DISCOVERING AND EXPLOITING NOVEL SECURITY
VULNERABILITIES IN APPLE ZEROCONF(Xiaolong Bai, Luyi Xing) (co-first authors),
Nan Zhang , XiaoFeng Wang , Xiaojing Liao , Tongxin Li , Shi-Min Hu
Tsinghua University,
Indiana University Bloomington
Georgia Institute of Technology,
Peking University

1

Who are we ?
• System Security Lab, Indiana University Bloomington– Focus on novel problems in system security– High-impact publications on IEEE S&P, ACM CCS, Usenix Security, NDSS
– http://sit.soic.indiana.edu/en/• Our advisor: Prof. XiaoFeng Wang
– Top 10 authors on leading security venues for the past 10 years– http://www.informatics.indiana.edu/xw7/2

Who are we ?
• We have two talks on Black Hat USA 2016
– Luyi Xing and Xiaolong Bai, DISCOVERING AND EXPLOITING NOVELSECURITY VULNERABILITIES IN APPLE ZEROCONF, August 4, Jasmine
Ballroom, 12:10 - 13:00– Nan Zhang, DANGEROUS HARE: HANGING ATTRIBUTE REFERENCES
HAZARDS DUE TO VENDOR CUSTOMIZATION, August 4, South Seas
GH, 17:00 - 17:25

3

DISCOVERING AND EXPLOITING NOVEL SECURITY
VULNERABILITIES IN APPLE ZEROCONF

4

ZeroConf• Zero Configuration Networking• Automatically configures a usable computer network– No manual configuration– No specific configuration server• Designed to reduce users’ burden– Setting up a new network– Use a new service.

5

ZeroConf• Bonjour protocol– zero-configuration networking over IP that Apple has
submitted to the IETF.

• Goals:– With little or no configuration– to add devices/services to a local network– Existing devices can automatically find and connect tothose new devices/services
6Bonjour• Administrators– no need to assign IP, host names, service names to network services(e.g., printer)• When using a service, users simply– ask to see what network services are available– and choose from the list of automatically discovered services.
7

How about traditional
configured network?

8

Traditionally✔

Must Configure:– IP– Printer name,• e.g., lh135-soic.ads.iu.edu– DNS server9TraditionallyMust Configure:– IP– Printer name,• e.g., lh135-soic.ads.iu.edu– DNS server

10Features of Bonjour
1. Service configures itself– IP, hostname, service instance name

2. Clients automatically discover available services– No pre-knowledge of the service’s name, hostname or IP

11

1. ZeroConf Concept
2. So, how?

12Features of Bonjour
1. Service configures itself– IP, hostname, service instance name

2. Clients automatically discover available services– No pre-knowledge of the service’s name, hostname or IP

13

Add a new printer to a network14

A printer configures itself

Is anybody using IP
fe80::abcd:1234....?

15

A printer configures itself
IP
fe80::abcd:1234

No?
Great, I’ll take it.

16

A printer configures itself
IP
fe80::abcd:1234

Anybody using hostname
HP9FE5.host.local?

17

A printer configures itself
IP
fe80::abcd:1234
Hostname
HP9FE5.host.local

No?
Wonderful, I’ll take it.

18

A printer configures itself
IP

Anybody having a printing
service named HP-Service9FE5?

fe80::abcd:1234
Hostname
HP9FE5.host.local
Service Instance Name
HP-Service-9FE5

19

A printer finishes configuring itself
IP
fe80::abcd:1234
Hostname
HP9FE5.host.local
Service Instance Name
HP-Service-9FE5

20

Features of Bonjour
1. Service configures itself– IP, hostname, service instance name

2. Clients automatically discover available services– No pre-knowledge of the service’s name, hostname or IP

Two phases: Discovery and Resolution

21

Automatically find the printer: Discovery

Q1:
Anyone has a printer service?

A1:
I have HP-Service-9FE5

22

Automatically find the printer: Resolution

Q1:
Anyone has a printer service?
Q2:
So on which host is this HP-Service9FE5?

A1:
I have HP-Service-9FE5
A2:It’s on host
HP9fe5.host.local

23

Automatically find the printer: Resolution

Q1:
Anyone has a printer service?
Q2:
So on which host is this HP-Service9FE5?
Q3:What is the address of
NPI9fe5.host.local?

A1:
I have HP-Service-9FE5
A2:It’s on host
HP9fe5.host.local
A3:
Its address is
fe80::abcd:1234

24

Added/Saved the printer to your list
IP
fe80::abcd:1234
Hostname
HP9FE5.host.local
Service Instance Name
HP-Service-9FE525

Added/Saved the printer to your list
IP

Apple:
Applications store service instance names,
so if the IP, port, or host name changed, theapplication can still connect.

fe80::abcd:1234
Hostname
HP9FE5.host.local
Service Instance Name
HP-Service-9FE5

26

Service instance name HP-Service-9FE5
is savedIP
fe80::abcd:1234
Hostname
HP9FE5.host.local
Service Instance Name
HP-Service-9FE5

Saved printer =A printer who owns service name HP-Service-9FE5

27

Adversary Model• On a device (malware infected) in your local network• Aims to intercept secrets/files transferred between
uninfected devices

28Adversary Model• Your Mac/printer are un-infected• Steal your printing documents?

29

1. ZeroConf Concept
2. ZeroConf How

3. ZeroConf Breaking
Printer30

1. ZeroConf Concept
2. ZeroConf How

3. ZeroConf Breaking
Case 1: Attack Bonjour

31

Attack Bonjour• Two examples• Printer– Printers using Bonjour• PhotoSync– Synchronizing photos between Mac and iPhone using Bonjour• Not an application-specific or service-specific problem– Vulnerabilities in the design of Bonjour protocol

32

A device infected by malware
IP
Hostname
Service Instance Name
HP-Service-9FE5

33

A device infected by malware
IP
Hostname
Service Instance Name
HP-Service-9FE5

I have a printing service
instance named
HP-Service-9FE5

Service Instance Name
HP-Service-9FE5

34

A device infected by malware
IP
Hostname
Service Instance Name
HP-Service-9FE5

I have a printing service
instance named
HP-Service-9FE5
xf

Service Instance Name
HP-Service-9FE5

35

Saved printer =A printer who owns service name HP-Service-9FE5
New Service Name
HP-Service-9FE5 (2)xService Instance Name
HP-Service-9FE536

Why it happens?
Three Changing Attributes:– IP– Hostname– Service Instance NameApple:
Applications store service instance names,
so if the IP, port, or host name changed, theapplication can still connect.

37

Lack of authentication
Three Changing Attributes:– IP– Hostname– Service Instance Name

• Anyone can claim any value of the three attributes• The protocol only guarantees no duplicates.
38

If not saving service instance names,
is it secure enough?

39

Attack Bonjour• PhotoSync– Synchronizing photos between Mac and iPhone using Bonjour• Not saving service instance name– Client discovers and resolves the server each time40Normally• Discovery: Client browses for server
Who has PhotoSync service

ServerClientmeans broadcast
41Normally• Discovery: Server responds with service instance nameWho has PhotoSync service
I have. service instance name: abcd

ServerClientmeans broadcast
42Normally• Resolution 1: Client queries for the host name of the service
Who has PhotoSync service
I have. service instance name: abcd
What is the host name of abcd

ServerClientmeans broadcast
43Normally• Resolution 1: Server responds with the host nameWho has PhotoSync service
I have. service instance name: abcd
What is the host name of abcd
Its host name is Macbook
ServerClientmeans broadcast
44Normally• Resolution 2: Client queries for the address of the hostWho has PhotoSync service
I have. service instance name: abcd
What is the host name of abcd
Its host name is Macbook
What is the address of Macbook

ServerClientmeans broadcast
45Normally• Resolution 2: Server responds with its address
Who has PhotoSync service
I have. service instance name: abcd
What is the host name of abcd
Its host name is Macbook
What is the address of Macbook
ClientServerIts address is 192.168.0.1
means broadcast
46

What Can Go Wrong?
• Another malware-infected device spoofs the client– Successful Man-in-the-Middle• During Resolution– Service instance name to host name– Host name to address47

What Can Go Wrong?
• Attack 1: service instance name to host nameWhat is the host name ofservice instance abcd
ServerClientAttacker48

What Can Go Wrong?
• Attack 1: service instance name to host name
The host name of service
instance abcd is Macbook
ServerClient

The host name of service
instance abcd is Mallory

Attacker49

What Can Go Wrong?
• Attack 1: service instance name to host nameServerClientConnect

Attacker50

What Can Go Wrong?
• Attack 1: service instance name to host nameServerConnect
ClientConnect

Attacker51

What Can Go Wrong?
• Attack 2: service instance name to host nameWhat is the address ofhost Macbook
ServerClientAttacker52

What Can Go Wrong?
• Attack 2: service instance name to host name
The address of host Macbook
is 192.168.0.1

ServerClient
The address of host Macbook
is 192.168.0.100

Attacker53

What Can Go Wrong?
• Attack 2: service instance name to host nameServerClientConnect

Attacker54

What Can Go Wrong?
• Attack 2: service instance name to host nameServerConnect
ClientConnect

Attacker55

Demo• https://www.youtube.com/watch?v=WUWusqgqFr0&feature=
youtu.be56

Fundamental Problem•••

Lack of authentication
Anyone can claim any value of the identification attributes
The protocol only guarantees no duplicates, but not security.

Is it easy to provide authentication?

57

1. ZeroConf Concept
2. ZeroConf How
3. ZeroConf Breaking

Case 2: Airdrop58

Airdrop between Apple devices• With AirDrop, you can share photos, videos, websites,
locations, and more with people nearby with an Apple device.

59

Attack Airdrop

Jeff’s Macbook:
Q1: Anyone has an
airdrop service?
Alice’s iPhone:
I have a service named
abcd.airdrop.service

60

Attack Airdrop

Jeff’s Macbook:
Q2: So on which host is
Alice’s service?

61

Attack Airdrop

Jeff’s Macbook:
Q2: So on which host is
Alice’s service?
Alice’s iPhone:
A2: It’s on host
Alices.iphone.local

Bob’s iMac:
A2: It’s on host Bobs.imac.local

62

Alice’s iPhone has service named abcd.airdrop.tcp,
which is on host Bobs.imac.local

Jeff’s Macbook:
Q2: So on which host is
Alice’s service?
Alice’s iPhone:
A2: It’s on host
Alices.iphone.local

Bob’s iMac:
A2: It’s on host Bobs.imac.local

63

Does TLS help?

Jeff’s Macbook:
Connect
https://Bobs.imac.local
Alice’s iPhone:
A2: It’s on host
Alices.iphone.local

Bob’s iMac:
A2: It’s on host Bobs.imac.local

64

TLS in Airdrop
https://Bobs.imac.local
Server certificate issued to appleid. CDEF …
Bob’s iMac
Jeff’s Macbook

https://Alices.iphone.local
Server certificate issued to appleid.ABCD…
Alice’s iPhone
65

So the certificate in airdrop
can hardly be used for authentication.
https://Bobs.imac.local
Server certificate issued to appleid.CDEF…
Bob’s iMac
Jeff’s Macbook

https://Alices.iphone.local
Server certificate issued to appleid.ABCD…
Alice’s iPhone66

Domain should match the certificate
https://Bobs.imac.local
Server certificate issued to appleid.CDEF…
Bob’s iMac
Jeff’s Macbook

https://google.com
xf
Certificate issued to google.com
xf

67

Domain should match the certificate
https://Bobs.imac.local
Server certificate issued to appleid.CDEF…
Bob’s iMac
Jeff’s Macbook

https://Alices.iphone.local
Server certificate issued to appleid.ABCD …
Alice’s iPhone
68

What’s wrong with TLS in Airdrop• The certificate in airdrop cannot be used for authentication– E.g, certificate should be issued to Alice– but indeed issued to appleid.ABCD…

• The certificate should be issued to WHAT?

69

What’s wrong with TLS in Airdrop• Issue the certificate to the domain (host name)?
– No. Host name may change and not representing a user

• Issue the certificate to the user’s name?
– No. Name can be duplicated• Issue the certificate to the user’s social security number?
– No. social security number is too private

70What’s wrong with TLS in Airdrop• Linking a human to her certificate is complicated– challenge in finding any identifiable information that are• well-known• no privacy implication• and unique

71

Demo
• https://www.youtube.com/watch?v=2JEJLpvnRO4

72

Technical Details• Airdrop service daemon: /usr/libexec/sharingd– Responsible for Bonjour process and https connection• Not ethernet interface, Apple private interface– awdl0: Apple Wireless Direct Link
– Device-to-device direct link73

Technical Details• How to work on this interface?
– sharingd uses an Apple-private socket option SO_RECV_ANYIF(0x1104)74

Some customized ZeroConf protocols• FileDrop– TCP packets for discovery– elliptic curve cryptography for security– Failed in authentication• challenge in linking a human to her public key

75

1. ZeroConf Concept
2. ZeroConf How

3. ZeroConf Breaking
Case 3: Apple’s Vulnerable framework76Apple’s Vulnerable framework• Multipeer Connectivity (MC)– A framework for automatic service discovery between nearby devices
across Wi-Fi and Bluetooth without configuration• Object to identify each app: peerID– displayName (public) & uniqueID (private)77Normally• Automatic Service Discovery Without Configuration– Servers advertise peerIDs
ServerpeerID
displayName: Alice
uniqueID: 8573a

peerID
displayName: Bob
uniqueID: 6c5b3

ServerClient78

Normally• Automatic Service Discovery Without Configuration– Servers advertise peerIDs, Client browse peerIDs (show displayName)
ServerpeerID
displayName: Alice
uniqueID: 8573a
Alice
Bob

peerID
displayName: Bob
uniqueID: 6c5b3

ServerClient79

Normally• Even if servers have the same displayName
ServerpeerID
displayName: Alice
uniqueID: abcde

peerID
displayName: Alice
uniqueID: 54321

ServerClient80

Normally• Even if servers have the same displayName– uniqueIDs generated by MC will always be different
ServerpeerID
displayName: Alice
uniqueID: abcde

peerID
displayName: Alice
uniqueID: 54321

ServerClient81

Normally• Even if servers have the same displayName– uniqueIDs generated by MC will always be different
ServerpeerID
displayName: Alice
uniqueID: abcde
Alice
Alice

peerID
displayName: Alice
uniqueID: 54321

ServerClient82

What Can Go Wrong?
• Attacker acts as both client and server– Browse and acquire peerID object from victim server
ServerpeerID
displayName: Alice
uniqueID: abcde

Client & Server

Client83

What Can Go Wrong?
• Attacker acts as both client and server– Advertise using the same peerID object
ServerpeerID
displayName: Alice
uniqueID: abcde
AlicepeerID
displayName: Alice
uniqueID: abcde

Client & Server

Client84

What Can Go Wrong?
• Client can not distinguish because of same uniqueID
ServerpeerID
displayName: Alice
uniqueID: abcde
AlicepeerID
displayName: Alice
uniqueID: abcde

An Update?
Client & Server

Client85

What Can Go Wrong?
• Client can not distinguish because of same uniqueID• Client maps the only peer to attacker’s address (MitM)
ServerpeerID
displayName: Alice
uniqueID: abcde
AlicepeerID
displayName: Alice
uniqueID: abcde

Client & Server

Client86

Technical Details• MitM attacker– First acts as client browsing for advertising servers– Once found a server, advertise using the same peerID87

If not using peerID to for identification,is it secure enough?

88

1. ZeroConf Concept
2. ZeroConf How

3. ZeroConf Breaking
Case 4: MC in QQ

89

MC in QQ

Face to Face Transfer• Popular instant messaging software in CN– 829 million active accounts (Wikipedia)• Face-To-Face Transfer– Transfer files between nearby peers by using
Multipeer Connectivity• Not using peerID for identification– Customized unique QQ ID

Send File

Recv File90

Normally• Receiver advertises its QQ ID
My QQ ID is 1234

ReceiverLooking for receiver

SenderReceiverMy QQ ID is 4321

91

Normally• Sender browses for receivers and found their QQ IDs
My QQ ID is 1234

ReceiverFound Receivers:
QQ ID: 1234
QQ ID: 4321

SenderReceiverMy QQ ID is 4321

92

Normally• Sender connects to receiver and gives its QQ ID
Receiver
Connect
Found Receivers:
QQ ID: 1234
QQ ID: 4321

My QQ ID is 5678
My QQ ID is 5678
Connect

SenderReceiver93Normally• Sender connects to receiver and gives its QQ ID
Receiver
Connect
Found Receivers:
QQ ID: 1234
QQ ID: 4321

My QQ ID is 5678
My QQ ID is 5678
Connect

SenderSender Connected:
QQ ID: 5678

Sender Connected:
QQ ID: 5678

Receiver94

What Can Go Wrong?
• Receiver advertises its QQ ID
My QQ IDis 1234

Looking for receiver

SenderLooking for receiver

Attacker

Receiver95

What Can Go Wrong?
• Attacker found victim receiver’s QQ ID
My QQ IDis 1234

Looking for receiver

SenderFound Receiver:
QQ ID: 1234

Attacker

Receiver96

What Can Go Wrong?
• Attacker advertise using the same QQ ID
My QQ IDis 1234

Looking for receiver

SenderAdvertising
QQ ID: 1234

Attacker

Receiver97

What Can Go Wrong?
• Sender found only one QQ ID
My QQ IDis 1234

Found Receiver:
QQ ID: 1234

Sender

Attacker

Receiver98

What Can Go Wrong?
• Sender connects to Attacker

Found Receiver:
QQ ID: 1234

SenderConnect
QQ ID:5678

Attacker

Receiver99

What Can Go Wrong?
• Attacker connects to Receiver using the Sender’s QQ ID

Connect
QQ ID:5678

Sender

Attacker

Receiver100

Demo• https://www.youtube.com/watch?v=B71FlD3_vrc

101

1. ZeroConf Concept
2. ZeroConf How

3. ZeroConf Breaking
Case 5: Bluetooth102

All your iOS notifications belong to me• ZeroConf on Bluetooth: Apple Handoff– A service that lets iOS and OS X synchronize data through Bluetoothwithout configuration

103Normally• Handoff creates Bluetooth Channel without configuration– Devices logged in with the same iCloud account– Pairing automatically through iCloud accountBluetooth104

What Can Go Wrong?
• Bluetooth ZeroConf: No app-level authentication• Apple Notification Center Service (ANCS)– designed for Bluetooth accessories to access notifications on iOS devices

Bluetooth105

What Can Go Wrong?
• Bluetooth ZeroConf: No app-level authentication• Apple Notification Center Service (ANCS)• Through Bluetooth channel created by Handoff

Bluetooth106What Can Go Wrong?
• Bluetooth ZeroConf: No app-level authentication• Apple Notification Center Service (ANCS)• Through Bluetooth channel created by Handoff

Bluetooth

107

Demo
• https://www.youtube.com/watch?v=c5viAzAs0Uo108

Summary of attacks• Attacks on Apple ZeroConf channels– Bonjour (Printer, PhotoSync)– Airdrop– Customized ZeroConf protocols (Filedrop)– Multipeer Connectivity (MCBrowserViewController, QQ)– Handoff• All vulnerabilities were reported to vendors, acknowledged bymost vendors
109

1. ZeroConf Concept
2. ZeroConf How
3. ZeroConf Breaking

4. Impact

110Impact• Measurement– We analyzed 61 popular Mac and iOS apps working with ZeroConf– 88.5% are vulnerable to man-in-the-middle or impersonation attacks
ZeroConf
Channels

Vulnerable/
SampledSensitive Information Leaked

Bonjour

18/22

files, directories and clipboard synced, documents printed,
instant message

MC

24/24

files and photos transferred, instant message

BLE

10/13

User name and password for OS X

Customized
protocols

2/2

remote keyboard input and files transferred111

1. ZeroConf Concept
2. ZeroConf How
3. ZeroConf Breaking
4. Impact

5. Protecting ZeroConf

112

Protecting ZeroConf• Problem: link a human to her certificate is complicated• Speaking out Your Certificate (SPYC)– Voice biometrics ties certificate to identity

113

Speaking Out Your Certificate
Hash hPartition tok n-bit segments

Δ1||Δ2||…||Δknk most significant bits

<w1, w2, …, wk>
Words list linking to the certificate

114

Protecting ZeroConf• Challenge: link a human to her certificate• Speaking out Your Certificate (SPYC)– Voice biometrics ties certificate to identity– Human Subject Study: convenient and effective

115

Conclusion• Apple’s ZeroConf techniques are not secure as expected– The usability-oriented design affects security• Addressing such security risks is nontrivial– Challenge in binding a human to her certificate• Our Defense: SPYC
– Voice biometrics ties certificate to identity116