Surveillance Concerns: China’s Ongoing Pursuit to Monitor Apple’s AirDrop Raises Privacy Alarms Amid Activist Usage
The Chinese government has recently declared its capability to unveil the identities of Apple device owners utilizing AirDrop, Apple’s wireless sharing protocol. A Beijing-based institute claims to have cracked the encryption of iPhone device logs, exposing the email addresses and phone numbers of users engaging in AirDrop transmissions. Traditionally, activists and dissidents have turned to AirDrop for private and untraceable message sharing, avoiding easy surveillance.
As reported on a Chinese government website (via Bloomberg), the institute in Beijing discovered that Apple stores encrypted phone numbers and email addresses of users involved in AirDrop transactions within iPhone log files. Notably, the institute successfully extracted and analyzed records from phones provided by law enforcement, as outlined in the post.
According to the Chinese government’s findings, Apple encrypts details such as an AirDrop sender’s device name, email address, and phone number, representing them as hash values. The institute utilized a sophisticated rainbow table, essentially a table of reversed hashes, to decrypt the data. This process allowed them to access the encrypted information, ultimately revealing the identity of the sender through their email address and phone number. The revelation raises concerns about the privacy of AirDrop users in China, particularly activists who have historically relied on the protocol for discreet communication.
The Chinese government also says that law enforcement has managed to identify “multiple suspects” in a case. The institute managed to achieve this by analysing both the sender’s device and the receiver’s device. It is currently unclear whether Apple plans to issue a patch that fixes the flaw identified by the government.
Bloomberg reported in 2022 that Apple limited the capability of its AirDrop wireless sharing feature as part of the iOS 16.1.1 update in China. While the US firm previously allowed users to receive files from all users, their contacts, or no one, the first option was reduced from an always-on mode to a limited 10-minute window. This limitation was later expanded to all iPhone models globally.
The detection method listed by the Chinese government suggest that both the sender’s and receiver’s smartphones are required in order to confirm the user identities. AirDrop wirelessly transfers data between Apple devices without requiring an Internet connection, while both devices do not need to be on the same Wi-Fi network. As a result, the cracking of AirDrop would allow the government monitor transfers that are difficult to track as they work without access to the Internet.