Billions of phones face new risk

AirDrop and Quick Share make file sharing easy, but this convenience comes with risks. Security researchers at the CISPA Helmholtz Center for Information Security identified six vulnerabilities in these services.

The main problem involves how AirDrop and Quick Share operate. They run background services that automatically connect to nearby devices. This seamless feature allows attackers to exploit the system. All they need is a laptop with Wi-Fi and proximity to devices set to the “Everyone” discoverability option.

6 vulnerabilities were identified. Three are linked to AirDrop and affect the sharingd daemon, which powers features like AirPlay, Universal Clipboard, Continuity Camera, and Handoff on macOS and iOS. The other three vulnerabilities are tied to Quick Share and Windows continuity features.

The biggest risk with AirDrop is that attackers can overload the system, causing the sharingd process to crash. This shuts down AirDrop and related services. For Quick Share and Windows users, the risks are greater. Bad actors can bypass security checks, potentially leading to a “use after free” error. This flaw allows unauthorized access through unencrypted data frames.

Apple and Google were notified about these vulnerabilities. Two have already been fixed, and the remaining four are in the process of being resolved. Users can also take steps to protect themselves. Changing the discoverability settings on AirDrop and Quick Share can significantly reduce the risk.

Users can set these services to share with “Everyone,” “Contacts Only,” or “Nobody.” Opting for “Nobody” blocks all incoming connections, requiring users to manually enable sharing when needed. Changing to “Contacts Only” is useful for frequent sharing with trusted individuals. Avoiding the “Everyone” setting is advisable, especially given the current vulnerabilities.

Apple is working on improving privacy features in AirDrop. Though the current vulnerabilities do not allow data retrieval, new threats could emerge. Keeping your device and personal data secure is always a priority. Google recently added AirDrop support to Android devices, making this issue even more relevant. The seamless sharing experience now extends across platforms, but so do the potential risks. Staying informed and adjusting settings accordingly is key to maintaining security.

Quick Share lets Samsung devices exchange files quickly and easily. It’s convenient, but the way it works makes it vulnerable. The system picks up data from unknown sources before requiring user intervention, which is how attackers can exploit them.

While the researchers discovered these issues, it’s important to note that the manufacturers have been informed. They are actively working on fixes. Two vulnerabilities have already been addressed, and the remaining four are in the process of being resolved. Users can also take immediate action to protect their devices. Adjusting the discoverability settings on AirDrop and Quick Share is a simple yet effective way to enhance security. By choosing “Contacts Only” or “Nobody,” users can control incoming connections and reduce the risk of exploitation.

Even though these flaws don’t currently allow for data retrieval, it’s always possible that new threats could emerge. Staying informed and proactive is essential for maintaining the security of your device and personal data. It’s also worth noting that these issues aren’t limited to mobile devices. They can affect macOS and Windows users as well, making this a widespread concern.

What Is A “Use After Free” Vulnerability?

A “use after free” error occurs when a program accesses memory after it has been freed or deallocated. This can lead to crashes, data corruption, or even the execution of arbitrary code, making it a serious security risk. In the context of Quick Share and Windows, this vulnerability allows bad actors to reopen sessions using unencrypted data frames, potentially gaining unauthorized access to the system. Such errors can be difficult to detect and exploit, but they pose a significant threat to the security of affected devices.