Apple AirDrop leaks user data like a sieve. Chinese authorities say they’re scooping it up.

Rainbow tables were first proposed in 1980 as a means for vastly reducing what at the time was the astronomical amount of computing resources required to crack at-scale hashes, the one-way cryptographic representations used to conceal passwords and other types of sensitive data. Additional refinements made in 2003 made rainbow tables more useful still.

When AirDrop is configured to distribute files only between people who know each other, Apple says, it relies heavily on hashes to conceal the real-world identities of each party until the service determines there’s a match. Specifically, AirDrop broadcasts Bluetooth advertisements that contain a partial cryptographic hash of the sender’s phone number and/or email address.

If any of the truncated hashes match any phone number or email address in the address book of the other device, or if the devices are set to send or receive from everyone, the two devices will engage in a mutual authentication handshake. When the hashes match, the devices exchange the full SHA-256 hashes of the owners’ phone numbers and email addresses. This technique falls under an umbrella term known as private set intersection, often abbreviated as PSI.

In 2021, researchers at Germany’s Technical University of Darmstadt reported that they had devised practical ways to crack what Apple calls the identity hashes used to conceal identities while AirDrop determines if a nearby person is in the contacts of another. One of the researchers’ attack methods relies on rainbow tables.

Matthew Green, an expert in cryptography at Johns Hopkins University, said that the researchers’ rainbow-table approach to de-anonymizing AirDrop users is almost certainly what Chinese authorities are using. In a post Thursday, he wrote:

For a variety of mildly defensible reasons—which I will come back to in a moment—Apple does not use a secure PSI protocol to solve their AirDrop problem. Instead they did the thing that every software developer does when faced with the choice of doing complicated cryptography or “hacking something together in time for the next deadline”: they threw together their own solution using hash functions.

The TU Darmstadt researchers do a nice job of reverse-engineering Apple’s protocol in their paper. Read it! The important bit happens during the “Discovery” portion of the protocol, which happens during the HTTPS POST request below:

Diagram capturing the flow during the discovery phase in AirDrop.

Credit: Heinrich et al.

The very short TL;DR is this:

1. In the POST request, a sender attaches a SHA-256 hash of its own Apple ID, as part of a certificate that it gets from Apple. (If the sender has more than one identifier, e.g., a phone number and an email address, this will contain hashes of each one.)
2. The recipient then hashes every entry in its Contacts list and compares the results to see if it finds a match.
3. If the recipient finds a match, it indicates this and accepts later file transfers. Otherwise, it aborts the connection.

(As a secondary issue, AirDrop also includes a very short [two-byte] portion of the same hashes in its BLE advertisements. Two bytes is fairly short, which means this shouldn’t leak much information, since many different addresses will collide on a two-byte hash. However, some other researchers have determined that it generally does.)

A second important issue here is that the hash identifiers are apparently stored in logs within the recipient’s phone, which means that to obtain them you don’t have to be physically present when the transfer happens. You can potentially scoop them out of someone else’s phone after the fact.

Apple, put on notice, takes no action

Green noted that given the resources available to the Chinese government, it’s easily within its means to pre-compile a list of hashes for every phone number in that country. Compiling hashes of email addresses would be harder but still possible. Then, when investigators encounter an illegal AirDrop transmission, they can compare the hash of the sender to the ones on the list. When there’s a match, the investigators will finger the phone number or email address of the sending party.