yeah this summer Apple newly introduced iPhone mirroring that means that is a
feature that allows users to remote control their locked iPhone wireless from their Mac
and how does this feature work?
Okay, I don't want to anticipate too much, Aron will give you a deep dive into this feature
and I'm really excited what he has to tell us. So, please welcome the fabulous Aron.
Thank you so much for that very warm introduction and also thank you all for being here at this
early time while many of you are still waiting in queue outside.
Yes, I want to take the next half hour to talk a bit about this new iPhone mirroring
feature that Apple introduced. Maybe before I get started let me tell you a few words of who I am.
Oh well, that skipped a bit too far forwards but I can still tell you that.
I'm Aron, I'm a Cybersecurity Master's student at the Hasso Plattner Institute in Potsdam
and I have also been a security researcher at Jiska Klassen's chair for around the past
six to ten months where I looked into things like Apple continuity, this whole Apple ecosystem
and in particular iPhone mirroring when it was introduced. And how did this whole story start?
Basically Apple held their annual Worldwide Developer Conference in May I think and basically
directly after that keynote presentation.
Jiska sent me an email with like, hey this is a very interesting feature, it looks very
weird from a security perspective, you are remote controlling your iPhone while it is
supposedly locked but maybe not really.
And it looks like you're controlling like a virtual machine but it's actually your iPhone
and like the iPhone should be locked but it isn't, it's just a very weird thing.
So maybe this might be interesting to look at and that is when I started and well arguably
it was quite interesting to look at. And what I found is what I want to talk about.
So for those of you who generally don't use the Apple ecosystem, let's maybe take a look
at how this feature is supposed to work.
Basically you have your iPhone, it is locked and you have your Mac and it has that window
up there which is basically your iPhone, you can click on it, you can interact with it,
you can open apps, you can look at your photos, do whatever you want.
Apart from a few limitations that I will go into in just a second.
What is somewhat interesting about this is the fact that there are a few awareness features
in this feature.
You've seen the first one right there which is that there is a permanent notification
on the lock screen of the iPhone while you're remote controlling the device.
And also after you unlock that iPhone afterwards there's this pill notification up top that
shows you yeah well there has been a connection since you last unlocked this iPhone.
And if you tap on it, it also shows you a list of which devices were connected and you
get the whole history and it's supposed to be very transparent and all that.
So let's maybe take a look at how this actually works.
Like from a security perspective but also just out of well what protocols are they using
to then later take a look at how we might be able to break this stuff.
And the foundation for all of this is Apple's continuity framework which is a name for
a number of features that all somewhat work differently but what this has quite a lot
of similarities to is Apple sidecar which is when you use your iPad as a second screen
for your MacBook and continuity camera where you can use your iPhone or your iPad as a
camera for your Mac for your Apple TV whatever.
And also I've put AirDrop in here even though it's technically not Apple continuity but
it actually works the same while other features just use plain Bluetooth.
And what is used here is these two protocols like a lot of abbreviations but let's look
at what they actually are.
First of all there is Apple Wireless Direct Link which is Apple's proprietary thing for
making devices talk to each other over Bluetooth and Wi-Fi.
The idea essentially is that they find themselves among each other via Bluetooth or energy and
after they've found each other.
They establish a Wi-Fi peer to peer connection which then allows you to transfer data at
relatively high data rates.
And this is used in the context of iPhone moving to transfer your mouse input your
keyboard input and other control commands that you send from your Mac.
But Apple Wireless Direct Link isn't really suitable for live video streaming and Apple
has their own proprietary protocol for that as well which works over Wi-Fi.
They call it low latency Wi-Fi and it is what they use for the media data so video and audio.
Interestingly this is basically the same thing.
It's the same thing that you would use for when using Apple Sidecar but just in reverse.
So here's the iPhone sending video to your Mac whereas with Apple Sidecar it's the Mac
sending video to your iPad and for the control data the other way around which was quite interesting.
So you might wonder well how does this actually work in terms of security and protection.
And I personally found this quite interesting and also a pretty nice solution actually.
And that is that Apple performs key management for this.
Which means that every Apple device that you have generates its public private key pair
and then syncs that to your iCloud key chain and these public keys are then synced among
all of your devices that are signed into your Apple ID which allows them to find each
other even though they're offline.
And they can just interact with that and you don't need any internet connection doing that
but it's still secure and you can basically perform a key exchange and it works. Okay.
After having talked.
Talked about how this feature is supposed to work and how it works from a technical perspective.
The next topic that came quite apparent that it needed to be discussed was the threat model
because as I said it's just a very weird feature.
What does Apple tell us what it's supposed to do? So.
It stays locked so nobody else can access it. So this is basically what Apple told us.
This is just a short extract from that Worldwide Developer Conference keynote presentation.
The iPhone is supposed to stay locked. But is it actually?
Because if we take a look at it okay well on the lock screen it says it is locked it
actually has that lock icon on there. But at the same time you've seen that picture already.
We are interacting with that iPhone. As though it was unlocked.
So it's definitely not really locked.
It's just some weird state in between and well that is just a very weird thing to have
and also opens the question of what exactly is this supposed to protect against and what
threats are they considering and what is out of scope and what is in scope and that
is what I wanted to take a look at.
And as I said this video is basically all that Apple told us about what the threat model
here is supposed to be. So what we already saw is that okay. The iPhone is supposed to be locked.
And you cannot access anything on the iPhone while you are remote controlling it.
And also it is supposed to be obvious that this remote control connection is established.
There are a few more things that Apple limits which is stuff like no camera and no microphone
access from your Mac while you are remote controlling the iPhone.
And also the fact that you cannot change certain settings such as you cannot change the pin
or the biometrics authentication methods on the iPhone while you are remote controlling it.
And from that.
I tried to derive what the threat model here actually is and I came to two main points.
Which is that first of all the iPhones are supposed to remain secure while they are being
remote controlled and they might be in another room, they might be in a pocket, somebody
might be able to get them in their hands while you are remote controlling it.
And also especially with these red things that I mentioned it appears that Apple is
aware of the fact that it is relatively likely that in situations where multiple people might
be using a Mac. Uh. In. All kinds of situations.
In all kinds of social situations it is realistic that the iPhone might in fact get remote controlled
by someone who is actually not supposed to do that and it should be apparent to the user
and it should at least prevent some of the issues that might happen.
And based off of that is what I looked into when I did security research.
And one of these topics was well Mac OS is a very interesting attack surface because
previously when you had your iPhone the only way to do much with it was while holding that
device in your hand.
And there isn't really much that you can do when you just connect it to a Mac via USB or anything.
It's basically limited to what you can do because it is already synced into your iCloud
account if you enabled that. So things like photos and contacts might be shared.
But you cannot just install applications or anything like that.
And in general Mac OS is a less secure platform in the sense that it is a far more open platform.
For example, you can at least run unsigned software. And you can also do a lot of other things.
You can disable security features that are just the default on iPhones and cannot be
disabled unless you jailbreak them or have a security research device.
And so there is a high risk for malware and abuse in Mac OS.
And with iPhone mirroring this basically enables a direct path from a compromise of the Mac
OS operating system to a compromise of the iPhone.
Because as we already saw we are now controlling iPhones from the Mac.
And one idea that I had what one could do here.
Is basically play around with these AWDL keys that I mentioned a few minutes ago.
And just swap them around.
The idea behind this being that I already mentioned we have this list of previously
connected devices.
And maybe we might be able to spoof which device appears when we connect from a different device.
Because maybe somehow the iPhone confuses the different devices if we swap around keys.
How might this key swapping work? Well. We need one or multiple Macs that have a number of keys.
And we need one or multiple Macs that have a number of keys.
So we have a set of security features. Namely system integrity protection disabled.
Which allows us to access these keys from software that we are able to write.
And in particular I used Frida which is a dynamic reverse engineering tool.
Which allows you to hook functions that are on anywhere in the system.
And you can modify the input values, the output values and the behavior.
And what I did is just hook these functions that are supposed to perform this whole key
authentication stuff. And then extract the functions. Extract the keys on one Mac.
And put them into another Mac. And then try what happens.
And what I found is that it is actually relatively well implemented.
Because first of all I can swap around keys from two Macs signed into the same Apple ID
of which one is not paired to the iPhone.
And no matter which keys you use, the mirroring feature still works.
But also you cannot just swap around keys to make a non-authenticated Mac suddenly work.
So from that perspective it is fine. And why might this work? Why might that be?
Well, I don't entirely know honestly.
Likely this is due to the fact that they are putting additional security measures into
the hardware security modules that they have in the Macs.
So they might have additional key material there that they store in a hardware module
that you just cannot access from software directly.
This is especially likely because Apple mentions the existence of such a hardware security
module as a system requirement for this iPhone mirroring feature.
So you cannot just use any old Mac but you need one that has like an Apple T1 or T2 chip.
But reverse engineering that software is actually incredibly hard because first of all the firmware
for these chips is relatively hardware dependent for the different device generations.
And also it just comes without symbols. It is generally not really available in binary form.
So it's just a lot of work that I didn't have the time to just look into that.
So this is what the security likely comes from. But I couldn't prove that yet.
Okay, let's now move on to the fun stuff, which is, well, where did this all go wrong?
And where did people make implementation mistakes?
Maybe just as a word before, well, just to notice, this whole feature is of course incredibly
complex and also making sure that the security guarantees that I mentioned beforehand are
actually applied in all parts of the system is an incredibly complex task.
So that mistakes are made here was quite likely and which is also why I found some.
And I like to call them Schrödinger's iPhone because, again, it's about this whole weird
thing with it's locked and it's not locked.
And in which situation does that application consider to be and when doesn't it?
So let's look at the first implementation issues in just a second.
Before that, let's look at how they actually implemented all of this and what impact iPhone
moving has when you're using the iPhone.
Again, this is an example I already told you about a moment ago.
You cannot change your touch ID and passcode.
So in this case it's an iPhone with a fingerprint sensor, but it could also be face ID.
You can change the settings while you're remote controlling the iPhone.
And apparently the settings app seems to be aware of the fact that the iPhone is being
remote controlled, but we should keep in mind that Apple currently does not provide any
public API to developers to check whether the iPhone is currently in such a state.
So these system applications are the only ones who are capable of actually checking.
So this was the first.
And the first vulnerability I found and that I actually reported to Apple, which is working
with Siri. And what I show here is that if I tell Siri to take a screenshot and send an iMessage
message to someone from that screenshot from the locked iPhone, well, it just doesn't work
and it asks me for my fingerprint for authentication.
But if I now connect to that iPhone via iPhone mirroring, well, let's try that again and
ask that question again.
And we will see in just a second that the iPhone will just take that screenshot.
And also, if we continue all of this, actually send it to someone.
And remember, this iPhone is supposed to be locked, as we were told in the keynote presentation.
And this was the fact in the second beta of iOS 18, so not a fully public release.
And apart from not only sending messages, the arguably far worse part was the fact that
you could also ask Siri to read out any iMessage messages from any user that you had received
before and it would just happily do so.
I reported that in July and Apple actually ultimately fixed it, so it was already completed
when the final release of iOS 18 came out in September.
And we can see here, yeah, luckily it is resolved, although it was ultimately at least for me
marked as a duplicate report because apparently multiple people had reported it at the same time.
Next up. Next up, this whole topic of camera and microphone access.
And this is where it actually becomes quite a lot more interesting.
Because when you try to access the camera or the microphone of a Mac, sorry, of the
iPhone from your Mac, you get this dialogue right here, which tells you, yeah, you cannot do this.
And you can just press okay. And after that, nothing happens.
And just to remember, well, in general, iPhone apps just cannot know that the iPhone is being
remote controlled. So I wondered what happens if I take a photo instead. Well, this happens.
And no, this is not a placeholder. This is actually the picture that you get.
So it appears that Apple seems to be quite keen on preventing this feature from working
even though it's not really cleanly implemented.
And I presume that it is supposed to be there for preventing people from spying on other
people where the iPhone might be in another room.
So this would at least justify why it is so hastily implemented that it just prints out
a green image and that there is no public API to check for anyone or anything. Okay.
So this doesn't work. Well, can we basically make the iPhone work as a spy device anyways?
And the idea I had was using Apple shortcuts, which is their automation tool.
If you've never used these before, you can just basically create programs in the drag
and drop interface.
And what I basically did is create a shortcut that waits for a few seconds, that then starts
a recording, waits some more time, stops that recording, and then sends it to someone
or just syncs it to the iCloud.
The idea being that if I disconnect from the iPhone, while this 10-second delay is
running, when that check is performed whether I can access the camera or microphone, I'm
not connected anymore and it just runs.
What also works, apart from just making recordings, is just initiating FaceTime calls, which is
far more awesome because I basically get a direct video and audio live feed from that device.
What else could I want more if I want to use this device as a bug?
And well, Apple told me that this is supposed to be expected behavior. Okay.
Well, that's what they initially told me.
When I rechecked this, when I prepared this presentation, funnily enough, I found that
this issue is in fact fixed.
The solution here is that all shortcuts are interrupted whenever you disconnect from
iPhone mowing, which is like a very stringent and maybe a bit too harsh solution for this
problem, but it works.
So this is why I'm also very happy to talk about it now because, again, this issue just
doesn't work anymore.
They just terminate all your shortcuts that are running, and in that way, you cannot start
any actions that then gain permissions from when you disconnect. So that is fixed, luckily. Okay.
Another topic I want to look at is persisting and hiding access. What do I mean by that?
iPhone mowing access is temporary and evident, which I've hopefully already shown you.
Just to recap in a few screenshots, I clicked too many buttons right here. There we go. Okay.
There we go. Basically, you need to re-enter your pin on the iPhone every few days maybe.
I don't entirely know what the conditions for that are.
So you cannot just continuously remote control the iPhone from anywhere.
And again, we have these notifications for current and past connections, and we have
this list of recent connections.
So these are the security features that Apple provides, and so let's take a look at what
we might be able to break from this. First off.
Let's take a look at normal operation on how these notifications are supposed to work.
For those of you who have not seen that feature in action before, this is now your chance
to see it in video.
I'm basically just performing a normal connection and disconnecting from the iPhone.
And in a second, we will see that when I take that iPhone into my hand, we see that that
permanent notification has disappeared, and that notification pops up, and if I click
on it, it opens the list of previous notifications. So this is the connection.
It's now automatically connected. Okay. So far, so good. This works. But let's try another thing.
Because we have access to these iPhone mirroring settings while we're remote controlling the
iPhone. And if we do so, and just open the settings up right here, then we can go ahead and go
to AirPlay and Continuity and open that iPhone mirroring settings page, and just delete the
Mac we're currently connected from so it doesn't appear anymore on that list, and well, it
terminates our connection.
But if we now take a look at the iPhone, we will see that, well, there still is a notification
after we unlock it.
But if we click on that notification, well, even that menu item about iPhone mirroring
at all doesn't exist anymore.
So anyone who would see that feature, who would see that notification might be able
to click on it, never see it again, and have no idea what actually happened, even though
the iPhone was just compromised and somebody has done basically anything with it.
And again, I report this to Apple. And what I was told is that this is not even a connection.
It's not even a security topic at all. Interesting. Okay.
Let's look at gaining persistence, so to not only gain that temporary access while remote
controlling the device. And there is a number of ways to do this.
First of all, you could do things like add Bluetooth devices.
Arguably, if you're already signed into the same Apple ID, some of the Apple devices basically
think that they're Bluetooth pairing over the iCloud anyways.
But at the same time, you can use the iCloud.
You can use this feature to pair any Bluetooth devices that might be used to maybe randomly
initiate FaceTime calls and similar things.
And I reported some of these things to Apple and was basically told, yeah, these are features.
These are supposed to be here.
So at some point, I basically stopped to report every feature that this whole system has as
a bug because apparently, well, it's wanted.
But I think especially as a security-conscious crowd here, you should be aware of these things.
We can, of course, also pair new Wi-Fi networks. Sniff Wi-Fi traffic.
And what we are also able to is install applications and give permissions.
And depending on what applications you might have in mind here, it might be used for permanent
location tracking, always uploading photos.
You might just basically use normal apps to just misuse them in a completely different
setting, which could, of course, be very problematic. Okay.
As a last major topic, let's look at stolen device protection, which is a feature that
some of you may have heard of.
It has been introduced after devices were stolen, especially in the U.S., after these
thieves had observed people entering their pins, which enabled these thieves to basically
change far more things than just have that iPhone in their hand and do things like make
payments using the paired credit cards, also apply for an Apple credit card and make purchases
with that. In the terms of tens of thousands. Thousands of dollars.
And also do things like changing the iCloud password, because for those of you who don't
know, you can change your iCloud password with just your iPhone and its pin for some reason.
And you can also do things like, yeah, that's basically the main features, and there's a
number of security things. You cannot change the pin of the device and so on and so forth.
And what the stolen device protection does is it introduces biometrics as the highest
security form of authentication. So, you need biometrics.
You need biometrics to perform an iCloud password change, and you need biometrics to access
locked and hidden apps, which is also a feature that has been newly introduced in iOS 18.
Further security features that come with this.
Well, this whole iPhone rebooting thing that you may have heard of that Jiska did some
research into this fall, where the iPhone reboots when it has not been unlocked for
72 hours might be tied to the stolen device protection.
And also what stolen device protection introduces is a so-called security delay.
Which means you have to authenticate if you want to do something, then wait another hour,
and then authenticate again to then access the security-critical settings, so that just
someone having the iPhone in their hand and making you put their finger in it or holding
it in front of your face, that just is supposed to not have any major impact.
So that's the idea behind this.
And to take a look at from a more graphical perspective what this does to the threat model,
if we don't use stolen device protection, basically we have our pin and our biometrics,
and these three things that I'm showing below are unlocking the device, changing the iCloud
password and accessing hidden and locked apps.
And if we don't use stolen device protection, we can use any of the two to do any of the three.
So that is perfectly fine.
But if we start using stolen device protection, this changes a bit, and we can only use the
pin to unlock the iPhone, and we need biometrics for the two other things.
But if we now enable stolen device protection and look at that in combination with iPhone
moving, it becomes far more interesting.
Because if we have another Mac that is signed into the same Apple ID, we only need the pin
to pair the iPhone to that Mac, which then for some reason allows us to access these
hidden and locked apps. Which I again found quite weird and reported to Apple.
And was told, well, again, this is supposed to be expected behavior.
And well, one could say yes, it doesn't say otherwise, because this is the dialogue that
is shown to you when you try to enable this feature, and it tells you, we require touch
ID to access this app. And then in the description it says, we require touch ID or the passcode.
And this description text does not change whether or not you're using stolen device protection.
But yeah. I would say it's at least unclear if you expect that feature to work because you've
tried it out, and it just suddenly doesn't work anymore, and it's just unexpected. Okay.
To let me conclude.
All in all, I think I've shown you that iPhone moving is a very complex and also unprecedented
feature, both in the Apple ecosystem and also in other mobile device ecosystems.
Because it's just so incredibly weird to have a locked device that can be remote controlled
at the same time.
And it has an incredibly complex threat model that I tried to understand, but I think that
is not really understood yet by anyone.
Next up, Apple tried to introduce a number of safeguards to protect this whole feature.
Which were successful in some parts. And required some refinements in other parts.
These initial implementations that they rolled out in these beta programs had pretty critical
bugs. Things like the Siri feature. This threat model is definitely not implemented consistently.
And I would also argue that app developers themselves need to be taken into account when
we're doing all of this.
Because they should also consider whether they want a certain feature of the apps to be available
while the iPhone is being remote controlled or not.
And maybe three last things of what I would maybe... Wish from Apple.
Is first of all to define what this threat model is actually supposed to protect against.
Because we as security researchers basically don't know.
We have to write reports and then be basically told that this is expected behavior or not.
And we cannot really know beforehand. Next up, protect some more critical resources.
So maybe consider whether it is a good idea that I can give permanent permissions to things
while the iPhone is being remote controlled.
That I can install apps while it's being remote controlled.
Maybe this is a feature that just isn't needed maybe.
And also lastly, and you might have maybe heard my cynicism from some of these reports.
Maybe probably assess reports that are reported to you when they are actually reported and
not at a later point when for some reason they are fixed six months later.
Because maybe there is things that are far more complex that you might not be looking
into and it would be nice if, well, these were considered.
And with that, thank you very much for being here.
And if you have any questions, I'm here to answer them. Thank you, Aaron.
That was really, really interesting. I have an iPhone. And maybe I should not get a Mac.
I mean, you can. It's just a question of whether you want to enable that feature or not.
Yeah, that's right. So this is the question and answer section.
And do you have questions to Aaron? I can pass you the microphone and...
I can just pass the microphone. Is the camera itself? Yeah.
Is the camera feature itself locked or just the camera app?
So can I open a third-party app and access the camera through it?
I know the feature is, in fact, completely locked.
And it also just shows that notification anywhere, which also was the main reason why I wondered
what happens if I basically access the camera anyways.
And this green thing is basically what you get in every app when you take a photo.
And the preview generally doesn't work.
But if it performs like taking an actual picture, you always just get that green image.
It's the same thing with the camera. The microphone and everything? Yes.
In that case, you basically just get silence.
Maybe I missed the first two minutes of the talk, but on the topic of what is an expected
feature and what isn't, what is the actual purpose?
So what are you supposed to do with that feature and what are you not supposed to do?
That is exactly the question. Like what they show you, what you're supposed to do is that...
They also sync your notifications.
And the idea is that you can click on the iPhone notification and that window pops up
and you can interact with that notification in the native iPhone app.
That is one of the features that they show you.
But what is not supposed to work is something that you just don't define.
And what I tried to find out, but have honestly not really found a final conclusion.
Okay, I think that were all the questions. Really, really, really interesting talk.
I will have to rewatch that when it's published. Thank you all for coming here.