Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols

Source: arXiv:2606.26967 · Published 2026-06-25 · By Arash Ale Ebrahim, Nils Ole Tippenhauer

TL;DR

This paper presents the first systematic, cross-platform security analysis of the widely deployed proximity file-transfer protocols Apple AirDrop and Android Quick Share. Despite over five billion devices supporting these protocols, their application-layer security has remained understudied due to proprietary, undocumented stacks. The authors use extensive reverse engineering, binary analysis, and a protocol-aware fuzzing framework called AIRFUZZ to reconstruct AirDrop's seven-layer state machine and adaptive compression format, as well as analyze Samsung's and Google's Quick Share implementations. They discover six vulnerabilities across macOS, iOS, Android, and Windows, including zero-click denial-of-service bugs on AirDrop and protocol-layer authentication and encryption bypasses in Quick Share, as well as a critical use-after-free in Google Quick Share's Windows client that allows remote code execution. All findings were responsibly disclosed and acknowledged by the vendors.

The study shows the relative complexity and attack surface in protocol design, serialization formats, and authentication layers of these proximity protocols. By combining multi-layer mutation strategies guided by coverage feedback and Frida-based instrumentation to bypass user consent, AIRFUZZ greatly improves acceptance rates for fuzzing the DVZip-compressed CPIO payloads. The cross-platform analysis surfaces divergent design choices, such as Apple's use of self-signed TLS with consent gating, Samsung’s lax handling of encrypted frames, and Google’s Windows client endpoint race condition. Overall, the work illuminates significant pre-authentication attack surfaces exploitable within wireless proximity and offers a reproducible methodology for fuzzing complex application-layer protocols implemented in privileged daemons.

Key findings

• V1 AirDrop (macOS/iOS): Sending an HTTP POST to an unknown path triggers a fatalError in Swift path router, crashing sharingd and causing denial of service; repeated attacks cause persistent DoS blocking AirDrop and other Continuity services.
• V2 AirDrop: Foundation.framework's XML plist recursive parser lacks depth limit, causing stack overflow and SIGBUS crashes after ~180-200 nested <dict> elements on macOS (Intel/Apple Silicon) and iOS ARM64e devices.
• V3 AirDrop: Network.framework's HTTP/1.1 parser null-pointer dereference triggered by malformed HTTP chunked transfer-encoding or conflicting Content-Length headers causes SIGSEGV crash.
• V4 Quick Share Samsung Android: Pre-authentication OfflineFrame dispatch bypass allows protocol interaction before UKEY2 handshake completion, leading to protocol-state manipulation.
• V5 Quick Share Samsung Android: Device-to-device (D2D) encryption bypass in three frame types where SecureMessage encryption wrapper is omitted, enabling plaintext processing for supposedly encrypted frames.
• V6 Quick Share Google Windows: A heap use-after-free triggered by endpoint collision race conditions during concurrent connect/disconnect leads to remote code execution (version 1.2.2472.1).
• AIRFUZZ's pre-compression mutation of raw CPIO archives before DVZip compression raised server acceptance from <1% to over 90%, enabling extensive protocol fuzzing and discovery of vulnerabilities V1-V3.
• Coverage-guided fuzzing with nine mutation layers (HTTP, plist, DVZip, CPIO, DER, havoc, memcorrupt, field-level) and targeted Frida hooks achieved approximately 950 unique edges in key frameworks across 250K+ executions.

Threat model

Adversaries are unprivileged wireless-proximity attackers within approximately 10-30 meters of the target device using commodity Wi-Fi/BLE hardware. They have no prior pairing, contact exchange, or shared credentials with the target and exploit zero-click vulnerabilities in open visibility modes (AirDrop “Everyone for 10 minutes”, Quick Share default visibility). The attacker cannot break hardware key storage or forge Apple ID certificate chains but can inject malformed protocol messages to privileged daemons handling proximity transfers.

Methodology — deep read

1. Threat Model & Assumptions: The adversary is a wireless-proximity attacker within typical 10-30m AWDL or Wi-Fi Direct range who has no prior relationship with the target device, requiring no pairing or contact exchange. The target's AirDrop or Quick Share is enabled in open visibility modes (“Everyone for 10 minutes” or default Quick Share visibility). Attacks execute zero-click without user interaction.

2. Data: The seed corpus for AirDrop fuzzing included 162 seed templates extracted from legitimate transfers between Apple devices across six scenarios (single image, multi-file, large files, URL sharing, VCF contact cards, directory transfer). TLS keys were logged with Wireshark to decrypt traffic and extract seeds. For Quick Share, reverse engineering used captured traffic from Samsung Galaxy S23 running Android 16 with Quick Share v13.8.01.11 and Windows Quick Share v1.0.2472.1.

3. Architecture/Algorithm: The AIRFUZZ fuzzer mutates protocol messages across nine layers: HTTP (path, headers, content-length), binary property lists (plist) (type confusion, nested containers), DVZip compression (chunk-level corruption), CPIO archive (headers, path traversal), DER ASN.1 structures, havoc random mutations, memcorrupt targeted corruptions, and field-level mutations preserving structure. The fuzzer mutates decompressed inputs before DVZip compression to preserve framing. A Frida-based auto-accept agent bypasses user consent in sharingd enabling full automation. Coverage is collected via handpicked Frida Interceptor hooks at the input boundary of each protocol layer due to arm64e Stalker instrumentation incompatibility.

4. Training Regime: Fuzzing evolves over four versions (AF1 to AF4) increasing mutation layers from HTTP+plist to full nine-layer + memcorrupt + pre-compression mutation. Runs exceeded 250,000 executions yielding 950 edges in system frameworks.

5. Evaluation Protocol: Crashes are detected via monitoring sharingd process respawns triggered by launchd. Inputs triggering crashes are saved for triage. Key crashes discovered (V1-V3) are analyzed for root cause, preconditions, impact, and reproduction across macOS/iOS variants. Quick Share vulnerabilities are identified via manual protocol parsing and testing on Samsung Android and Windows clients.

6. Reproducibility: The authors release reverse engineering artifacts including disassembly, plist keys, and AIRFUZZ code on Zenodo for transparency and replication. Precise symbol offsets and crash reproduction files are shared. Source code for the Frida agent and fuzzing harness is included.

Concrete Example: To trigger V1, the fuzzer sends an unauthenticated HTTP POST over TLS/awdl to an unknown URI path on port 8770 on a macOS sharingd. The sharingd code switches on allowed paths; unknown paths call Swift fatalError crashing the process. Repeated crafted POSTs induce persistent denial-of-service by crashing the daemon managing continuity services. This crash is caught by the fuzzer’s monitoring system, and the input saved for analysis.

Technical innovations

• Reconstruction of Apple AirDrop as a seven-layer protocol stack including proprietary DVZip adaptive compression and CPIO archive extraction through binary and dynamic analysis, enabling protocol-aware fuzzing.
• Development of AIRFUZZ, a multi-layer protocol-aware fuzzer that applies mutations before DVZip compression, increasing fuzzing acceptance rates above 90%, combined with Frida-based auto-accept instrumentation to enable zero-click testing.
• Manual coverage collection via targeted Frida Interceptor hooks circumventing arm64e codesigning and pointer authentication enforcement incompatibility with Frida Stalker on Apple Silicon and iOS devices.
• Cross-platform comparison of AirDrop and Android Quick Share protocols identifying shared pre-authentication design flaws and protocol-layer encryption bypasses absent from prior literature.

Datasets

• AirDrop seed corpus — 162 seed templates extracted from real transfers between Apple devices (images, multi-file, large file, URL sharing, VCF, directories) — public via Zenodo artifact
• Traffic captures from Samsung Galaxy S23 Ultra (Android 16) with Quick Share v13.8.01.11 — proprietary device data
• Google Quick Share Windows client v1.0.2472.1 — proprietary

Baselines vs proposed

• Frida Stalker instrumentation on arm64e macOS/iOS: target process crashes due to pointer authentication enforcement vs AIRFUZZ manual hook approach: stable coverage on arm64e enabling detection of vulnerabilities V1-V3
• Mutating compressed DVZip output: <1% server acceptance vs pre-DVZip decompression mutation: >90% acceptance, greatly improving fuzzing efficacy and vulnerability discovery
• Crash attack loop frequency: ~1 crash every 2 seconds for persistent AirDrop DoS (V1), blocking all legitimate connections during attack

Limitations

• Fuzzing limited by inability to use full dynamic binary instrumentation (Frida Stalker) on Apple arm64e/PAC due to kernel enforcement, reducing coverage granularity.
• Quick Share analysis partly based on Samsung Galaxy device and Google Windows client binaries; Android Quick Share generality beyond Samsung not fully explored.
• No full adversarial testing against active network attackers in non-proximity scenarios; attacks assume attacker is within wireless range and visibility modes enabled.
• User-consent prompt was bypassed using Frida hooks rather than replicated in a black-box setting, limiting evaluation of real-world automation.
• Potential protocol-layer replay or injection countermeasures outside application layer (e.g., lower link-layer defenses) are not evaluated.
• Limited discussion on remediation complexity, patch timelines, or impact on normal user experience for collateral continuity service crashes.

Open questions / follow-ons

• Can more robust, formally verified deserialization libraries replace vulnerable recursive plist and HTTP parsers in sharingd and Quick Share stacks?
• How can AWDL and Wi-Fi Direct link layers be hardened or augmented to detect and mitigate malicious pre-authentication frames?
• What automated instrumentation or coverage tooling can overcome arm64e pointer authentication and kernel mitigations to enable finer-grained fuzzing on Apple Silicon/iOS targets?
• Can stateful anomaly detection frameworks be applied in sharingd or Quick Share daemons to throttle or block malformed protocol usage before reaching vulnerable component?

Why it matters for bot defense

This work exposes fundamental pre-authentication protocol design weaknesses in commonly used proximity file transfer services, highlighting the risk of zero-click denial-of-service and protocol-layer state manipulation without any user interaction. For bot-defense and CAPTCHA practitioners, the analysis underscores the importance of rigorous state machine validation, depth-limited parsing, and cryptographic authentication enforcement even on local wireless protocols.

The AIRFUZZ approach—mutating decompressed payloads combined with coverage feedback—offers a practical strategy applicable to fuzzing other complex multi-layered application protocols beyond AirDrop and Quick Share. The cross-platform side-by-side analysis provides insight into differences in security postures that practitioners should consider when defending against proximity or device-to-device attacks. Defenses such as rejecting unexpected requests earlier, imposing resource limits on recursive parsing, and requiring proper cryptographic session establishment before command dispatch have parallels in hardening interactive bot-detection and challenge-response protocols.

Cite

@article{arxiv2606_26967,
  title={ Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols },
  author={ Arash Ale Ebrahim and Nils Ole Tippenhauer },
  journal={arXiv preprint arXiv:2606.26967},
  year={ 2026 },
  url={https://arxiv.org/abs/2606.26967}
}

Read the full paper

• arXiv:2606.26967 (abstract)
• arXiv:2606.26967 (PDF)