A bug in the AirDrop system of Apple devices can share your phone number and email address with strangers. They only need to be within WiFi range of you.
AirDrop vulnerability
The security flaw was already discovered in May 2019, but German researchers now show that Apple has still not done anything about it. This is striking: because AirDrop is installed by default on every iPhone and iPad, the error affects 1.5 billion devices.
The German investigation now shows that the vulnerability is more serious than was thought two years ago. Tests show that full phone numbers and email addresses can be stolen as soon as someone opens the Share screen. This person does not even have to use AirDrop.
That way, someone can read your contact details unnoticed, making it a danger to people who are being stalked or who for some other reason want to keep this information private. Because it happens unnoticed, the victim often does not even know that he is a victim.
The flaw is in the option that AirDrop can only be used with people in your contact list. To do this, your iPhone needs to know if someone nearby is in your contact list. To do this, the device compares the person’s phone number and email with your address book. If this matches, he or she will appear in your AirDrop list, otherwise not.
AirDrop security easily bypassed
Although Apple protects this data, this protection is not strong enough and is easy to crack. By ‘brute forcing’ the security code, it can be deciphered. For this, hackers often use software that tests all possible code options in a short time. For example, the code is cracked by simply guessing at lightning speed.
The researchers have reported the flaw to Apple and even developed an alternative. This new version of AirDrop (renamed PrivateDrop) uses stronger security which solves the problem. Apple has not done anything with this at the time of writing. Let’s hope iOS 15 changes this, the major update will be announced in June and will be released this fall.