Millions of Apple Airplay-Enabled Devices Can Be Hacked via Wi-Fi

Apple's AirPlay feature has become an integral part of our daily lives, allowing us to effortlessly stream music or show photos and videos on other devices or smart speakers and TVs that integrate the protocol. However, a recent discovery by researchers at cybersecurity firm Oligo reveals that this convenience comes with a significant security risk. The researchers have identified a collection of vulnerabilities affecting AirPlay, which they call "AirBorne," that could allow hackers to take control of hundreds of millions of devices on the same Wi-Fi network as them.

According to Gal Elbaz, Oligo's chief technology officer and cofounder, the AirBorne vulnerabilities affect a wide range of third-party devices that support AirPlay, including speakers, receivers, set-top boxes, and smart TVs. This means that millions of devices around the world could be exposed to these security flaws, making them vulnerable to hacking.

The researchers found two types of bugs in Apple's AirPlay software development kit (SDK) for third-party devices. The first type allows hackers to hijack gadgets on the same Wi-Fi network as the hacker's machine, while the second type would have allowed hackers to exploit AirPlay-enabled Apple devices, but these bugs have already been patched by Apple in recent updates.

However, Oligo warns that many of the vulnerable third-party devices have microphones and could be turned into listening devices for espionage. The researchers did not create proof-of-concept malware for any particular target, but they demonstrated their AirBorne hacking technique to take over an AirPlay-enabled Bose speaker, showcasing their company's logo.

The Scope of the Problem

According to Oligo, potentially vulnerable third-party AirPlay-enabled devices number in the tens of millions. This is a staggering number, and it's clear that many of these devices will take years to patch or may never receive updates at all.

"The amount of devices that were vulnerable to these issues, that's what alarms me," says Uri Katz, an Oligo researcher. "When was the last time you updated your speaker?" This highlights the importance of regular software updates and the need for device manufacturers to prioritize security in their products.

The Attack Vector

Oligo warns that hackers can exploit these vulnerabilities by gaining access to the same Wi-Fi network as vulnerable devices. Once on the network, they could take control of these devices, use them to spread malware, or add them to a botnet of infected machines.

The CarPlay Connection

Interestingly, Oligo found that some AirBorne vulnerabilities also affect CarPlay, which is used in over 800 car and truck models. However, these vulnerabilities can only be exploited if the hacker pairs their device with the head unit via Bluetooth or a USB connection.

The Impact on Consumers

While Apple has pushed out security updates to fix some of the AirBorne vulnerabilities, many consumers may not have taken advantage of these patches. This means that millions of devices around the world are still vulnerable to hacking, making them susceptible to identity theft, financial loss, and other malicious activities.

The Conclusion

The discovery of the AirBorne vulnerabilities highlights the importance of security in our daily lives. It's essential for device manufacturers to prioritize security in their products and for consumers to stay vigilant and keep their devices updated.

What Can You Do?

If you have an AirPlay-enabled device, it's essential to check if your device is vulnerable to the AirBorne vulnerabilities. You can do this by visiting the Oligo website or checking with your device manufacturer for updates on patching these vulnerabilities.

Regular software updates are crucial in protecting our devices from security threats. Don't forget to update your speakers, smart TVs, and other connected devices regularly to keep them secure.