These scripts are an experimental PoC that uses Bluetooth Low Energy (BLE) to send proximity pairing messages to Apple devices.
This project is created for educational purposes and cannot be used for law violation or personal gain. The author of this project is not responsible for any possible harm caused by the materials of this project.
After Techryptic's attempt to steal the work of myself and WillyJL, Willy has taken the time to give an insanely in-depth timeline of the events and proof of the work being stolen (Git and my typos dont lie!) Check out the full report below and please help us spread the word that the person who has been all over the news outlets claiming this as their work, stole the code and gave none of the actual developers credit.
Thanks to the amazing work of Willy-JL this has been added to the Flipper Zero Xtreme Firmware. It's currently in dev and will be officially released in the next update.
To install it now, follow the guide below from the Xtreme Firmware page to clone and compile the current dev build that contains the Apple BLE Spam app.
โ ๏ธ Warning!
We will not give basic support for compiling in our server. This is intended for people that already know what they are doing!
To download the needed tools:
$ git clone --recursive --jobs 8 https://github.com/Flipper-XFW/Xtreme-Firmware.git
$ cd Xtreme-Firmware/
To flash directly to the Flipper (Needs to be connected via USB, qFlipper closed)
$ ./fbt flash_usb_full
To compile a TGZ package
$ ./fbt updater_package
To build and launch a single app:
$ ./fbt launch APPSRC=some_appid
Thanks to ronaldstoner for porting this over to the ESP-32
Check out this in-depth walk though by Mobile Hacker about running AppleJuice on a rooted Android phone.
This was created in response to the various AppleTV spoof messages being sent out during DEF CON 31. After experiencing it first hand, I had to figure out what was happening. The existing research projects I could find (see credits) had great info but were both a couple years out of date with broken package dependencies, so I decided to take what I could from them and start building from there.
To run these scripts you need a Linux machine with an internal Bluetooth card or a USB Bluetooth adapter.
All original testing was done on a Lenovo T480 with a built-in Bluetooth adapter.
Later tested on Raspberry Pi 3B+ and Raspberry Pi Zero W running Kali Linux with a Zexmte Long Range USB Bluetooth 5.1 Adapter with Dual Antenna.
Range
Range of messages by device type
Device | Range |
---|---|
Lenovo | Couple feet from machine |
Raspberry Pi and long range adapter | 20+ feet indoors in heavy BLE traffic |
Please follow in this exact order or you might run into issues with bluetooth dependencies.
git clone https://github.com/ECTO-1A/AppleJuice.git && cd ./AppleJuice
sudo apt update && sudo apt install -y bluez libpcap-dev libev-dev libnl-3-dev libnl-genl-3-dev libnl-route-3-dev cmake libbluetooth-dev
โ ๏ธ Warning
Thepybluez
library is broken on GitHub and needs to be installed manually
Download the latest version
pip install git+https://github.com/pybluez/pybluez.git#egg=pybluez
pycrypto is not maintained, be sure to install pycryptodome instead
pip install pycryptodome
sudo pip install -r requirements.txt
To be able to run without sudo, you need to set the capabilities of the python binary to allow it to access raw sockets. This is done with the following command
sudo setcap cap_net_raw,cap_net_admin+eip $(eval readlink -f $(which python))
Several users have reported the need for a reboot after installing the bluetooth packages in order for everything to work properly.
Run hcitool dev
to get a list of connected adapters
hcitool dev
Devices:
hci0 00:00:7C:00:3A:13
๐ Note
If the adapter is showing ashci1
you will need to edit thedev_id
variable in the scripts to match
All messages have been combined into a single app. You can now run app.py
to get a list of available options.
To run the script use -d (number of message)
Example
app.py -d 13
python3 app.py
Please select a message option using -d.
Available message options:
1: Airpods
2: Airpods Pro
3: Airpods Max
4: Airpods Gen 2
5: Airpods Gen 3
6: Airpods Pro Gen 2
7: PowerBeats
8: PowerBeats Pro
9: Beats Solo Pro
10: Beats Studio Buds
11: Beats Flex
12: BeatsX
13: Beats Solo3
14: Beats Studio3
15: Beats Studio Pro
16: Beats Fit Pro
17: Beats Studio Buds+
18: AppleTV Setup
19: AppleTV Pair
20: AppleTV New User
21: AppleTV AppleID Setup
22: AppleTV Wireless Audio Sync
23: AppleTV Homekit Setup
24: AppleTV Keyboard
25: AppleTV 'Connecting to Network'
26: Homepod Setup
27: Setup New Phone
28: Transfer Number to New Phone
29: TV Color Balance
beatssolopro.py
Model: Beats Solo Pro
airpods_max.py
Model: Airpods Max
- FuriousMAC and Hexway for all the prior research on Apple BLE, Continuity, and building the Wireshark disector.
- Jae Bochs for exposing this to me at DEF CON 31 which made me jump into learning about BLE.
- Guillaume Celosia and Mathieu Cunche for reverse engineering Proximity Pairing