Slashdot Mirror
Apple AirPlay Private Key Exposed
An anonymous reader writes "James Laird has reverse engineered the Airport Express private key and published an open source AirPort Express emulator. 'My girlfriend moved house, and her Airport Express no longer made it with her wireless access point. I figured it'd be easy to find an ApEx emulator — there are several open source apps out there to play to them. However, I was disappointed to find that Apple used a public-key crypto scheme, and there's a private key hiding inside the ApEx. So I took it apart (I still have scars from opening the glued case!), dumped the ROM, and reverse engineered the keys out of it.'"
Or was it taken down by Apple's request?
How long before we see some hacked firmware for normal routers, I wonder?
Apple is going to make life a royal pain in the ass for this guy for releasing this publicly...
-SaNo
If you extract the ROM out of an Apple device, is that a core dump?
Be relentless!
I like how easy he makes it sound :-)
Things you need to hack the Airport Express:
1. Girlfriend
2. A pinch of dissappointment
3. Wilingness to break open glued Apple casing
If only we had more people like this around; people willing and able to void the warranty and hack things. I know there are a few, but every story like this is great. James, good work!
Score one for the good guys. This is just further proof that security through obscurity is a myth. You cannot expect that keeping everything locked inside your proprietary case is going to keep it secure. The best security is sunlight. Let the community poke and prod at your software and/or hardware and it will only improve your offering.
Social Engineering Expert: Because there is no patch for stupidity.
"...her Airport Express no longer made it with her wireless access point..."
I hate it when that happens.
I don't see anywhere where is says it's the AirPlay private key. I thought that was on a per device basis anyway.
I fear this guy will likely get himself a lawsuit or a restraining order for his troubles.
Pretty much any major company is going to react badly to you publishing their private keys for their encryption.
Lost at C:>. Found at C.
This guy should just meekly accept that his girlfriend's expensive gadgets don't work for her anymore. How dare he tinker around and fix things. (At least I think they imported some flavor of the DMCA down under.)
Holy crap, Editors, this copy looks like it rolled straight off of the translation software. I don't feel like I am being a copy nazi when I say an 11th grade journalism teacher would give this teaser an F.
Obviously, the main site is down, but I found this by digging around a bit. http://permalink.gmane.org/gmane.comp.video.videolan.vlc.devel/77383
Does this mean we can finally get an iTunes-alike that can work with iTunes 7+ library sharing?
i know it's more than just a cheap wifi router, but how many people care and are willing to pay the $180 price tag?
he did a post to the vlc-devel list here, http://mailman.videolan.org/pipermail/vlc-devel/2011-April/079616.html It private rsa key is there, might be a good thing to download, if you are worried apple might do something stupid.
The guy sounds pretty casual about the whole thing. I hope he knows that Apple is not going to be happy about this. He should probably start getting rid of his hard drives.
Raters gon' rate.
Managed to nab the download, mirrored it here if anyone does want to try it >> http://www.mediafire.com/?r5pdcxdcbqkrpcb
"My girlfriend moved house, and her Airport Express no longer *made it* with her wireless access point."
Hot stuff!
Can't read the article right now (slashdotted), but I doubt either of them bothered to reset the ApEx properly.
Here's the code you would have find on that page. I saved it earlier, here you go: http://www.multiupload.com/0EUN2QKDMT (Yes, it does include something like a private key. Don't ask me if it's THAT key, I don't know.)
Mod Up. Nice find AC.
You're pro-open source, so that makes you a "good guy"? I like chocolate, you like vanilla, ergo, I am good, you are bad.
Good for you that you believe in open source, but do we have to make it a religion?
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
From the README:
"Thanks also to Apple for obfuscating the private key in the ROM image, using a
scheme that made the deobfuscation code itself stand out like a flare."
Is it actually "reverse engineering" if you scrape the data off the ROM? It sounds like the phrase "reverse engineering" is just being used to avoid a DMCA attack.
My Photography - http://ian-x.com
The Deathlings (comic) - http://thedeathlings.com
Time to get out that old Pocket PC, or Palm devices which have WiFi + audio out in them.
Now what the hell's an AirPlay and what good is it to me?
Oh, it's an Apple-proprietary media streaming protocol? Well, I give an A+ for l33tness, but an F for choosing a useful target.
"When information is power, privacy is freedom" - Jah-Wren Ryel
The airport express is 99 bucks I believe. If my stupid work firewall didn't block the "apple everything" then I could look and see. I know I've seen them for $89 and $79 at times... Throw 3 or 4 around your house, they're awesome just for the airplay aspect, regardless of the other features (router, printer sharing).
Ocean is land, covered with water.
http://mafipulation.org/static/shairport-0.02.tar.gz. c source code and perl script included. Link still working as I post this.
"Actually, I enjoyed this in the same vague, horrible way I enjoyed the A-Team" P. Opus
The AirPort Express cost $99 as do an Apple TV.
- Henrik
- when the Shadows descend -
Burn the apple flag
here is a mirror of the original site : http://www.brouchier.com/shairport-itunes
So, was she impressed?
Oh, wait... It's not a large evil empire like Sony or Microsoft. These are the Good Guys(tm).
Could someone familiar with Apple stuff please explain
what exactly this key is for?
Why would a wifi AP need a secret key?
Once you get the case open, how does one "dump the ROM" of a device?
From: http://www.cocoadev.com/index.pl?AirTunesEncryption
The Apple-Challenge / Apple-Response is iTunes' method to verify that it's talking to an Airport Express; it may be similar to the DAAP one which has been reverse-engineered. These headers are optional when talking to the Airport Express, so it's possible for other programs to talk to the Express but it'll be difficult to get iTunes to talk to something other than the Airport Express.
Until we get the private key out of the AirPortExpress, it's not possible to convince iTunes to send anything to a non-AirPortExpress client (say, another computer pretending to be an AirPortExpress).
Seems that problem has now been solved.
I expect the next version of iTunes come with a new private key which will require a new firmware flash on all Aiport Express. Then James will need to find another girlfriend with an Airport Express, crack that open and dump the key again.
Like IP or not, the Constitution speaks to patent and copyright. I happen to believe that IP laws can, but not always do in practice, increase innovation. As an Apple stockholder, I'd prefer people don't hack their products, and that Steve Jobs decides how Apple software will be designed. You might disagree, and think other people's intellectual property should be "free," but it doesn't make you a good guy, except, apparently here on Mod Abuse Central, where I got modded "flamebait" for daring to not toe the party line. Real flame there!
So no, you're entitled to your views, but imposing them on someone else does not make you good. It makes you kind of officious actually. And people who modded me flamebait for saying it, you are definitely not good.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
If Apple wants to lock things away, how does going public help? Would the public shoot themselves in the foot by improving the protection on Apple's tools? Would the public help perfect DRM to keep the important stuff locked away from themselves? Or would we just take it and do what *we* want with it? Opening everything may be for the ultimate good, but that's not what Apple cares about. So of course they're going to go with obscurity. Which for-profit businesses are altruistic?
Twinstiq, game news
Lawsuit in 3 .... 2 .... 1 ....
Did this guy even read the license the device is sold under?!
Im sure whatever eastern european country with guy is in will be happy to extradite. In 2100.
... as my gateway router / print server / wifi node / backup for all notebooks in the house.
The good news is that it's one device, drawing little power.
The bad news is that it's a single point of failure. After my first one died just outside of warranty, my current one sits on top of a cheap USB-powered notebook cooling fan.
To a Lisp hacker, XML is S-expressions in drag.
OK, so the private key is now exposed, but isn't there much more to getting AirPlay to work than simply having a key? Or, does this just follow the model:
1. Install private key
2. ???
3. Stream music!!!
Personally, I wonder if this was done simply to lock down what devices can be streamed to, or if there are other issues at play here. For instance (think movie rentals), if content providers allow you to rent content and stream it in your house, won't they probably require some sort of encryption such as this to to be used to prevent unauthorized capturing/copying of the stream? Just wondering.
I'm just trying to figure out the real value of this - given the fact that AirPort Expresses can be had rather cheaply.
"My girlfriend ... dumped the ROM, and reverse engineered the keys out of it."
Hmmm, something does not compute here :-)
When you think about it, there's one device that has VERY similar hardware to an airport express... your cell phone. (processor, wifi, audio out). An android app implementing this would breath new life into almost any old cell phone. Now that old G1 you lovingly gave up can take on a new life as your audio interface. Here's to hoping some intelligent developer decides to make this happen. I'd certainly buy it.
I do security
Everyone is looking at the tree, not the forest. While everyone is going to jump on the "Apple did this to make money" argument, you know a major reason for this key was Apple's way of keeping content providers happy. Now that it's broken, there is a new "analog hole" for audio and video content. It is easy to imagine a computer using this to create a digital media file rather than routing to speakers. I suspect it won't be long before content providers pressure Apple into using secondary data to confirm iTunes is talking to a legit device.
I would love to see this adapted for the asterisk MOH
Not analogous. Try again.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
interesting. my private key is exactly the same!
"her Airport Express no longer made it with her wireless access point."
wtf does that even mean?
>> But sometimes you've gotta work with what you get: for example, I own an iPhone,
Oh. That's like trying to prove something exists by assuming it exists. Lame.
Get rid of itoys. You will suddenly feel less urge to 'break' things, because they will just work.
The data stream to my headphones isn't exactly encrypted (last time I checked). Why would decrypting airplay be a bigger hole in a DRM scheme?
That's great. I agree with your assessment as to what the authentication is for.
But this isn't about changing the definition of the problem, it's about solving the problem before you.
How would open source have solved the problem of authenticating this device as being from Apple?
http://lkml.org/lkml/2005/8/20/95
Sure, some knockoff company can use the key to make a knockoff, but that's nothing they aren't (and have been for some time) able to do themselves.
If that isn't enabling piracy, what is?
Storing permanent keys in memory is great for us, and bad for the companies that want to keep things hidden. I'd say "Please, keep doing that!" Well, I mean, both to the type of person who's willing to go through this process and reverse engineer things, and the companies that add lame security to their products. One might ask: "Why add the security in the first place?"
What I'd like to see is a well-defined and documented, open-source released method for "dumping ROMs." I'm sure it's out there on the Internet. While this is a great example of someone taking the time to rip something important (to them) out of a closed-system, it might be nice to actually document how he did it.
Open-source the world! :)
Yeah, really winning over the masses there with your charm and debating skills.
Look, little dweeb in your parents' basement, you're real tough behind your keyboard. I am very impressed. But in the real world, where non-virgins actually roam, and will stuff geeks like yourself in trash cans (or fire your socially inept ass), were you brave enough to run your mouth in person as you did in the post above, Linux is dead. Proprietary software won. Sure, we "fascists" (learn the definition, simpleton - Hitler was a socialist who executed profiteers) will use Apache to save money and sell our proprietary goods (e.g., software) on Websites or to run certain enterprise infrastructure, or to sell crappy cellphones to the cheapos out there who don't buy apps or content anyway, but non-nerds do not want to be troubled with your geeky little open source religion. They don't care about the dogma of geeks. They just want their products to be useful and elegant.
And here's the kicker: Even the dogmatic open sourcers (i.e., losers) are subject to human nature, i.e., greed. Those who buy Android phones are either geeks like you who don't pay for shit because you think it should be "open," or cheapos who don't buy apps or anything else. So any developer who wants to make a buck had better code for iOS, or he'll be telling mom to come down to the basement and bring him some more hot cocoa. but this time with more marshmallows.
So STFU and get in your cubicle and code like a good little monkey, or we'll import an Indian to do it who is smarter and better educated than you and who has an attitude of gratitude and isn't half an Asperger's retard like yourself. You're a walking argument for "closed" software - and insourcing.
Love,
Unass
Does anyone know what was involved in "dumping ROMs"? I would have assumed that the private key was buried in the hardware and not directly accessible via software... From his description it sounds like it was just stored in ROM and software obfuscated. If that was the case it seems odd that it took six years for someone to find it...
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion