Apple's AirDrop protocol can accidentally leak your e-mail address and phone number to nearby Apple devices, five German researchers have discovered. They added that Apple has known about this problem (which makes 1.5 billion devices vulnerable) for nearly two years, but has come up with a possible solution.

"It is possible to know the phone numbers and e-mail addresses of AirDrop users. All the attacker needs is a Wi-Fi enabled device and physical proximity to the target."

"Apple users are still vulnerable. They can only protect themselves by disabling AirDrop detection in their system settings and refraining from opening the sharing pane."

To avoid these attacks, set AirDrop to "Receive Off" on iPhones and iPads, and set it to "Don't let anyone discover it" on Macs.

You may also want to turn off Wi-Fi and Bluetooth when not in use, but it is not certain that doing so will actually turn off AirDrop.

Alternatively, you could have "Everyone" send you files via AirDrop. You may see a lot of disturbing images sent by other iPhone users, though.

When an AirDrop-enabled device is ready to share a file, it will broadcast your phone number or email address (whichever is tied to your Apple account) in encrypted form to anything within Wi-Fi or Bluetooth range.

Other Apple devices with AirDrop set to the default "Contacts Only" can check to see if you are in that user's contact list, in case you want to connect. (Devices with AirDrop set to "Everyone" will not perform this check, but will receive encrypted phone numbers and email addresses.)

Apple devices do not broadcast actual phone numbers or email addresses. Rather, they transmit a "hash" of their values, a long string of characters obtained when the text is subjected to a fixed mathematical algorithm.

For example, the phone number 1 (212) 555-1212, stripped of spaces and parentheses, would be "26321368f6c23510f79a21085024dd5a4f958e6c22dc057a" from the SHA-256 hashing algorithm used by AirDrop 358d1b5a1fc5c932" as output.

Other Apple devices match those hashes with hashes of email addresses and phone numbers in their own contact lists. If a match is found, those devices will send back to you a hash of their own email addresses and phone numbers.

If both devices have each other's contact information in their contact lists, an AirDrop connection is made and files can be shared. (The "Everyone" setting skips this check and will share files with anyone.)

The problem is that the hash is supposed to be irreversible, i.e., it should not be possible to dial back the hash to get the original phone number or email address, but in reality this is not the case.

"Cryptographic hash functions cannot hide their input (called pre-images) when the input space is small or predictable, such as a phone number or email address," according to researchers Alexander Heinrich, Matthias Holick, Thomas Schneider, Milan Stoute, and Christian Weinert.

Heinrich, Hollick, and Stoute had previously worked on ways to attack AirDrop's technical infrastructure.

In other words, since phone numbers follow a predictable format, precompiling a list of known hashes for every possible phone number in a particular area code, or for all 10 billion or so possible phone numbers in North America, would not take a mid-range computer so It would not take long.

A hacker could put a compiled list of phone number hashes on his or her laptop, sit in a public place, such as outside the entrance to a large company's headquarters during lunch break, and passively collect the numbers of nearby iPhones trying to set up AirDrop sharing.

Hackers can also actively force other devices to give out their phone numbers. For example, they can initiate AirDrop sharing by sending a hash of phone numbers that many people might have in their contact list, such as a company's representative phone number or the number of its human resources department.

A passing iPhone with that number in its contact list will send back a hash of its own phone number.

Since cell phone numbers are (mis)used as identification for password challenges, bank account logins, and two-factor authentication, obtaining the phone number of a high-profile individual or someone who owns a large amount of bitcoin can cause significant damage.

Email addresses are a bit more difficult to precompile hashes for. However, hackers can limit the precomputed hashes to addresses ending in "@gmail.com" or "@yahoo.com" or those that follow a company-specific address format.

"Alternatively, an attacker could generate an email lookup table from the data leak or use an online lookup service for hashed email addresses," the paper states.

Hackers can then harvest email addresses in the same way they harvest phone numbers. These e-mail addresses "could be used for fraudulent activities such as (spear)phishing attacks or selling personal data for profit," the research paper notes.

The Darmstadt researchers stated that they privately communicated the passive attack scenario to Apple in May 2019 and the active attack scenario in October 2020.In July 2019, a second group independently was discovered and made public.

"Apple has not yet commented on whether it plans to address these AirDrop issues," the research paper states. (Tom's Guide has reached out to Apple for comment and will update this article as soon as we hear back.)

The researchers have created an open source project called "PrivateDrop" that "seamlessly integrates with the current AirDrop protocol stack."

They told Apple in October that PrivateDrop would fix AirDrop's data leakage problem by substituting other values for hashed phone numbers and email addresses.