Handoff All Your Privacy (Again)

Apple's Continuity features, including Handoff, Universal Clipboard, Instant Hotspot and auto unlock, let a user's devices coordinate over Bluetooth and Wi-Fi. The speaker argues that much of the data these features broadcast is unencrypted, so nearby observers can capture it and infer a person's habits and device details. The work builds on earlier research from the FuriousMAC team and on later analysis by other researchers.

The walkthrough shows how to capture Continuity Bluetooth Low Energy advertisements with a sniffer dongle and parse them with a custom Wireshark dissector, then reads a packet byte by byte. Message types determine what each packet carries. A Nearby message can reveal whether AirDrop or Wi-Fi is enabled, whether a phone is locked, and activity such as a call or driving. Handoff packets use nonces that were sequential, which could link two devices in an ongoing exchange. AirPods proximity packets were shown to expose battery levels, a lid-open counter that increments, case colour and whether each earbud is in the ear.

The speaker described Apple fixing an issue where authentication tags did not rotate with advertising addresses, which had allowed tracking across rotations. She also noted that offline Find My messages appear only when at least two Apple devices share an account. The takeaway for practitioners is that Bluetooth devices should rotate addresses and avoid static counters, and that Continuity traffic reveals more about users than people expect.