Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols

• URL: http://arxiv.org/abs/2606.26967v1
• Date: Thu, 25 Jun 2026 12:40:13 GMT
• Title: Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols
• Abstract summary: Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices.<n>We perform the first cross-platform reverse engineering and protocol-aware fuzzing study of both stacks.
• Score: 6.758813789342145
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices, yet their application-layer security properties remain largely unstudied because both stacks are proprietary and undocumented. Both protocols are reachable from wireless proximity without any prior pairing and process complex serialized content (binary plists, CPIO archives, Protocol Buffers, UKEY2 handshakes) inside privileged daemons, making them attractive zero-click targets across multiple operating systems. We perform the first cross-platform reverse engineering and protocol-aware fuzzing study of both stacks. We reconstruct AirDrop's seven-layer state machine and DVZip adaptive compression from binary analysis, build AIRFUZZ, a protocol-aware fuzzer that mutates pre-compression representations, and complement it with targeted hand-written analyses of Samsung's Quick Share service and Google's Quick Share for Windows. We discover six vulnerabilities (V1-V6): three pre-authentication issues in macOS/iOS AirDrop (V1: Swift fatalError DoS in the HTTP path router; V2: unbounded XML plist recursion in Foundation; V3: NULL dereference in Network.framework's HTTP/1.1 parser), two protocol-layer flaws in Samsung Quick Share (V4: pre-authentication OfflineFrame dispatch; V5: D2D encryption bypass for three frame types), and a heap use-after-free in Google Quick Share for Windows (V6) for which Google awarded a bounty. We responsibly disclosed all findings, and Apple, Samsung, and Google have acknowledged the reports.

Related papers

• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies [20.918689443204286]
  COHORT is the first end-to-end framework to automate the procedure for deployable mitigations.<n>A role-decomposed multi-agent LLM workflow proposes candidates, implements them as real device commands, and refines them through a critique loop.<n>Each candidate is evaluated by offensive replay: re-executing the original adversary on the mitigated network for a paired comparison against the unmitigated baseline.<n>Two further checks complement replay: a connectivity-regression check (LAN ping and internet HTTP probe) rejects mitigations that disrupt legitimate LAN or internet connectivity.
  arXiv  Detail & Related papers  (2026-06-29T15:39:05Z)
• PriSrv+: Privacy and Usability-Enhanced Wireless Service Discovery with Fast and Expressive Matchmaking Encryption [42.621633702087074]
  PriSrv+ is an advanced privacy and usability-enhanced service discovery protocol for modern wireless networks.<n>Key innovation in PriSrv+ is the development of Fast and Expressive Matchmaking Encryption (FEME)<n>PriSrv+ achieves superior performance, scalability, and efficiency compared to existing state-of-the-art protocols.
  arXiv  Detail & Related papers  (2026-06-04T09:07:19Z)
• PriSrv: Privacy-Enhanced and Highly Usable Service Discovery in Wireless Communications [43.30406587083713]
  Existing protocols provide limited privacy protection, leaking sensitive device information and opening routes to network attacks.<n>This paper proposes a private service discovery protocol, called PriSrv, which enables both service providers and clients to specify fine-grained authentication policies.
  arXiv  Detail & Related papers  (2026-06-04T08:00:31Z)
• Octopus Protocol: One-Shot Hardware Discovery and Control for AI Agents via Infrastructure-as-Prompts [0.0]
  We present Octopus Protocol, a system that collapses that cost to a single shell command.<n>Two architectural principles make this work: protocols are prompts, not code, and the coding agent is the runtime.<n>One command onboards the hardware in 10-15 minutes and exposes up to 30 MCP tools; an MCP-compliant client then performs closed-loop visual-motor control through tools no human wrote.
  arXiv  Detail & Related papers  (2026-05-09T16:57:11Z)
• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain [6.142057368768942]
  Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests.<n>We present the first systematic study of this attack surface.
  arXiv  Detail & Related papers  (2026-04-09T16:06:41Z)
• RedVisor: Reasoning-Aware Prompt Injection Defense via Zero-Copy KV Cache Reuse [47.85771791033142]
  We propose RedVisor, a framework that synthesizes the explainability of detection systems with the seamless integration of prevention strategies.<n>RedVisor is the first approach to leverage fine-grained reasoning paths to simultaneously detect attacks and guide the model's safe response.<n> Experiments demonstrate that RedVisor outperforms state-of-the-art defenses in detection accuracy and throughput while incurring negligible utility loss.
  arXiv  Detail & Related papers  (2026-02-02T08:26:51Z)
• Automated Side-Channel Analysis of Cryptographic Protocol Implementations [9.38081874899831]
  We extract the first formal model of WhatsApp from its implementation.<n>We identify a known clone-attack against post-compromise security.<n>We introduce a methodology to analyze cryptographic protocol implementations for their resilience to side-channel attacks.
  arXiv  Detail & Related papers  (2025-11-14T15:13:49Z)
• Active Attack Resilience in 5G: A New Take on Authentication and Key Agreement [13.49434164633215]
  5G-AKA protocol is central to authentication in current 5G deployments.<n>5G-AKA has known limitations in both security and performance.<n>This paper proposes an enhanced authentication protocol that builds on 5G-AKA's design while addressing its shortcomings.
  arXiv  Detail & Related papers  (2025-07-23T13:18:44Z)
• Quantum Private Information Retrieval for Quantum Messages [71.78056556634196]
  Quantum private information retrieval (QPIR) for quantum messages is the protocol in which a user retrieves one of the multiple quantum states from one or multiple servers without revealing which state is retrieved. We consider QPIR in two different settings: the blind setting, in which the servers contain one copy of the message states, and the visible setting, in which the servers contain the description of the message states.
  arXiv  Detail & Related papers  (2021-01-22T10:28:32Z)
• FCOS: A simple and strong anchor-free object detector [111.87691210818194]
  We propose a fully convolutional one-stage object detector (FCOS) to solve object detection in a per-pixel prediction fashion. Almost all state-of-the-art object detectors such as RetinaNet, SSD, YOLOv3, and Faster R-CNN rely on pre-defined anchor boxes. In contrast, our proposed detector FCOS is anchor box free, as well as proposal free.
  arXiv  Detail & Related papers  (2020-06-14T01:03:39Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.