{"id":"bd62d208-4ac7-4e64-bd57-19d04df625a4","arxiv_id":"2606.26967","paper_version":1,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":9.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"First cross-platform reverse engineering and protocol-aware fuzzing of Apple AirDrop and Google/Samsung Quick Share reveals six vulnerabilities including pre-auth DoS, recursion issues, encryption bypass, and a heap use-after-free.","lead":"Researchers reverse engineered the undocumented AirDrop and Quick Share proximity file transfer protocols and found six vulnerabilities through fuzzing and targeted analysis. The work matters because these protocols run on billions of devices without pairing and handle complex data in privileged system components.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"The reader's weakest assumption is the accuracy of the reverse-engineered models. However, the explicit vendor acknowledgments and bounty constitute independent evidence that the issues are real and reachable, removing the load-bearing risk. No internal inconsistency or unsupported leap is apparent from the abstract and claim structure.","tokens_in":1854,"tokens_out":202,"duration_ms":23814,"concrete_test":"Cross-reference the paper's vulnerability descriptions against any public CVE assignments or vendor security bulletins released after disclosure; confirm that each matches the reported root cause and affected component.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Vendor acknowledgments for V1-V6 (including Google's bounty for the V6 use-after-free) provide external confirmation that the reported crashes and bypasses exist in production code. This directly validates that the reconstructed seven-layer state machine, DVZip handling, and frame types are sufficiently accurate for the claimed reachability.","agreement_with_reader":"disagree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript reports the first systematic reverse-engineering and protocol-aware fuzzing study of the proprietary Apple AirDrop and Google/Samsung Quick Share proximity file-transfer protocols. It reconstructs AirDrop's seven-layer state machine and DVZip adaptive compression, introduces the AIRFUZZ fuzzer that mutates pre-compression representations, performs targeted analysis of Samsung and Google Quick Share implementations, and identifies six vulnerabilities (V1-V6): three pre-authentication issues in macOS/iOS AirDrop (Swift fatalError DoS, unbounded XML plist recursion, NULL dereference in HTTP/1.1 parser), two protocol-layer flaws in Samsung Quick Share (pre-auth OfflineFrame dispatch, D2D encryption bypass), and a heap use-after-free in Google Quick Share for Windows.","tokens_in":1912,"tokens_out":386,"duration_ms":21029,"significance":"If the reported crashes and bypasses hold, the work is significant for the security of proximity protocols deployed on billions of devices. The empirical nature of the findings, combined with responsible disclosure, vendor acknowledgments from Apple, Samsung, and Google, and a bounty for V6, provides external validation that the reconstructed state machine and frame handling accurately reflect production behavior.","major_comments":[],"minor_comments":[{"comment":"§3.2: The AIRFUZZ mutation operators are described at a high level; adding one or two concrete examples of how a pre-compression plist or CPIO archive is mutated would improve reproducibility for readers attempting to extend the fuzzer.","section":"§3.2"},{"comment":"Figure 2: The seven-layer state machine diagram would benefit from explicit labels on transitions that correspond to the frame types used in the V4 and V5 attacks.","section":"Figure 2"}],"recommendation":"accept","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for their positive evaluation of the manuscript, accurate summary of the contributions, and recommendation to accept. The work's significance is reinforced by the external validation through responsible disclosure and vendor acknowledgments.","responses":[],"tokens_in":1355,"tokens_out":60,"duration_ms":13686,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"This paper reverse engineers the AirDrop and Quick Share proximity protocols and finds six vulnerabilities that vendors have acknowledged. The core contribution is the reconstruction of AirDrop's seven-layer state machine from binaries, plus the AIRFUZZ fuzzer that mutates pre-compression representations. They also do targeted analysis on Samsung Quick Share frames and a use-after-free in Google's Windows client.\n\nThe work is new because no prior public study has mapped these stacks or applied protocol-aware fuzzing to them. The pre-auth DoS issues in AirDrop, the encryption bypasses in Samsung, and the bounty-winning heap bug in Google Quick Share are concrete outputs. Vendor acknowledgments and the bounty give external confirmation that the crashes and bypasses are reachable in production code.\n\nThe methods are appropriate for undocumented protocols: binary analysis, custom fuzzing, and hand-written checks. The DVZip handling and frame dispatch details line up with the reported issues.\n\nOne soft spot is that the state machine reconstruction is tied to the versions they tested, so some edge cases might differ on newer builds. That said, the vendor responses reduce the practical impact of this limitation. No load-bearing assumptions appear to be unfalsifiable.\n\nThis paper is for security researchers working on mobile proximity protocols or zero-click surfaces. A reader doing similar reverse engineering or fuzzing would get usable methods and examples from it.\n\nIt deserves peer review. The empirical results and external validation are strong enough to justify referee time.","headline":"This paper is the first to reverse-engineer AirDrop and Quick Share at the protocol level, with vendor-confirmed bugs from the analysis.","tokens_in":2370,"tokens_out":371,"would_cite":true,"duration_ms":18831,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Reverse engineering uncovers six pre-authentication vulnerabilities in AirDrop and Quick Share protocols used on billions of devices.","keywords":["AirDrop","Quick Share","proximity protocols","reverse engineering","protocol fuzzing","pre-authentication vulnerabilities","zero-click attacks","binary analysis"],"falsifier":"Sending the exact mutated packets or frames described to current production devices and observing neither crashes nor successful bypasses would show the reported issues are not reachable.","tokens_in":2759,"feed_emoji":"🔓","tokens_out":710,"duration_ms":47165,"temperature":0.7,"pith_summary":"The paper sets out to show that two widely deployed but proprietary proximity file-transfer protocols can be systematically analyzed despite being closed and undocumented. By reconstructing AirDrop's internal seven-layer state machine and DVZip compression, then applying a custom fuzzer plus targeted analysis, the authors locate three issues in Apple's macOS and iOS implementations, two protocol flaws in Samsung Quick Share, and one heap bug in Google's Windows client. A reader would care because these protocols accept complex serialized data over wireless links with no prior pairing and run inside privileged processes, creating zero-click surfaces. The work therefore supplies concrete evidence that such stacks merit dedicated security scrutiny even when source code is unavailable.","feed_headline":"Reverse engineering finds six flaws in AirDrop and Quick Share","feed_subtitle":"Protocols on over five billion devices accept complex untrusted data without pairing, exposing reachable denial-of-service and bypass paths.","key_machinery":"AIRFUZZ, a protocol-aware fuzzer that mutates pre-compression representations of the reconstructed seven-layer AirDrop state machine.","core_discovery":"We reconstruct AirDrop's seven-layer state machine and DVZip adaptive compression from binary analysis, build AIRFUZZ to mutate pre-compression representations, and through this method plus hand-written protocol analysis identify six vulnerabilities: a Swift fatalError in the HTTP path router, unbounded XML plist recursion, a NULL dereference in the HTTP/1.1 parser, pre-authentication OfflineFrame dispatch and D2D encryption bypass in Samsung Quick Share, and a heap use-after-free in Google Quick Share for Windows.","pith_inferences":["The same reverse-engineering-plus-fuzzing approach could be applied to other undocumented proximity or device-to-device protocols.","Vendors of closed proximity stacks may need to expose more internal interfaces or test harnesses to enable independent security review.","Zero-click attack surfaces in wireless file transfer deserve routine, protocol-aware testing rather than only generic network fuzzing.","The existence of adaptive compression layers like DVZip adds complexity that can hide parsing bugs until the representation is mutated before compression."],"forward_implications":["Three distinct pre-authentication paths in AirDrop can be triggered to cause denial of service on macOS and iOS.","Samsung Quick Share accepts and dispatches certain frames before authentication and permits encryption bypass on three frame types.","Google Quick Share for Windows contains a reachable heap use-after-free.","All six issues were reported to the respective vendors and acknowledged.","The protocols process untrusted serialized content inside privileged daemons without requiring prior pairing."],"fun_headline_variants":["Six flaws identified in AirDrop and Quick Share","Protocol analysis reveals AirDrop Quick Share vulnerabilities","Reverse engineering uncovers six flaws in proximity protocols","AirDrop and Quick Share protocols contain six vulnerabilities"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The reconstructed seven-layer state machine, DVZip compression, and identified frame types accurately match the production implementations on current devices.","fun_headline_variants_meta":{"raw":{"variants":["Six flaws identified in AirDrop and Quick Share","Protocol analysis reveals AirDrop Quick Share vulnerabilities","Reverse engineering uncovers six flaws in proximity protocols","AirDrop and Quick Share protocols contain six vulnerabilities"]},"model":"grok-4.3","cost_usd":0.007845,"raw_usage":{"total_tokens":3625,"prompt_tokens":759,"num_sources_used":0,"completion_tokens":55,"cost_in_usd_ticks":78449500,"prompt_tokens_details":{"text_tokens":759,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2811,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":759,"tokens_out":55,"duration_ms":41184,"temperature":1.0,"reasoning_tokens":2811,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-26T04:08:21.210737+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Sending the exact mutated packets or frames described to current production devices and observing neither crashes nor successful bypasses would show the reported issues are not reachable.","supporting_citations":[],"review_version":1}