The Beijing Municipal Bureau of Justice (BMBJ), a state-backed institution in China, has recently released a statement claiming to have successfully decrypted Apple’s AirDrop protocol. As reported by Bloomberg, this would allegedly allow the country’s authorities to identify the source of certain transfers. Let’s review everything we know.
A supposed system with several requirements to consider
AirDrop is a service that allows us to discover other nearby Apple devices and securely transfer files through Wi-Fi and Bluetooth. A protocol that is widely used to share photos, videos, documents, contacts, passwords, boarding passes, tickets and other files quickly and without the need for an internet connection. A completely secure method thanks to the encryption that has been attracting the attention of the Chinese government for some time.
In November 2022, Apple changed the way to receive AirDrop transfers on devices in China after anti-government activists used the feature to spread political flyers. Following the expansion of the changes, our devices now only show us transfer requests from people on our contact list. Thus, the option for open reception to “Everyone” remains active for only 10 minutes.
Going further, the BMBJ claims to have developed a method to extract information from AirDrop transfers, exposing identifying information of users. According to the BMBJ website, local log files from some iPhones were analyzed to create a reference table that established a relationship between the hidden hash values in the original text and the phone numbers and email accounts of the AirDrop content senders.
While a phone number and an email address are data that may not identify anyone, as it is easy to enter random information when setting up any service, the Chinese institution claims to have already solved several cases with this system. A resolution apparently due to the fact that by analyzing the log files of the transfers received on an iPhone that claims to have received illegal content, it could be possible to find out the phone number or email address of the sender.
The security of AirDrop does not depend on the anonymity of users. At the moment of initiating a transfer, we quickly see the name of the recipients, for example. The logs of the transfers are also encrypted within the receiving device, so only with the cooperation of the same can access certain information. Even with the multiple uncertainties in the information published by the BMBJ, and recognizing that it is difficult to verify the published claims, we will see if any updates occur in the field of these wireless transfers.
