Bypassing regulatory locks, hacking AirPods and Faraday cages
lagrangepoint.substack.com
lagrangepoint.substack.com
Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but perhaps that was a huge calculated risk.
There's an incredible amount of processing power and flexibility in these things. Even the sub-$10 ones using the infamous JieLi SoCs - a 160MHz 32-bit computer in each ear. I'm surprised there hasn't yet been any TWS advertised with open-source firmware, although there's been some work in the usual Chinese (and Russian) communities on customisations.
Let me introduce you to the PineBuds Pro: https://pine64.com/product/pinebuds-pro-open-firmware-capabl...
I did manage to find the firmware, but it says that it doesn't have ANC, which the factory firmware does. Good start nonetheless.
Jeez that's not great. Hard to develop on these devices when too many flashes kills them.
I was worried that there might have been some other regulatory concern, perhaps to do with volume. Though I can't think what that might be.
https://audiochamps.com/what-does-tws-mean/
So, Bluetooth.
https://5.imimg.com/data5/SELLER/Default/2023/5/311562137/UE...
https://kagi.com/proxy/1462421?c=3_iinnNGr4mThI2-fwchjJtCnBS...
This is a bigger deal than it may sound. Apple isn't operating in a vacuum, sony[0] and bose are also targeting the market and they'll also probably do their marketing push as they see fit.
Apple only having a "kinda works as a hearing aid" is a sizeable disadvantage when the other brands will have posters in prominent places at sales points. Apple would still win on online sales and people who don't need that much reliability of course.
Once you factor price into the equation, there's very little reason for an educated customer to pick the Airpods besides marketing. Apple doesn't give people a good reason unless they already own thousands of dollars in other Apple hardware.
Sony funnily also has presence in many specialized and/or non tech shops (select goods shops etc.) where they could be only two or three earbuds. If Apple didn't get the certification, having a spot for Sony's or Bose's ones could have been a natural choice if the shop targeted that kind of demographic.
AirPods too! I'm am yet to be convinced that this is any different than using a different hearing test app like Mimi and applying the resulting audiogram, as has been possible for years.
and this means both that they don't have to use weasel legal language to avoid "the regulatory hawks" AND that they gain a huge air of legitimacy in their marketing as a medical device
Fwiw I refuse to own Apple, I only own AAPL.
Incidentally, WiFi tries to intentionally avoid this interference. Microwaves output no power during the zero crossing of the AC line that's driving it, and in this interval, there is no signal in the air to jam things. WiFi listens before sending (so as to avoid stepping on other stations), and the microwave's signal is enough to trigger this. (I forget if microwave ovens are "half wave" and you get 1/120th of a second 60 times a second, or if there is just a threshold near the zero crossing where there isn't enough power to interfere.)
I would say it's likely that the microwave oven didn't really do much here.
Now that I think about it, in OP's case, it's quite possible that the iPad can "hear" the microwave, but the access point can't, so the access point will send out its SSID broadcast while the microwave is interfering. This is great because you WANT that packet to get corrupted. So maybe the microwave does help!
IETF attendees reengineer their hotel’s Wi-Fi network - https://www.computerworld.com/article/1448494/ietf-attendees... ( https://news.ycombinator.com/item?id=3771876 31 comments)
> “There was no WiFi signal when on the desk in front of the window in my room, but after some experiments, I discovered that the signal was quite good… on the ceiling of the bathroom,” emailed Marc Petit-Huguenin.
> “I have a Nexus S phone, so I taped it on the ceiling of the bathroom, and used tethering over Bluetooth to bridge the gap to the desk,” he explained. This is a slow connection, but good enough to send emails over SMTP or use vi [the popular Unix text editor] over SSH.”
> ... Working behind the scenes, a team of IETF attendees negotiated with the hotel and were granted access to the wireless network by Sunday night. ...
> The changes made by the IETF makeover team included:
> – Decreasing the AP receiver sensitivity ([changing] HP/Colubris configuration “distance” from “large” to “small”);
> – Increasing the minimum data and multicast rate from 1Mbps to 2Mbps;
> – Decreasing the transmit power from 20dBm to 10dBm;
> – And, turning off the radios on numerous APs to reduce the [RF] noise.
> ...
> Each floor now has approximately two access points on each of these four channels, with the channels staggered on adjacent floor. That design maximizes the distance between access points on the same channel. “I hope this will significantly improve the coverage in some rooms that had marginal or no signal while also improving the signal to noise ratio for all,” he said
----
Note that the changes were being made to decrease the power being used.
So the transformer based microwave oven power supplies have a 2.2kV transformer and then double that to 4.4kV for the magnetron.
There is no filtering or smoothing, as those parts would cost money and present a danger to the service technician.
So the voltage feeding the magnetron is not even sinusoidal.
It is truly amazing how cost-optimized microwave ovens are.
x-apple-health://HearingAppPlugin.healthplugin/HearingTest
1: https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_...
At some level, this was just the easier approach :)
I'm sure there's something though. Apple changed the URL handler schemes for iOS 18, so a lot of old repos that reference that don't work anymore.
I guess if I have one question, it would be... what else are you planning to do with your new Faraday cage?
We've got some ideas for the Faraday cage—a whole bunch of networks research and hacking that we can do without messing up live systems! It's also really nice to be able to test a device in isolation, without worrying about whether it's phoning back home in some way.
This is a great attitude in the face of a pretty sad 2024 reality: that the manufacturer of a device is expected to intentionally go out of its way to remotely stop users from using the device they bought in the way they want to use it.
Imagine typing in coordinates or picking a location on a map, and then suddenly your phone or any other device is at that location inside the cage, by a combination of GPS, cellular and WiFi spoofing
My former manager called it a portal haha: https://x.com/masadfrost/status/1856467695606345756
Since you did not end up having bought yourself a very expensive set of earphones, what earphones do you use — or want to get?
I've just been hacking away at things since I was in middle school, am lucky that there's some transfer. LLMs have also been a huge unlock—really cool to be able to try things at near speed of thought!
> what earphones do you use — or want to get? I'm very happy with my Shure Aonic 3s, a very loyal IEMs guy!
The first prototype was just aluminium foil, tape and hope, but we wanted something more solid so we built one out of n°100 copper mesh and some 2020 aluminium extrusions!
If I can ask -- what program did you use to generate the code maps in your article?
Think someone has already linked it below!
As for the sound quality, a few of our grandparents have tried it, and while they say it sounds 'different', it's not necessarily bad. Grandma was actually quite content even with just the old EQ settings that shipped pre iOS 18 for folks with hearing issues.
Thanks for the kind words!
I can't give the hearing aid feature a test because it's not available in either Canada or Spain, but I am wondering what the difference is (if any) between the hearing aid region lock and other geo-locked/geo-enabled features Apple has.
I ended up transferring my account to an EU account (pro-tip, you may be on the phone with Apple support for 6+ hours if the automation fails). I still have access to both US-specific features (like Apple Cash in USD and the feature in this article) and EU-specific features (like the new app store stuff).
I'm surprised that this worked for you, my main Apple ID is a German one, with active CC/subscriptions/etc; but I am physically in Japan and definitely don't get to play Fortnite on my phone.
I'd even be happy to repeat your cellular signals here in the EU, so you connect to EU towers.
That would be entertaining to see if it worked.
Nope, its a one time thing. When the feature is enabled, a flag is set on the iCloud account, so you can travel anywhere and have it work. At the same time, a EQ profile is pushed to the transparency mode of the Airpods, enabling the hearing aid features.
Once done, it sticks with the Airpods, unless you reset them.
However, an interesting quirk is that if you enable this on someone's airpods, and _their_ device/account does not have it 'available', they wont be able to tweak the settings on their device.
If the software/firmware was free and open, you’d be able to patch out/disable the geo-lock. But it probably wouldn’t be there in the first place…
In the approved countries a regulatory body has had to approve this as a medical aid. If medical aids etc did not have to be approved then things that actually hurt and kill people could be sold as medical aids.
The issue here is that this case appears to be a non damaging aid and so it looks silly to ban it. But regulations have to work otherwise they are of no use.
The issue here is either regulators in other countries are slow or in the worst case Apple has not applied for approval.
Public health has had more effect than anyother medical change.
It's somewhat similar in spirit to the end-to-end encryption issue: government agencies can demand platforms hand over copies of users' messages if they have them, but they can't force platforms to have them, resulting in platforms going out of their way to not have copies of users' messages. If a platform went out of its way to not have control over the software its users run (this describes most non-Apple general computing platforms) then it can't be forced to regulate that software. If it does, it can.
I've used the AirPods Pro 2 as hearing protection for some stuff before, it works fine. Is it just due to the words ("Hearing Protection") which they are only allowed to use only in America or is it actually better than regular Pro 2 noise-cancelling?
From listening to it work HP sounds to me like multiband compression, in other words divide up the audible spectrum into multiple bands and apply compression on each one individually. Again it was already doing this though.
Off the top of my head:
The biggie is that we're right down the street from WOMC's transmitter, which is 135,000 watts EIRP. It gets into EVERYTHING and makes other RF measurements more difficult, so if you're trying to align an amplifier or something, it's nice to start from a quiet place and get the basics solid, and only THEN add sources of potential intermod and stuff.
Debugging wifi, bluetooth, and other wireless stuff without a zillion other nodes in view. Yes you can filter the output of a sniffer, but it's more fun to filter the input. ;)
Lighting up a 1G or 2G cellular network without worrying about spectrum licensing.
Practicing offensive wifi techniques or other stuff that might interfere with the hackerspace's existing network.
Playing with GPS spoofers in an FCC-free zone. Or anything else you might find amusing but want to do responsibly.
Locking an iPhone in there to see if it reboots itself... (rofl)
Shocked we made it this far in life without one! Itching to put devices inside and light the air inside up without worrying about licensing!
We actually ended up seeing a life size Faraday cage at Indian Institute of Science—felt good to see that the construction was similar to our approach
The trouble with the tabletop ones is that it's such a pain to set up all the I/O passthroughs and stuff, often it's just not justifiable to go through the hassle, and it just doesn't get used.
Being able to walk in and just use your own hands to manipulate the DUT is huge. If you're not dealing with high power, it's plenty safe, and it just saves a ton of time.
There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.
The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.
But I suppose, in this case Apple is deliberately using the wifi signals, not relying on IP so "just use VPN" doesn't work.
Apple has some slightly more complex checks that they have used in the past to georestrict stuff like ECG, by using MCC/MNC codes from your mobile network. I suspect that the alt stores would be region locked and stop working outside the EU—but that remains to be tested, and seems like a fun thing to experiment with.
TLDR, iPhones prioritize external GPS devices over internal ones. All you need is a "fake" lightning or USB-C external GPS device that tells your device where you want it to think it is.
Source: https://www.v2ex.com/t/1075937
However, if they did lock it to require an iPhone, the way we would activate would be by using our Faraday cage to spoof GPS inside it, and maybe a spoofed base station.
can't wait for this to find its way into Tomahawk missiles as a fallback for the jammed GPS environment
Also the probability that power is still functioning long into a conflict is pretty low so it may only really be useful for early strikes.
Have the laptop on the vpn even during OS install. Never run the vpn client on the laptop. Never connect to any other network. Use the target's localisation (language, kb, timezone) during install. Have a dedicated browser with detailed location features turned off for your target sites.
[0] https://www.amazon.com/Hearing-Seniors-Rechargeable-Bluetoot...
[1] https://apps.apple.com/us/app/sound-amplifier/id1615079093
There's quite a bit of processing going on on-device.
It is Binary Ninja
Somehow they fall out of my if i adjust my head down.
Battery life is good though
For those who don't recognize the ₹ symbol it is the symbol for the Indian Rupee and an "L" after a number means 100,000, so ₹ 8L is ₹ 800,000.
At current exchange rates that puts hearing aids in India from $600 to upwards of $9,500.
AirPods Pro 2 are ₹ 24,900 ($295).
Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3, 6, 9}. Thousands, millions, billions, et cetera.
To make matters more confusing, for American English it goes millions, billions, trillions. For British English it used to go millions, milliards, billions, billiards, trillions, trilliards. (That 'long scale' is still the way German used to work ten years ago. No clue if it changed in the meantime.)
"Eine Billion" is Million² bi -> 2 "Eine Billiarde" is 1000 * Million² "Eine Trillion" is million³ tri -> 3 "Eine Trilliarde" is 1000 * Million³ And so on
Yes I knew what a million, milliard, billion, billiarde and so on are, but it never made click that the long scale makes so much sense.
I also like the easy suffix for thousand (k), million (M), billion (B), trillion (T), quadrillion (Q) for written conversation. $10B revenue, 5k liters, 300M people, etc.
For anything bigger, you'd use 'scientific' notation anyway.
I think an exponential system would do better to have a different naming scheme.
Eg it's common to read sentences like the following in popular science texts: 'ACME produces one quintillion widgets per year, that's a one followed eighteen zeroes.' The second half is basically scientific notation, but written out.
i.e. the milliard was replaced with the US billion.
I’m envisioning some highly specialised and tuned implant at that price.
What drives the prices up is a multitude of factors: High end DSPs, micro speakers which can do good sound reproduction at required frequencies, relatively low sales volume, R&D expenses and of course an insatiable appetite for profits.
These things always cost and arm and a leg in here, too.