A security researcher known as Anthony has demonstrated a concerning attack using a Flipper Zero, a versatile hacking device. With this tool, hackers can inundate iPhones with irritating pop-up messages that prompt users to connect to nearby Apple devices, including AirTags, Apple TV, and AirPods.
This attack, dubbed a “Bluetooth advertising assault” by Anthony, essentially acts as a denial-of-service attack. By continuously generating pop-up messages, an attacker can render an iPhone nearly unusable, disrupting the seamless experience Apple users are accustomed to.
Anthony modified the Flipper Zero firmware to broadcast Bluetooth Advertisements, which are a type of transmission used in the Bluetooth Low Energy protocol by Apple. These advertisements allow iDevice owners to connect to other Apple devices and use features like AirDrop.
Example of 'DDOS: pic.twitter.com/5FGhK7QYoG
— Techryptic, Ph.D. (@tech) September 4, 2023
A well-reputed source tested the exploit by compiling proof-of-concept code from Anthony’s blog into a firmware file for the Flipper Zero. Once loaded onto the device, it began broadcasting pop-up signals to nearby iPhones when Bluetooth was enabled. They successfully imitated an AirTag and initiated a phone number transfer dialogue on iPhones.
Researchers have been highlighting potential Bluetooth abuse by malicious hackers lately. In August, at the Def Con hacking conference, another researcher used a Raspberry Pi Zero 2 W and Bluetooth adapter to create alerts on iPhones, mimicking an Apple TV.
Anthony revealed that his attack could work over long distances using an “amplified board,” but he chose not to disclose further details due to concerns about widespread abuse. He suggested that Apple could mitigate such attacks by verifying the legitimacy of Bluetooth devices connecting to iPhones and reducing the range for Bluetooth connections between iDevices and other devices.
Apple has not yet responded to any of this information yet.