Heinrich, Alexander ; Hollick, Matthias ; Schneider, Thomas ; Stute, Milan ; Weinert, Christian (2021)
AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop.
14th ACM Conference on Security and Privacy in Wireless and Mobile Networks. Abu Dhabi, United Arab Emirates (28.06.2021-01.07.2021)
doi: 10.1145/3448300.3468252
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
Apple’s file-sharing service AirDrop leaks phone numbers and email addresses by exchanging vulnerable hash values of the user’s own contact identifiers during the authentication handshake with nearby devices. In a paper presented at USENIX Security’21, we theoretically describe two attacks to exploit these vulnerabilities and propose “PrivateDrop” as a privacy-preserving drop-in replacement for Apple’s AirDrop protocol based on private set intersection. In this demo, we show how these vulnerabilities are efficiently exploitable via Wi-Fi and physical proximity to a target. Privacy and security implications include the possibility of conducting advanced spear phishing attacks or deploying multiple “collector” devices in order to build databases that map contact identifiers to specific locations. For our proof-of-concept, we leverage a custom rainbow table construction to reverse SHA-256 hashes of phone numbers in a matter of milliseconds. We discuss the trade-off between success rate and storage requirements of the rainbow table and, after following responsible disclosure with Apple, we publish our proof-of-concept implementation as “AirCollect” on GitHub.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2021 |
| Autor(en): | Heinrich, Alexander ; Hollick, Matthias ; Schneider, Thomas ; Stute, Milan ; Weinert, Christian |
| Art des Eintrags: | Bibliographie |
| Titel: | AirCollect: Efficiently Recovering Hashed Phone Numbers Leaked via Apple AirDrop |
| Sprache: | Englisch |
| Publikationsjahr: | 28 Juni 2021 |
| Verlag: | ACM |
| Buchtitel: | WiSec '21: Proceedings of the 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks |
| Veranstaltungstitel: | 14th ACM Conference on Security and Privacy in Wireless and Mobile Networks |
| Veranstaltungsort: | Abu Dhabi, United Arab Emirates |
| Veranstaltungsdatum: | 28.06.2021-01.07.2021 |
| DOI: | 10.1145/3448300.3468252 |
| URL / URN: | https://sites.nyuad.nyu.edu/wisec21/ |
| Zugehörige Links: | |
| Kurzbeschreibung (Abstract): | Apple’s file-sharing service AirDrop leaks phone numbers and email addresses by exchanging vulnerable hash values of the user’s own contact identifiers during the authentication handshake with nearby devices. In a paper presented at USENIX Security’21, we theoretically describe two attacks to exploit these vulnerabilities and propose “PrivateDrop” as a privacy-preserving drop-in replacement for Apple’s AirDrop protocol based on private set intersection. In this demo, we show how these vulnerabilities are efficiently exploitable via Wi-Fi and physical proximity to a target. Privacy and security implications include the possibility of conducting advanced spear phishing attacks or deploying multiple “collector” devices in order to build databases that map contact identifiers to specific locations. For our proof-of-concept, we leverage a custom rainbow table construction to reverse SHA-256 hashes of phone numbers in a matter of milliseconds. We discuss the trade-off between success rate and storage requirements of the rainbow table and, after following responsible disclosure with Apple, we publish our proof-of-concept implementation as “AirCollect” on GitHub. |
| Freie Schlagworte: | ATHENE, emergenCITY_KOM, Engineering, E4, Privacy and Trust for Mobile Users, A.1, B.3, C.1, emergenCITY |
| Fachbereich(e)/-gebiet(e): | 20 Fachbereich Informatik 20 Fachbereich Informatik > Praktische Kryptographie und Privatheit 20 Fachbereich Informatik > Sichere Mobile Netze DFG-Sonderforschungsbereiche (inkl. Transregio) DFG-Sonderforschungsbereiche (inkl. Transregio) > Sonderforschungsbereiche DFG-Graduiertenkollegs DFG-Graduiertenkollegs > Graduiertenkolleg 2050 Privacy and Trust for Mobile Users Profilbereiche Profilbereiche > Cybersicherheit (CYSEC) LOEWE LOEWE > LOEWE-Zentren LOEWE > LOEWE-Zentren > emergenCITY DFG-Sonderforschungsbereiche (inkl. Transregio) > Sonderforschungsbereiche > SFB 1119: CROSSING – Kryptographiebasierte Sicherheitslösungen als Grundlage für Vertrauen in heutigen und zukünftigen IT-Systemen |
| TU-Projekte: | HMWK|LOEWE|emergenC TP Gurevych |
| Hinterlegungsdatum: | 02 Jul 2021 10:12 |
| Letzte Änderung: | 21 Jul 2021 11:50 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum