AirDrop and Quick Share: Six Bugs Across Five Billion Devices

Researchers at the CISPA Helmholtz Center for Information Security have spent quality time prodding the wireless file-sharing features baked into nearly every phone and laptop in circulation. Between Apple's AirDrop and the Google/Samsung Quick Share stack, that's more than five billion active devices. Arash Ale Ebrahim and Nils Ole Tippenhauer found six vulnerabilities spanning macOS, iOS, Android and Windows. Patches are only starting to trickle out.

The threat model is refreshingly mundane. Someone within 10 to 30 metres with a laptop and a Wi-Fi card. No pairing, no shared network, no account. If a device is set to receive from Everyone, the early protocol stages answer before the user ever sees a prompt. Quick Share replies to anything nearby once it's visible. Both run inside privileged background services that happily parse complex data from strangers.

What breaks on Apple

All three Apple findings end in a crash. The cleanest one is a single web request to an unrecognised path that hits a Swift fatalError and kills sharingd, the daemon that also handles AirPlay, Handoff, Universal Clipboard and Continuity Camera. Loop the request and the whole bundle stays down.

A second bug exhausts the stack by feeding the XML property list parser around 200 nested elements, which reaches into any Apple app that decodes untrusted plists. The third is a null pointer dereference in the HTTP parser. Apple has quietly fixed one of these with a CVE that hasn't been published yet.

What breaks on Quick Share

Quick Share is more interesting, and more worrying. Samsung's implementation processes three frame types before the UKEY2 key exchange that's supposed to gate everything after it. Worse, three further frame types are still accepted as plain unencrypted data after the handshake, so an on-path attacker on the same Wi-Fi can keep a session alive and feed the server whatever addresses they like.

The Windows client carries a use-after-free triggered by colliding connections. There is a developer comment in the source code openly admitting an earlier race bug at the same spot. Google's first attempt at a fix read the freed object during its check, which reopened the same hole. The Windows patch has landed without a public CVE. The Samsung issues are still under investigation at Google.

One mistake, made twice

Ale Ebrahim's reading is that two ecosystems with almost no shared code arrived at the same architectural weakness. Authentication and encryption checks live inside individual handlers instead of at a single boundary, and a lot of privileged code runs before anyone has been authenticated. When the gate is downstream of the parser, every parser becomes attack surface.

What to do in the meantime

• Set AirDrop and Quick Share to contacts only rather than Everyone across managed fleets.
• Treat the next round of OS updates on macOS, iOS, Android and Windows as worth chasing rather than deferring.
• Remember that proximity attacks land in cafes, airports, conferences and open-plan offices. The radius is small, but so is the average office.

The bugs themselves are mostly crashes today. The architecture that produced them is the part worth watching.