Vulnerabilities found in Apple AirDrop and Android Quick Share

Researchers from the CISPA Helmholtz Center for Information Security have identified six vulnerabilities in Apple's AirDrop and Android's Quick Share features, potentially exposing users to security risks. These flaws, detailed in research examining Apple, Samsung, and Google implementations, could allow nearby attackers to exploit file-sharing functionalities without user interaction.

The vulnerabilities include issues that could crash Apple's AirDrop service, protocol weaknesses in Samsung's Quick Share, and a use-after-free bug in Google's Quick Share for Windows, which researchers suggest could potentially lead to remote code execution.

How File Sharing Features Can Create Risks

AirDrop and Quick Share are designed for convenience, allowing users to easily share files between nearby devices without a lengthy pairing process. This convenience, however, means the software must remain discoverable and listen for requests, creating a potential wireless opening. Researchers highlighted this as a "proximity problem," where an attacker within range could attempt to exploit the open connection.

These features are widely used, with Apple reporting over 2.2 billion active devices utilizing AirDrop and Google noting more than 3 billion Android devices with Quick Share. The identified vulnerabilities could affect a significant number of users.

Potential Exploitation Scenarios

The most immediate risk identified is disruption, such as the AirDrop bugs that could cause the sharing service to crash. On Samsung devices, attackers might manipulate connection behavior or inject control messages during an active transfer. The Google Quick Share for Windows bug, described as a heap use-after-free issue, is considered more serious and could potentially be developed into a remote code-execution exploit.

Google has stated that the identified flaw for Quick Share for Windows has been patched and advised users to keep their devices updated. The other vendors have also acknowledged the reports, according to the researchers.

Protecting Users from Nearby Sharing Risks

Experts advise users to be particularly cautious in crowded public spaces like airports, coffee shops, and conference rooms, where a nearby attacker could target multiple devices simultaneously. Key recommendations include:

• Updating devices: Regularly installing software updates for iOS, iPadOS, macOS, Android, and Windows is crucial, as vendors work to address these vulnerabilities.
• Limiting AirDrop on iPhones: Users should set AirDrop to "Receiving Off" or "Contacts Only" for everyday use. The "Everyone for 10 Minutes" setting should be used only when actively expecting a file.
• Configuring Quick Share on Samsung: Similar to AirDrop, Quick Share should be set to "No one" or "Contacts only" to limit discoverability. The "Everyone" option should be reserved for specific file transfer needs.
• Declining unknown requests: Users should treat unsolicited file requests from strangers as a potential red flag and decline them.
• Disabling sharing features in crowds: Turning off nearby sharing functionalities when in crowded environments can significantly reduce exposure.
• Careful handling of personal files: When sending sensitive documents, users should double-check recipients, confirm devices in person, and consider using secure cloud storage services.
• Managing Bluetooth and Wi-Fi: While not necessary to keep off all day, disabling sharing features when not in use is recommended.
• Using security software: Antivirus software can help detect malicious files if an accidental download occurs, especially on computers using Quick Share for Windows.