Reverse Engineering the Apple Multipeer Connectivity Framework (2022) | Hacker News Reader

Reverse Engineering the Apple Multipeer Connectivity Framework (2022)

evilsocket.net

121 pointswslh34 comments

“Moreover, while sending crafted packets and attempting all sorts of things, I’ve discovered several vulnerabilities in the Apple custom made parsers. I will not discuss them here (exception made for the session spoofing) but at the same time I’m not interested in reporting them to Apple…”

Erm, hope they’re not super serious I guess?

Taken out of context it looks a bit weird, but it does explain the motivation:

"I’ve heard way too many negative stories about their disclosure program and in general how they mistreat researchers."

Yeah. Plenty of such stories, I had to reproduce a security issue across four macOS versions before it was finally fixed. Such a waste of time.

> My informed guess was multicast DNS as I’ve seen this protocol being (ab)used a lot from Apple (Bonjour for instance)

I understand it's in fashion to kick Apple (and not without reason) but mDNS and DNS-SD is their protocol. They made it and they market it combined with link-local addressing, etc as Bonjour. To me writing like this is naff and makes the author seem needlessly salty.

"custom (and as typical of Apple, undocumented) TCP protocol"

Pretty much all custom protocols are undocumented. Not sure why he feels the need to shit on Apple.

And any custom protocol parser will be riddled with errors, because they always expect values to be in range.

Because when apple does it you can assume it only works on apple devices, such a bore. How people can get excited about vendor lock-in beyond me.

> And any custom protocol parser will be riddled with errors, because they always expect values to be in range.

I hope you're not working on any products I rely on.

Apple has one of the most damaging two-faced approaches where on the public side they say they are all about openness and power users and security but on the private side they are intentional and severe about keeping that public image at the expense of users.

I agree that there’s no responsibility on Apple to document this specific protocol but it’s important to see it in context.

> they say they are all about openness and power users and security

They do mention security a lot, but “all about openness and power users”? That’s not my impression. They famously eschew the “make everything a setting” philosophy. The whole Apple thing is simplicity at the expense of configurability and control. Do you see them otherwise?

> but “all about openness and power users”? That’s not my impression.

...!

I feel like a frog that’s just been shown the bubbles forming on the bottom of the pot.

Granted I’ve been pretty “meh” on Apple the last few years but I’ve still watched the keynotes and kept up with their growth. I didn’t even notice that Apple cleaned developers and pro users from their brand! (pro users as defined by those that are always stretching the limits of the tech, learning, and finding new optimal ways to do things).

I just finished re-watched the uncut WWDC keynote and when developers are mentioned they are now almost entirely talked about in 3rd person while Apple is talking directly to upper management. The most hands-on-tech thing they did was talk for a couple seconds about the WebKit features.

My impression of Apple is shockingly outdated in their favour.

The product pages for both Mac Studio and the Mac Pro (both “Pro” products) either talk specs without highlighting what can be done with them or they talk about media creation. The target demographic here is creative professionals and not technical ones, power users, or developers.

They have served creative professionals for a long time for sure, but they also served power users and technology professionals because they recognized that it was them working with the creative professionals (and sometimes working on their own) to build products with huge markets. I thought that this was still an underlying corporate value at Apple but I see now that they’ve just conveniently dropped it without even a whisper. I guess their new core demographic is content creators and movie studios?

Apologies if this rambles. I had to get it out. I’m still processing this.

This year, there were lots of product announcements, so the keynote was end user centric. It's really platforms state of the union address the same afternoon that has the developer focus: https://developer.apple.com/videos/play/wwdc2023/102/

I just watched the intro and conclusion for the Platforms State of the Union and cannot see the pro focus we’re talking about.

Yes, it’s now directly talking to developers, but with a tone of “Here are new APIs and features we decided to make. Use them how we designed them.” (like talking top-down to a workforce)

> I just finished re-watched the uncut WWDC keynote…

The WWDC keynote/state of the union is a public-facing event for enthusiasts, press and analysts. This is why Apple invites say, "Join the developer community for an in-depth look at the future of Apple platforms".

If you want to evaluate Apple's prioritization of the developer community, you can watch any other content that Apple creates for WWDC, along with the non-keynote events listed at developer.apple.com/wwdc23. Additionally, Apple developers have their own dedicated site at developer.apple.com.

It’s Apple’s choice what they do and the directions they go, but if the WWDC keynote really is for enthusiasts, press, and analysts it’s disingenuous to say it’s part of a Developer Conference.

Unfortunately I have to see “join the developer community” and “dedicated site at developer.apple.com” the same way as I see a big brand responding to a high-traction social media complaint with “Contact us privately so we can look in to it”: a way to pull the issue out of the public eye and in to a tightly-controlled environment that favours the brand over of the end user.

> but if the WWDC keynote really is for enthusiasts, press, and analysts it’s disingenuous to say it’s part of a Developer Conference.

About every conference has an opening keynote that doesn’t get into nitty-gritty details, but that informs both the participants and the press what the conference will be about.

It typically follows on a part where the local mayor/minister/… will welcome the participants, saying how good it is for the city/region/country to have the conference in their city/region/country.

https://en.wikipedia.org/wiki/Keynote: “At political or industrial conventions and expositions and at academic conferences, the keynote address or keynote speech is delivered to set the underlying tone and summarize the core message or most important revelation of the event”

I don’t see the WWDC keynotes as much different, except for the fact that Apple’s keynotes attract way more press than most other ones.

You’ve accidentally hit on the key point I’m making:

> the keynote speech is delivered to set the underlying tone...

The tone it sets is not about (or for) developers.

Yes, like all keynotes in all industries, it is about the larger ecosystem and new developments.

Cardiology keynotes are about global attention to heart health, not how a cardiothoraccic surgeon can rotate a stent to improve success.

Energy conference keynotes are about changing patterns in production and use of energy, not the novel polymers in the latest solar cells.

Keynotes are by definition intended to tie everything together (I like to believe the word was used a playful anagram). Pointing out that a keynote is not the most personally/professionally relevant part of a conference for the average attendee is not going to surprise anyone who’s been to conferences.

From a comment in the article:

> This gives me chills, the shared clipboard also uses this protocol, right? This means that everything we copy goes through the network via Bluetooth without encryption and can be captured by any Bluetooth sniffer?

The shared clipboard uses this protocol?... on what basis is this claim plausible?

I thought it was clear it ran through iCloud: https://support.apple.com/en-au/HT209460

It only works between devices signed in with the same Apple ID

The encryption keys are shared via the iCloud keychain, but I think the actual sharing happens over a protocol called Companion Link.

> on what basis is this claim plausible?

The article shows the author holds some grudges against Apple. Those grudges probably influence their judgement.

The comment in question was not written by the article author.

From Apple Platform Security Guide [0] :

> The individual messages are encrypted much like messages in iMessage are. After the devices are paired, each device generates a symmetric 256-bit AES key that gets stored in the device’s keychain. This key can encrypt and authenticate the BLE advertisements that communicate the device’s current activity to other iCloud-paired devices using AES256 in GCM mode, with replay protection measures.

[1]: https://support.apple.com/en-gb/guide/security/secf78dbe639/...

> From a comment in the article:

To be clear, it's a comment on the article, in the public comments section appended to the article. The comment was not made by the article author.

Agreed. My comment was worded poorly. Thank you for clarifying.

> I’ve heard way too many negative stories about [Apple's] disclosure program and in general how they mistreat researchers.

Links?

I did some lazy searching and it seems it's a well known fact. I don't think the author has to back it up in this case.

Infosec researchers say Apple’s bug-bounty program needs work[0]

[0] https://arstechnica.com/information-technology/2021/09/infos...

Wait times over 8 months and they refused to give credit (but gave $).

Personal experience so I can’t say for others. They pay well though. My first year of college has been completely covered by them so no complaints.

Reply on news.ycombinator.com