{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:WZIPFJYYG4XKZEMEOKINO2TGA6","short_pith_number":"pith:WZIPFJYY","canonical_record":{"source":{"id":"2606.26967","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T12:40:13Z","cross_cats_sorted":[],"title_canon_sha256":"8f4426799a206efbdd9c25de3c4f6823fea54bfea43348e37f90e6cf5f00bf8b","abstract_canon_sha256":"528e526cab7ea864c108e8f9f76ecc68136700754ce59875ab14569a2d68a823"},"schema_version":"1.0"},"canonical_sha256":"b650f2a718372eac91847290d76a66079026378320d792040b37082681dd6041","source":{"kind":"arxiv","id":"2606.26967","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.26967","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"arxiv_version","alias_value":"2606.26967v1","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.26967","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_12","alias_value":"WZIPFJYYG4XK","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_16","alias_value":"WZIPFJYYG4XKZEME","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_8","alias_value":"WZIPFJYY","created_at":"2026-06-26T01:16:05Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:WZIPFJYYG4XKZEMEOKINO2TGA6","target":"record","payload":{"canonical_record":{"source":{"id":"2606.26967","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T12:40:13Z","cross_cats_sorted":[],"title_canon_sha256":"8f4426799a206efbdd9c25de3c4f6823fea54bfea43348e37f90e6cf5f00bf8b","abstract_canon_sha256":"528e526cab7ea864c108e8f9f76ecc68136700754ce59875ab14569a2d68a823"},"schema_version":"1.0"},"canonical_sha256":"b650f2a718372eac91847290d76a66079026378320d792040b37082681dd6041","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-26T01:16:05.418656Z","signature_b64":"pAld0TML2oWySLByX116ic50AknFZfZ4niekPF5OuRCgECCvJK3NRPM4iePkJBiFkhI7lcfDEy9VdWn+QEpmAQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b650f2a718372eac91847290d76a66079026378320d792040b37082681dd6041","last_reissued_at":"2026-06-26T01:16:05.418257Z","signature_status":"signed_v1","first_computed_at":"2026-06-26T01:16:05.418257Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.26967","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-26T01:16:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8u5fS4wUxW+qRxm9Z3sV72abL9LbgDVzsbJoc+Y4UG9lViO1NMhIhnjeePTrlmioMLRDDYjcV/RcoHQjTKbCBQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T10:44:23.779498Z"},"content_sha256":"1349d82f1ca3af4ecc616af8bc88990524ad3565d1d43134038e7dce10f080e4","schema_version":"1.0","event_id":"sha256:1349d82f1ca3af4ecc616af8bc88990524ad3565d1d43134038e7dce10f080e4"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:WZIPFJYYG4XKZEMEOKINO2TGA6","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Arash Ale Ebrahim, Nils Ole Tippenhauer","submitted_at":"2026-06-25T12:40:13Z","abstract_excerpt":"Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices, yet their application-layer security properties remain largely unstudied because both stacks are proprietary and undocumented. Both protocols are reachable from wireless proximity without any prior pairing and process complex serialized content (binary plists, CPIO archives, Protocol Buffers, UKEY2 handshakes) inside privileged daemons, making them attractive zero-click targets across multiple operating systems. We perform the first cross-platform reverse engineering and protoc"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.26967","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.26967/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-26T01:16:05Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/v1/ud/73EpzHjHbulowZCKE0I3qk2qWWQb75GuQRZwTcH3KrcfWBDqSDvZknybjVuFwFuq/PnZEbzAgG46XBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-07T10:44:23.779867Z"},"content_sha256":"bfae57bae0235ce6bdc423c5c08b60c6cffdd46ecb2b6cb82aba1a8e22371fb9","schema_version":"1.0","event_id":"sha256:bfae57bae0235ce6bdc423c5c08b60c6cffdd46ecb2b6cb82aba1a8e22371fb9"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/bundle.json","state_url":"https://pith.science/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-07T10:44:23Z","links":{"resolver":"https://pith.science/pith/WZIPFJYYG4XKZEMEOKINO2TGA6","bundle":"https://pith.science/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/bundle.json","state":"https://pith.science/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/state.json","well_known_bundle":"https://pith.science/.well-known/pith/WZIPFJYYG4XKZEMEOKINO2TGA6/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:WZIPFJYYG4XKZEMEOKINO2TGA6","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"528e526cab7ea864c108e8f9f76ecc68136700754ce59875ab14569a2d68a823","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T12:40:13Z","title_canon_sha256":"8f4426799a206efbdd9c25de3c4f6823fea54bfea43348e37f90e6cf5f00bf8b"},"schema_version":"1.0","source":{"id":"2606.26967","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.26967","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"arxiv_version","alias_value":"2606.26967v1","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.26967","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_12","alias_value":"WZIPFJYYG4XK","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_16","alias_value":"WZIPFJYYG4XKZEME","created_at":"2026-06-26T01:16:05Z"},{"alias_kind":"pith_short_8","alias_value":"WZIPFJYY","created_at":"2026-06-26T01:16:05Z"}],"graph_snapshots":[{"event_id":"sha256:bfae57bae0235ce6bdc423c5c08b60c6cffdd46ecb2b6cb82aba1a8e22371fb9","target":"graph","created_at":"2026-06-26T01:16:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.26967/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Apple AirDrop and Google/Samsung Quick Share are proximity file-transfer protocols used by over five billion devices, yet their application-layer security properties remain largely unstudied because both stacks are proprietary and undocumented. Both protocols are reachable from wireless proximity without any prior pairing and process complex serialized content (binary plists, CPIO archives, Protocol Buffers, UKEY2 handshakes) inside privileged daemons, making them attractive zero-click targets across multiple operating systems. We perform the first cross-platform reverse engineering and protoc","authors_text":"Arash Ale Ebrahim, Nils Ole Tippenhauer","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T12:40:13Z","title":"Protocol Prying: Systematic Vulnerability Research in the Apple AirDrop and Android Quick Share Proximity Transfer Protocols"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.26967","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:1349d82f1ca3af4ecc616af8bc88990524ad3565d1d43134038e7dce10f080e4","target":"record","created_at":"2026-06-26T01:16:05Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"528e526cab7ea864c108e8f9f76ecc68136700754ce59875ab14569a2d68a823","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-25T12:40:13Z","title_canon_sha256":"8f4426799a206efbdd9c25de3c4f6823fea54bfea43348e37f90e6cf5f00bf8b"},"schema_version":"1.0","source":{"id":"2606.26967","kind":"arxiv","version":1}},"canonical_sha256":"b650f2a718372eac91847290d76a66079026378320d792040b37082681dd6041","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b650f2a718372eac91847290d76a66079026378320d792040b37082681dd6041","first_computed_at":"2026-06-26T01:16:05.418257Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-26T01:16:05.418257Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"pAld0TML2oWySLByX116ic50AknFZfZ4niekPF5OuRCgECCvJK3NRPM4iePkJBiFkhI7lcfDEy9VdWn+QEpmAQ==","signature_status":"signed_v1","signed_at":"2026-06-26T01:16:05.418656Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.26967","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:1349d82f1ca3af4ecc616af8bc88990524ad3565d1d43134038e7dce10f080e4","sha256:bfae57bae0235ce6bdc423c5c08b60c6cffdd46ecb2b6cb82aba1a8e22371fb9"],"state_sha256":"cef2fbe34036761ca90f589e3ca9610fbdc3aca4d9bc8a0a36d0a9072066f9fd"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Q8Ic7pbDqDhafVsRfYS8hn7XIMpIMGRa9wSLGL47BgAk8HQxPKfFsmKHBYY2wdQ3HaycheyPxtnkI5mNPshrAw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-07T10:44:23.781884Z","bundle_sha256":"68f6c00ece2b213664a0a8b0dad45756848724b42ce608b7ca18f70c9a9a2306"}}