apple_bleee

Overview

apple_bleee is a research toolkit from hexway that abuses Apple’s Bluetooth Low Energy Continuity protocol (used for AirDrop, Handoff, AirPods pop-ups, etc.). It can passively sniff BLE advertisements to fingerprint nearby Apple devices (iOS version, device type, phone number hash), spoof AirPods pairing pop-ups for phishing/social-engineering demos, and send malformed frames to trigger Bluetooth-stack DoS on some iOS versions.

Common Usage

Requires a Linux host with a BLE-capable adapter (root)

sudo pip3 install -r requirements.txt

Passively sniff and decode Apple Continuity advertisements

sudo python3 adv_watch.py

Show extended device info leaked in Continuity frames

sudo python3 adv_watch.py -e

Spoof an AirPods “connect” popup on nearby iOS devices

sudo python3 airpods.py -i hci0

Send a Bluetooth DoS-style crash advert (impact varies by iOS version)

sudo python3 crasher.py -i hci0

Tips

• Only works against unpatched/older iOS versions for the crash and some info-leak primitives — Apple has fixed several of these over time
• Requires a BLE adapter that supports raw advertisement injection (not all onboard/USB dongles do)
• Use only against devices you own or have explicit authorization to test — this targets real users’ personal devices

adv_watch.py - passive Apple Continuity BLE sniffer

Usage:
  sudo python3 adv_watch.py [options]

Options:
  -i IFACE    HCI interface to use (default: hci0)
  -e          Show extended/decoded device info
  -o FILE     Log output to file

airpods.py - AirPods popup spoofer

Usage:
  sudo python3 airpods.py -i IFACE [-m MODEL]

crasher.py - Continuity frame crash PoC

Usage:
  sudo python3 crasher.py -i IFACE

Vue d’ensemble

apple_bleee est une boîte à outils de recherche de hexway qui abuse du protocole Bluetooth Low Energy Continuity d’Apple (utilisé par AirDrop, Handoff, les popups AirPods, etc.). Il peut renifler passivement les advertisements BLE pour fingerprinter les appareils Apple proches (version d’iOS, type d’appareil, hash du numéro de téléphone), usurper les popups d’appairage AirPods pour des démos de phishing ou d’ingénierie sociale, et envoyer des trames malformées pour déclencher un DoS de la pile Bluetooth sur certaines versions d’iOS.

Utilisation courante

# Nécessite un hôte Linux avec un adaptateur compatible BLE (root)
sudo pip3 install -r requirements.txt

# Renifler et décoder passivement les advertisements Apple Continuity
sudo python3 adv_watch.py

# Afficher les infos étendues fuitées dans les trames Continuity
sudo python3 adv_watch.py -e

# Usurper un popup "connect" AirPods sur les appareils iOS proches
sudo python3 airpods.py -i hci0

# Envoyer un advert de crash type DoS Bluetooth (impact variable selon la version d'iOS)
sudo python3 crasher.py -i hci0

Conseils

• Ne fonctionne que contre des versions d’iOS anciennes ou non patchées pour le crash et certaines primitives de fuite d’info : Apple a corrigé plusieurs de ces failles au fil du temps
• Nécessite un adaptateur BLE qui supporte l’injection brute d’advertisements (ce n’est pas le cas de tous les dongles intégrés ou USB)
• À utiliser uniquement contre des appareils qui vous appartiennent ou pour lesquels vous avez une autorisation explicite de test : cela vise les appareils personnels de vraies personnes

adv_watch.py - passive Apple Continuity BLE sniffer

Usage:
  sudo python3 adv_watch.py [options]

Options:
  -i IFACE    HCI interface to use (default: hci0)
  -e          Show extended/decoded device info
  -o FILE     Log output to file

airpods.py - AirPods popup spoofer

Usage:
  sudo python3 airpods.py -i IFACE [-m MODEL]

crasher.py - Continuity frame crash PoC

Usage:
  sudo python3 crasher.py -i IFACE