← retour aux outils back to tools

# apple_bleee

Exploite des failles du protocole BLE Continuity d'Apple pour fuiter des infos sur les appareils proches, déclencher de faux popups d'appairage, ou crasher des appareils. Exploits flaws in Apple's BLE Continuity protocol to leak nearby device info, trigger fake pairing popups, or crash devices.

↗ https://github.com/hexway/apple_bleee

## Overview

apple_bleee is a research toolkit from hexway that abuses Apple’s Bluetooth Low Energy Continuity protocol (used for AirDrop, Handoff, AirPods pop-ups, etc.). It can passively sniff BLE advertisements to fingerprint nearby Apple devices (iOS version, device type, phone number hash), spoof AirPods pairing pop-ups for phishing/social-engineering demos, and send malformed frames to trigger Bluetooth-stack DoS on some iOS versions.

## Common Usage

Requires a Linux host with a BLE-capable adapter (root)

    sudo pip3 install -r requirements.txt

Passively sniff and decode Apple Continuity advertisements

    sudo python3 adv_watch.py

Show extended device info leaked in Continuity frames

    sudo python3 adv_watch.py -e

Spoof an AirPods “connect” popup on nearby iOS devices

    sudo python3 airpods.py -i hci0

Send a Bluetooth DoS-style crash advert (impact varies by iOS version)

    sudo python3 crasher.py -i hci0

## Tips

- Only works against unpatched/older iOS versions for the crash and some info-leak primitives — Apple has fixed several of these over time
- Requires a BLE adapter that supports raw advertisement injection (not all onboard/USB dongles do)
- Use only against devices you own or have explicit authorization to test — this targets real users’ personal devices

Help / Man page

    adv_watch.py - passive Apple Continuity BLE sniffer

    Usage:
      sudo python3 adv_watch.py [options]

    Options:
      -i IFACE    HCI interface to use (default: hci0)
      -e          Show extended/decoded device info
      -o FILE     Log output to file

    airpods.py - AirPods popup spoofer

    Usage:
      sudo python3 airpods.py -i IFACE [-m MODEL]

    crasher.py - Continuity frame crash PoC

    Usage:
      sudo python3 crasher.py -i IFACE

## Vue d’ensemble

apple_bleee est une boîte à outils de recherche de hexway qui abuse du protocole Bluetooth Low Energy Continuity d’Apple (utilisé par AirDrop, Handoff, les popups AirPods, etc.). Il peut renifler passivement les advertisements BLE pour fingerprinter les appareils Apple proches (version d’iOS, type d’appareil, hash du numéro de téléphone), usurper les popups d’appairage AirPods pour des démos de phishing ou d’ingénierie sociale, et envoyer des trames malformées pour déclencher un DoS de la pile Bluetooth sur certaines versions d’iOS.

## Utilisation courante

    # Nécessite un hôte Linux avec un adaptateur compatible BLE (root)
    sudo pip3 install -r requirements.txt

    # Renifler et décoder passivement les advertisements Apple Continuity
    sudo python3 adv_watch.py

    # Afficher les infos étendues fuitées dans les trames Continuity
    sudo python3 adv_watch.py -e

    # Usurper un popup "connect" AirPods sur les appareils iOS proches
    sudo python3 airpods.py -i hci0

    # Envoyer un advert de crash type DoS Bluetooth (impact variable selon la version d'iOS)
    sudo python3 crasher.py -i hci0

## Conseils

- Ne fonctionne que contre des versions d’iOS anciennes ou non patchées pour le crash et certaines primitives de fuite d’info : Apple a corrigé plusieurs de ces failles au fil du temps
- Nécessite un adaptateur BLE qui supporte l’injection brute d’advertisements (ce n’est pas le cas de tous les dongles intégrés ou USB)
- À utiliser uniquement contre des appareils qui vous appartiennent ou pour lesquels vous avez une autorisation explicite de test : cela vise les appareils personnels de vraies personnes

Aide / Page de manuel

    adv_watch.py - passive Apple Continuity BLE sniffer

    Usage:
      sudo python3 adv_watch.py [options]

    Options:
      -i IFACE    HCI interface to use (default: hci0)
      -e          Show extended/decoded device info
      -o FILE     Log output to file

    airpods.py - AirPods popup spoofer

    Usage:
      sudo python3 airpods.py -i IFACE [-m MODEL]

    crasher.py - Continuity frame crash PoC

    Usage:
      sudo python3 crasher.py -i IFACE