Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper conducts the first comprehensive vulnerability analysis of the Apple AirDrop and Google/Samsung Quick Share proximity transfer protocols, utilizing cross-platform reverse engineering and protocol-aware fuzzing techniques. The authors developed AIRFUZZ, a specialized fuzzer that targets the unique serialization formats of these protocols, leading to the discovery of six significant vulnerabilities across both systems. These findings, which include critical pre-authentication issues and protocol-layer flaws, highlight substantial security risks in widely used file transfer methods and have been acknowledged by the respective companies through responsible disclosure.
Six critical vulnerabilities in Apple AirDrop and Google/Samsung Quick Share expose serious security flaws in protocols used by over five billion devices.
Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices, yet their application-layer security properties remain largely unstudied because both stacks are proprietary and undocumented. Both protocols are reachable from wireless proximity without any prior pairing and process complex serialized content (binary plists, CPIO archives, Protocol Buffers, UKEY2 handshakes) inside privileged daemons, making them attractive zero-click targets across multiple operating systems. We perform the first cross-platform reverse engineering and protocol-aware fuzzing study of both stacks. We reconstruct AirDrop's seven-layer state machine and DVZip adaptive compression from binary analysis, build AIRFUZZ, a protocol-aware fuzzer that mutates pre-compression representations, and complement it with targeted hand-written analyses of Samsung's Quick Share service and Google's Quick Share for Windows. We discover six vulnerabilities (V1-V6): three pre-authentication issues in macOS/iOS AirDrop (V1: Swift fatalError DoS in the HTTP path router; V2: unbounded XML plist recursion in Foundation; V3: NULL dereference in Network.framework's HTTP/1.1 parser), two protocol-layer flaws in Samsung Quick Share (V4: pre-authentication OfflineFrame dispatch; V5: D2D encryption bypass for three frame types), and a heap use-after-free in Google Quick Share for Windows (V6) for which Google awarded a bounty. We responsibly disclosed all findings, and Apple, Samsung, and Google have acknowledged the reports.