Wormable Zero-Click RCE in AirPlay Impacts Billions of Apple and IoT Devices

## Overview

At this conference talk, Gal Elbaz (co-founder and CEO of Algo Security), Avi Lumelsky, and Uri Katz presented "AirBorne," a research campaign detailing the first-ever wormable zero-click Remote Code Execution (RCE) on macOS via Apple's AirPlay protocol. Across their research, the team discovered 23 total vulnerabilities (with 17 assigned CVEs) impacting billions of devices worldwide, including macOS systems and third-party IoT/embedded hardware utilizing the AirPlay SDK.

The discovery originated from prior research presented at DEF CON 32 ("0.0.0.0 Day"), which showed browsers communicating with local services over port `7000`. Port scanning revealed that every macOS device had port `7000` open by default to support AirPlay, prompting the researchers to investigate the proprietary, closed-source protocol.

---

## AirPlay Protocol & Attack Surface

AirPlay—originally released as "AirTunes" for audio streaming and later expanded to media and screen sharing (AirPlay 2)—depends on seamless device connectivity: - **Discovery via mDNS**: Devices announce their presence and open ports automatically using Multicast DNS (mDNS) over port `5353`. This allows an attacker on the same local network to sniff device names and ports without performing active port scans. - **Protocol Structure**: AirPlay operates over port `7000` using HTTP and RTSP methods (e.g., `GET`, `POST`, `SETUP`, `TEARDOWN`). Payloads are structured as property lists (PLists) in XML or binary serialization. - **Session Decoupling Flaws**: Although macOS provides three configuration levels (with "Current User" being the strictest, supposedly restricting connections to matching Apple IDs), the team discovered that many commands completely bypass authentication and session validation routines.

---

## Initial Fuzzing & Reverse Engineering Findings

Using a simple Python-based fuzzer featuring five nested loops, the researchers uncovered critical security flaws in minutes: 1. **Unauthenticated Action Execution**: Attackers could play full-screen video on target macOS systems configured to "Current User" mode without credentials or existing sessions. 2. **PII and System Reconnaissance (`syslog` leak)**: Sending a simple `GET /log` request leaked the complete system log (`syslog`) of any macOS device on the network, exposing hostnames, usernames, boot times, and active process lists. 3. **Control Center Denial of Service**: A single unauthenticated HTTP command (`FP setup`) crashed the macOS `ControlCenter` process due to an unhandled memory corruption issue.

By reverse-engineering binaries extracted from the macOS `dyld` shared cache, the team uncovered multiple vulnerability classes in the AirPlay HTTP handler: - **Type Confusion**: User-controlled PLists parsed into dictionary getters (`CFDictionaryGetValue`) could be fed incompatible types (such as strings or integers), leading to crashes or exploitable memory conditions. - **Null Pointer Dereferences**: Handlers executing session-level functions (such as adjusting media audio playback rates) assumed an initialized session existed, triggering null dereferences and process terminations when invoked directly.

The team submitted 16 bugs in rapid succession, temporarily triggering rate limits on Apple's vulnerability reporting portal.

---

## IoT & Embedded AirPlay SDK Exploitation

Beyond native Apple systems, AirPlay functionality is licensed to third-party manufacturers via an SDK: - **Stack Buffer Overflow**: Two of the 23 reported vulnerabilities resided directly in the AirPlay SDK, including a classic stack buffer overflow. - **Firmware Emulation**: Before purchasing physical hardware, the researchers simulated device firmware environments to validate exploitability. - **Root Compromise on IoT Devices**: - **Smart Speakers (Bose)**: The team achieved root privileges and established a reverse shell on a Bose Wi-Fi speaker. Because the speaker listens on the local network by default and includes an integrated microphone, the exploit demonstrated risks of persistent network access and eavesdropping. - **Automotive Infotainment (Pioneer)**: Rather than purchasing a full vehicle, the team acquired and booted an aftermarket Pioneer multimedia head unit running CarPlay/AirPlay in their lab to replicate embedded exploitation in automotive systems.