致公共MAC地址被广播来完全击败BLE媒体访问控制（MAC）地址随机化。我们证明，连续性消息的格式和内容可用于指纹设备的类型和操作系统（OS）版本，以及行为配置文件用户。最后，我们展示了这些帧中的可预测序列号可以允许对手跨越空间和时间跟踪Apple设备，击败现有的反跟踪技术，如MAC地址随机化。
Abstract We investigate Apple’s Bluetooth Low Energy (BLE) Continuity protocol, designed to support interoperability and communication between iOS and macOS devices, and show that the price for this seamless experience is leakage of identifying information and behavioral data to passive adversaries. First, we reverse engineer numerous Continuity protocol message types and identify data fields that are transmitted unencrypted. We show that Continuity messages are broadcast over BLE in response to actions such as locking and unlocking a device’s screen, copying and pasting information, making and accepting phone calls, and tapping the screen while it is unlocked. Laboratory experiments reveal a significant flaw in the most recent versions of macOS that defeats BLE Media Access Control (MAC) address randomization entirely by causing the public MAC address to be broadcast. We demonstrate that the format and content of Continuity messages can be used to fingerprint the type and Operating System (OS) version of a device, as well as behaviorally profile users. Finally, we show that predictable sequence numbers in these frames can allow an adversary to track Apple devices across space and time, defeating existing anti-tracking techniques such as MAC address randomization.