Security

Researcher says they were behind iPhone pop-ups at Def Con

Comment

A large screen at the 2023 Def Con hacking conference in Las Vegas.
Image Credits: Lorenzo Franceschi-Bicchierai / TechCrunch

Several attendees at the hacking conference Def Con reported seeing mysterious and persistent pop-ups prompting them to use their Apple ID to connect to an Apple TV, or to share a password with an Apple TV nearby, according to attendee tweets over the weekend and people who spoke to TechCrunch.

These incidents confused and dumbfounded some of the attendees, who weren’t sure how these alerts — for lack of a better word — were carried out, or what the goal was. Hacker shenanigans during Def Con are a decades-long tradition, and are more often pranks than actual malicious attacks.

In this case, it may have just been a research project.

On Saturday, a security researcher who goes by Jae Bochs said on Mastodon that it was them who was behind these activities.

“I’ll come clean: it me,” Bochs wrote.

Bochs said the alerts they sent out were built with two purposes: to remind people to “really shut off Bluetooth,” and not just from the Control Center, and “to have a laugh.”

Bochs said that this experiment wasn’t designed to collect any data, but rather to send Bluetooth “advertisement packets that don’t require pairing (and as such aren’t stopped by the control center toggle).”

It’s unclear, however, if they — or someone else researching this feature — could have actually collected data and done something more malicious.

The researcher said that to stop these pop-ups someone needs to turn off Bluetooth via the Settings app, not from the Control Center, which users can invoke by swiping down from the top right corner of the iPhone.

TechCrunch spoke to eight attendees who said they saw one or both of the prompts while at the conference. Some of them saw the pop-ups several times over the weekend, and at different places around the conference floor.

Opinions on the merits of this research project, which was not publicized in advance, varied.

“I think it’s hilarious. It was annoying as hell but also reminded me that control center is bad 😂,” said NinjaLikesCheez, an iOS application security researcher who saw the pop-ups.

Dan Guido, the CEO of security research firm Trail of Bits, wasn’t amused.

“I think he abused a bunch of users when he should take his complaints to Apple,” Guido told TechCrunch.

In response to someone who praised the experiment as “some OG #DEFCON shenanigans,” Bochs wrote that was the “vibe” they were hoping for.

“Glad I could add a little harmless WTF to everyone’s day,” they wrote on Mastodon.

The common denominator, at least for the people who spoke to TechCrunch, is that none of them had turned on Lockdown Mode, a special iPhone feature that limits some functionalities with the goal of reducing the risk of getting hacked. This reporter was using Lockdown Mode and never saw either of these prompts.

Bochs said they were hoping to submit a talk based on this experiment, and to “have it working” with the upcoming iOS 17 feature called “NameDrop.” This new feature will allow iPhone owners to share their contact with someone else with an iPhone or Apple Watch by simply bringing the phones close to each other.

Apple did not respond to a request for comment.

When asked whether the conference organizers had seen these pop-ups themselves or whether they had been reported to them by attendees, Def Con spokesperson Melanie Ensign simply sent a link to Bochs’ Mastodon post.


Do you have information about these alerts and how this iPhone feature works and whether it can be abused for a malicious attack? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop.

More TechCrunch

Google says it’s developed a new family of generative AI models “fine-tuned” for learning: LearnLM. A collaboration between Google’s DeepMind AI research division and Google Research, LearnLM models — built…

LearnLM is Google’s new family of AI models for education

The official launch comes almost a year after YouTube began experimenting with AI-generated quizzes on its mobile app. 

Google is bringing AI-generated quizzes to academic videos on YouTube

Around 550 employees across autonomous vehicle company Motional have been laid off, according to information taken from WARN notice filings and sources at the company.  Earlier this week, TechCrunch reported…

Motional cut about 550 employees, around 40%, in recent restructuring, sources say

The keynote kicks off at 10 a.m. PT on Tuesday and will offer glimpses into the latest versions of Android, Wear OS and Android TV.

Google I/O 2024: Watch all of the AI, Android reveals

It ran 110 minutes, but Google managed to reference AI a whopping 121 times during Google I/O 2024 (by its own count). CEO Sundar Pichai referenced the figure to wrap…

Google mentioned ‘AI’ 120+ times during its I/O keynote

Here are quick hits of the biggest news from the keynote as they are announced.

Google I/O 2024: Here’s everything Google just announced

Google Play has a new discovery feature for apps, new ways to acquire users, updates to Play Points, and other enhancements to developer-facing tools.

Google Play preps a new full-screen app discovery feature and adds more developer tools

Soon, Android users will be able to drag and drop AI-generated images directly into their Gmail, Google Messages and other apps.

Gemini on Android becomes more capable and works with Gmail, Messages, YouTube and more

Veo can capture different visual and cinematic styles, including shots of landscapes and timelapses, and make edits and adjustments to already-generated footage.

Google gets serious about AI-generated video at Google I/O 2024

In addition to the body of the emails themselves, the feature will also be able to analyze attachments, like PDFs.

Gemini comes to Gmail to summarize, draft emails, and more

The summaries are created based on Gemini’s analysis of insights from Google Maps’ community of more than 300 million contributors.

Google is bringing Gemini capabilities to Google Maps Platform

Google says that over 100,000 developers already tried the service.

Project IDX, Google’s next-gen IDE, is now in open beta

The system effectively listens for “conversation patterns commonly associated with scams” in-real time. 

Google will use Gemini to detect scams during calls

The standard Gemma models were only available in 2 billion and 7 billion parameter versions, making this quite a step up.

Google announces Gemma 2, a 27B-parameter version of its open model, launching in June

This is a great example of a company using generative AI to open its software to more users.

Google TalkBack will use Gemini to describe images for blind people

Firebase Genkit is an open source framework that enables developers to quickly build AI into new and existing applications.

Google launches Firebase Genkit, a new open source framework for building AI-powered apps

This will enable developers to use the on-device model to power their own AI features.

Google is building its Gemini Nano AI model into Chrome on the desktop

Google’s Circle to Search feature will now be able to solve more complex problems across psychics and math word problems. 

Circle to Search is now a better homework helper

People can now search using a video they upload combined with a text query to get an AI overview of the answers they need.

Google experiments with using video to search, thanks to Gemini AI

A search results page based on generative AI as its ranking mechanism will have wide-reaching consequences for online publishers.

Google will soon start using GenAI to organize some search results pages

Google has built a custom Gemini model for search to combine real-time information, Google’s ranking, long context and multimodal features.

Google is adding more AI to its search results

At its Google I/O developer conference, Google on Tuesday announced the next generation of its Tensor Processing Units (TPU) AI chips.

Google’s next-gen TPUs promise a 4.7x performance boost

Google is upgrading Gemini, its AI-powered chatbot, with features aimed at making the experience more ambient and contextually useful.

Google reveals plans for upgrading AI in the real world through Gemini Live at Google I/O 2024

Veo can generate few-seconds-long 1080p video clips given a text prompt.

Google’s image-generating AI gets an upgrade

At Google I/O, Google announced upgrades to Gemini 1.5 Pro, including a bigger context window. .

Google’s generative AI can now analyze hours of video

The AI upgrade will make finding the right content more intuitive and less of a manual search process.

Google Photos introduces an AI search feature, Ask Photos

Apple released new data about anti-fraud measures related to its operation of the iOS App Store on Tuesday morning, trumpeting a claim that it stopped over $7 billion in “potentially…

Apple touts stopping $1.8B in App Store fraud last year in latest pitch to developers

Online travel agency Expedia is testing an AI assistant that bolsters features like search, itinerary building, trip planning, and real-time travel updates.

Expedia starts testing AI-powered features for search and travel planning

Welcome to TechCrunch Fintech! This week, we look at the drama around TabaPay deciding to not buy Synapse’s assets, as well as stocks dropping for a couple of fintechs, Monzo raising…

Inside TabaPay’s drama-filled decision to abandon its plans to buy Synapse’s assets

The person who claimed to have stolen the physical addresses of 49 million Dell customers appears to have taken more data from a different Dell portal, TechCrunch has learned. The…

Threat actor scraped Dell support tickets, including customer phone numbers