Attendees at the hacking conference DefCon in Las Vegas last weekend kept getting mysterious prompts on their iPhones as requests to connect to a phantom Apple TV that was nowhere in sight.

Turns out the messages — which looked like a nearby Apple TV seeking approval to sync with users’ Apple ID or their password-protected accounts — were, in reality, from a homemade $70 transmitter designed to trick Apple’s Bluetooth security.

Some of the software security experts who were targeted by the prank at the conference, said they felt ‘abused,’ while others thought it was ‘hilarious’ but ‘annoying as hell.’ 

The perpetrator, a fellow DefCon attendee, has come forward to explain their intention: to draw attention to a serious vulnerability they hope Apple will correct.

‘If a user were to interact with the prompts, and if the other end was set up to respond convincingly, I think you could get the “victim” to transfer a password,’ said the prankster, a security researcher who goes by Jae Bochs on social media.

Until Apple corrects the vulnerability, according to Bochs, the best course of action for iPhone users, or any Apple product user, is to be careful when trusting the ‘Control Center’ feature on any device running iOS.

For their part, Bochs was unrepentant, writing on the decentralized social media platform Mastodon, ‘Glad I could add a little harmless WTF to everyone’s day.’

‘To offer some reassurance,’ Bochs also posted, ‘this was built with two purposes – to remind people to *really shut off* Bluetooth (i.e. not from control center) and to have a laugh.’

To completely switch off Bluetooth on an iPhone, iPad, or MacBook, Apple users can’t trust the seemingly convenient toggle on Control Center, iOS’s quick-access panel available to users with a simple swipe.

Instead users have to go into their Settings and search for the complete Bluetooth menu to truly prevent their device from engaging with other Bluetooth devices nearby, such as the hacker’s forged Apple TV.

Bochs told TechCrunch they built the device out of an off-the-shelf Raspberry Pi Zero 2 W, a portable battery, two antennas, and one Linux-compatible Bluetooth adapter.

The total cost, Bochs estimated, was about $70.

At the heart of the hack, Bochs explained, is lax security coded into Apple’s current protocols for Bluetooth low energy, or BLE, which allows any Apple device to attempt to connect with other nearby Apple devices via Bluetooth.

Apple describes these as ‘proximity actions’ because the intent is to add convenience for users trying to sync nearby devices, such as two friends with iPhones at a bar or an iPhone user trying to control their Apple TV or home wireless speakers.

‘Proximity is determined by BLE signal strength, and most devices intentionally use lowered transmit power for these to keep the range short,’ Bochs said, adding, ‘I don’t :)’

The range for Bochs’ $70 improvised, fake Apple TV extended to 50 feet, plenty of room to ensnare unsuspecting DefCon attendees waiting in line for events around the convention center. 

Typically, the BLE signal range for an iPhone is about 33 feet, and for an Apple TV box that number can be much lower.  

The device ‘builds a custom advertisement packet that mimics what Apple TV etc. are constantly emitting at low power,’ the security researcher told TechCrunch. This allows it to pose as an Apple device and trigger pop-ups on nearby devices.

‘There’s no data collected,’ Bochs said, ‘it’s just sending out BLE advertisement packets that don’t require pairing.’

In theory, however, a similar device could maliciously collect personal user data — and given growing concerns over the iPhone’s upcoming NameDrop feature, Bochs hopes to have a new ‘proof of concept’ devise that will probe NameDrop’s security lapses in time for next year’s DefCon.

Announced for Apple’s iOS 17 update this September, NameDrop is a new feature that promises to streamline sharing contact information, making it as easy as tapping two iPhones together. But the added convenience comes with some risk.

‘Hoping by next DC to have it working with the new iOS17 ‘NameDrop’ features, and potentially do something similar for Android (at least certain models),’ Bochs said. ‘Either way I’ll probably submit it for a talk.’

DefCon, which is among the largest annual gatherings of hackers worldwide, is no stranger to wild pranks, and some praised Bochs’ stunt as ‘some OG #DEFCON shenanigans.’

The conference, despite protests from attendees, is often a major scouting location for government intelligence agencies, including the National Security Agency (NSA), that are looking to recruit the best and brightest among cybersecurity and penetration experts.

But some attendees this year expressed more confusion and concern over the Apple Bluetooth flaw, including Dan Guido, the CEO of security research firm Trail of Bits.

‘I think [Bochs] abused a bunch of users when [they] should take [their] complaints to Apple,’ Guido told TechCrunch.

But others, like the iOS application security researcher who goes by the online name NinjaLikesCheez, saw it as part of DefCon’s grand tradition of teaching and exposing security loopholes by experience.  

‘I think it’s hilarious. It was annoying as hell but also reminded me that control center is bad,’ the Netherlands-based coder said. 

 

Coca-Cola HBC ups profit guidance as price hikes offset costs

• The firm revealed first-half operating profits more than doubled to €557.3m
• Increasing prices helped the anchor bottler’s net sales revenue surpass €5bn
• Coca-Cola HBC sells dozens of brands, such as Fanta, Fuze Tea and Powerade

By Harry Wise

Published: 05:31 EDT, 9 August 2023 | Updated: 05:31 EDT, 9 August 2023

Some links in this article may be affiliate links. If you click on them we may earn a small commission. That helps us fund This Is Money, and keep it free to use. We do not write articles to promote products. We do not allow any commercial relationship to affect our editorial independence.

The most viewed homes for sale in Britain have been revealed, and buyers will need a substantial budget if they want to snap them up.

The most popular homes for sale on Rightmove in April have asking prices within a range of the cheapest at £895,000, to the most expensive at £5million.

The stamp duty on the cheapest property is £32,250, meaning the total the cost of buying the property will be more than £925,000 – and this doesn’t include other costs such as solicitor’s fees or the cost of a removal firm.

By contrast, the stamp duty on the most expensive £5million property is an eye-watering £511,250. 

This assumes the purchase is a main home as there is a 3 per cent surcharge on second homes and buy-to-let properties, in England and Wales.

Tim Bannister, of Rightmove, said: ‘Homes from Wales, Scotland and England feature in this month’s most viewed properties, highlighting the many magnificent homes for sale in lots of different areas across Britain.’

The five most views homes online…

1. Six-bed mansion, Kirby Muxloe, £4m

This six-bedroom mansion in the Leicestershire village of Kirby Muxloe was built in 1885 and has been continuously refurbished by its current owners.

It boasts a hand-crafted open-plan kitchen as well as its own garden house with a spa, hot tub, games room and cinema room.

The property is for sale for £4million via Blatch Fine Homes estate agents.

2. Four-bed house, Marford, £999k

This modern family home is in the north Welsh village of Marford and has four bedrooms.

Outside, there is a gate at the end of the garden that opens into a woodland area of residents’ exclusive use.

The property is on the market for £999,000 via Monopoly estate agents.

3. Four-bed house, Trebetherick, £5m

This four-bedroom property on the north Cornish coast is called Bishop’s Rock and was built in 1937.

It is in Trebetherick in Wadebridge and is surrounded by sand beaches that are ideal for swimming and surfing.

The house has an asking price of £5million and is being sold by Savills estate agents.

4. Five-bed house, Nunthorpe, £895k

This detached home is on a development in Nunthorpe, Middlebrough, that is accessed via electric gates and security system.

It has five bedrooms, a heat pump and under-floor heating. It is on the market for £895,000 via Michael Poole estate agents.

5. Six-bed house, Glasgow, £1,795,000

This property is in the suburb of Whitecraigs in Glasgow and has been redesigned by interior designer Keith Hobbs, of United Designers, which has worked for George Clooney and Bruce Willis.

Its unique design combines an original 1930s art deco style with more modern finishes. It is for sale for £1,795,000 via Corum estate agents.

Government borrowing costs soar to Truss-era levels as inflation shock fuels rate-hike fears

By Hugo Duncan for the Daily Mail

Updated: 16:52 EDT, 24 May 2023

Some links in this article may be affiliate links. If you click on them we may earn a small commission. That helps us fund This Is Money, and keep it free to use. We do not write articles to promote products. We do not allow any commercial relationship to affect our editorial independence.

POPULAR MONEY SECTIONS
Take me to…

BUSINESS LIVE: Inflation slows to 8.7%; Marks & Spencer earnings dented by costs; SSE Group profits soar 89% on renewables

By Live Commentary

Updated: 07:54 EDT, 24 May 2023

Some links in this article may be affiliate links. If you click on them we may earn a small commission. That helps us fund This Is Money, and keep it free to use. We do not write articles to promote products. We do not allow any commercial relationship to affect our editorial independence.

POPULAR MONEY SECTIONS
Take me to…