There are always new technologies and strategies emerging in the field of cybersecurity and digital privacy, some of which can be exploited for less-than-savory objectives. In this scenario, we have the Flipper Zero, a seemingly harmless $200 portable pen-testing instrument capable of reading and simulating various radio waves such as RFID, NFC, Bluetooth, and Wi-Fi. Despite its potential for legitimate security testing and experimentation, hostile actors have used it to interrupt and crash devices, particularly iPhones running iOS 17.
Reader’s Walkthrough
What is Flipper Zero?
The Flipper Zero is a compact and versatile gadget that might initially remind you of a Tamagotchi toy from the past. However, its capabilities extend far beyond nostalgia. Priced at $200, this portable pen-testing tool is designed for reading and emulating a wide range of short-range radio frequencies, making it a powerful device for security enthusiasts and professionals. It boasts an open-source design, enabling users to flash custom firmware onto it, thereby unlocking new functionalities and applications.
How Flipper Zero is Being Used to Crash Apple iPhones on iOS 17
The concerning issue with the Flipper Zero arises when individuals with malicious intent utilize custom firmware to turn it into a tool for creating chaos. In one notable scenario, it is being employed to inundate nearby iPhones with a continuous stream of Bluetooth messages. These messages are framed as pairing requests for a Bluetooth accessory. However, the catch is that these non-existent accessories cannot be paired with and should not be connected to, for security reasons. As a result, the persistent appearance of these requests can disrupt the iPhone user’s experience.
But here’s where it gets more concerning: The Flipper Zero custom firmware includes a specific setting labeled “iOS 17 attack.” When this setting is activated, the Bluetooth requests escalate from mere annoyance to a full-blown assault on the iPhone’s stability. In the case of iPhones running iOS 17, the continuous bombardment of Bluetooth requests can lead to the device crashing and subsequently rebooting. This is a notable security concern, as iPhones have traditionally been recognized for their robust security features due to Apple’s “walled garden” approach, which tightly controls and restricts the ecosystem.
It’s crucial to note that this particular attack does not affect older iPhones running older iOS versions. However, as Apple actively rolls out new iOS versions, this issue may become more relevant, especially for users of the latest devices like the iPhone 15 series, which ship with iOS 17.
Protecting Your Device
If you find yourself on the receiving end of such a Bluetooth-based attack, the immediate solution for iOS 17 users is to disable Bluetooth from the device’s settings. It’s essential to note that turning off Bluetooth from the Control Center won’t entirely disable Bluetooth, and you’ll continue to receive unwanted Bluetooth notifications if you toggle the setting through the Control Center. To completely turn off Bluetooth on your iPhone or iPad, follow these steps:
- Open the “Settings” app.
- Scroll down and tap on “Bluetooth.”
- Turn off the Bluetooth toggle switch.
Unfortunately, this solution isn’t without drawbacks, as disabling Bluetooth will also disconnect your device from all connected Bluetooth accessories, including popular devices like AirPods.
Android and Windows users are not immune to these Bluetooth attack barrages either. While it’s unclear whether these attacks can crash Android and Windows devices, there are steps users of these platforms can take to protect themselves from spoofed Bluetooth requests:
How to protect yourself from spoofed Bluetooth requests on Android:
Android users can safeguard against such attacks by turning off the Fast Pair notification. Here’s how:
- Go to your Android phone’s settings.
- Navigate to Google.
- Select Devices and Sharing.
- Choose Nearby Share.
- Turn off the show notification.
Keep in mind that disabling this feature will affect the Fast Pair experience, as genuine Bluetooth accessories won’t automatically appear on your device. You’ll need to pair them manually.
How to protect yourself from spoofed Bluetooth requests on Windows:
Windows users can also protect themselves by turning off Swift Pair requests. Like with Android, disabling this setting will break the fast pairing experience, and you’ll need to pair accessories manually. Here’s how:
- On your Windows 11 PC, go to Settings.
- Select Bluetooth and devices.
- Choose Devices.
- Scroll down and turn off Show notifications to connect using Swift Pair.
The Implications and the Future
Bluetooth spoofing attacks are not new, and they may be carried out with rooted Android phones. The Flipper Zero simplifies the procedure, making it more accessible to people with less technical knowledge. In light of these developments, it is critical for businesses and manufacturers to examine and improve their rapid pairing methods in order to avoid easy exploitation. Until then, taking the steps to disable these potentially disruptive settings is a practical way to minimize unwelcome disturbances, even if it means giving up some convenience. Unfortunately, this may not be a viable solution for iPhone owners, underscoring the continued need for caution in the digital world. Also make sure to check out the guide on How to Protect Your Online Privacy.
English