Apple AirPlay Private Key Exposed

An anonymous reader writes "James Laird has reverse engineered the Airport Express private key and published an open source AirPort Express emulator. 'My girlfriend moved house, and her Airport Express no longer made it with her wireless access point. I figured it'd be easy to find an ApEx emulator — there are several open source apps out there to play to them. However, I was disappointed to find that Apple used a public-key crypto scheme, and there's a private key hiding inside the ApEx. So I took it apart (I still have scars from opening the glued case!), dumped the ROM, and reverse engineered the keys out of it.'"

Comments

Apple-time

[sanosuke001]

Apple is going to make life a royal pain in the ass for this guy for releasing this publicly...

Re:Apple-time

[jimicus]

Hmm.

Music. Being streamed in realtime from one wireless device to another.

Do you know, I rather suspect the reason for the encryption might be less to do with Apple and more to do with a certain industry we all love to hate. Last two initials of the organisation that represents them are AA.

open-source library sharing incoming?

[gblues]

Does this mean we can finally get an iTunes-alike that can work with iTunes 7+ library sharing?

The best part

[AK76]

From the README:
"Thanks also to Apple for obfuscating the private key in the ROM image, using a
scheme that made the deobfuscation code itself stand out like a flare."

Re:and how many people use Airport?

[characterZer0]

I bought one once. I set up the network for a small organization and every time there was any kind of problem they blamed the WiFi router and called me. I bought a Airport and threw that in there instead. Now they have just as many problems but they assume that the Apple product cannot possibly be the issue, and I have not received a complaint from them since. It has been a almost two years. It was well worth the $180 to me.

What does it do?

[the_other_chewey]

Could someone familiar with Apple stuff please explain
what exactly this key is for?

Why would a wifi AP need a secret key?

Look at the forest, not the trees

[awtbfb]

Everyone is looking at the tree, not the forest. While everyone is going to jump on the "Apple did this to make money" argument, you know a major reason for this key was Apple's way of keeping content providers happy. Now that it's broken, there is a new "analog hole" for audio and video content. It is easy to imagine a computer using this to create a digital media file rather than routing to speakers. I suspect it won't be long before content providers pressure Apple into using secondary data to confirm iTunes is talking to a legit device.

Re:Look at the forest, not the trees

[PhunkySchtuff]

You can't stream video to an AirPort Express, so there's no new analog hole for video content.
Even with protected audio content, you could still burn this to a CD as Red Book CDDA audio, which you could then freely "Rip, Mix, Burn" so it hasn't really enabled anything new for audio either.

What it does allow for is replacing a dead AirPort Express with something more reliable. Those little fuckers (earlier models at least) had a very bad habit of just randomly dying, and usually after a bit more than one year old, conveniently out of warranty. The fault was 200V rated capacitors used in the power supply that were fine in a 110V supply area but eventually died when on 240V...