AI
How a Prior Research Led to AirPlay
A year before Airborne, Gal Elbaz and Uri Katz presented “000000 day” at DEF CON 32. The research showed that browsers can reach locally running services through an overlooked IP address, enough to trigger RCE from a malicious email or webpage. Browsers have tried to close that hole for 20 years without success.
While port-scanning macOS devices through the browser during that project, they noticed port 7000 open on every machine. No Apple experience, no prior target in mind. Port 7000 belongs to AirPlay. That was enough to start pulling the thread.
AirPlay Protocol Internals
AirPlay started as AirTunes in 2004, streaming audio between Apple devices. Six years later Apple added video and images. Both AirPlay 1 and 2 remain in active use today.
Discovery runs over mDNS on port 5353. Devices broadcast their name and open port as plaintext, so an attacker on the same network collects a device list without scanning. Sessions run over HTTP and RTSP on port 7000, payloads encoded as binary plist. The protocol is proprietary and its documentation was incomplete or outdated, forcing the team to pull the binary from the dyld cache and reverse engineer the command set.
Five-Minute Fuzzer, Three Immediate Findings
The fuzzer took five minutes to write in Python: five nested for loops, no Apple experience required. Three findings came back immediately. First, an auth bypass: dozens of AirPlay commands skip the authentication check entirely, letting an attacker play full-screen video on a Mac set to the strictest configuration. Second, a syslog leak: one GET request dumps the full system log including hostname, username, and running processes. Third, a single HTTP packet crashed Control Center with no authentication. The crash was memory corruption, not yet exploitable, but finding it that fast made clear the surface ran much deeper.
Reverse Engineering and Vulnerability Classes
No source code. They pulled the AirPlay binary from macOS’s dyld cache and reverse engineered the HTTP command handler. Two bug classes recurred: type-confusion where user-controlled plist data reaches functions expecting a specific type, and null-dereference when commands fire before a media session exists. That pass produced 16 Apple CVEs.
“only two out of these 23 vulnerabilities were in the SDK. And one of these vulnerabilities is a stock buffer overflow. Yes, in 2025.” — Uri Katz
The SDK overflow is on every certified third-party device. They verified it on emulated Bose firmware, then ran the Pioneer CarPlay head unit exploit (19:13) on a multimedia unit booted in the office. The CVE called it “unexpected termination.” It is remote code execution.
macOS Use-After-Free and the Zero-Click Bypass
Bug 17 was a use-after-free inside FairPlay decryption. FairPlay stores the encryption context in a global pointer. When decryption fails, teardown frees that memory but never zeros the pointer. Apple’s AirPlay daemon has no heap-spray protection, so an attacker reclaims the freed region and writes to any heap address, giving arbitrary memory writes across the control center process.
The exploit still required one user click until they found a flag in the auth code. Clients identifying as a remote control skip the confirmation popup entirely. That flag turned the RCE into a zero-click. Apple assigned a CVE for the bypass.
Attack Vectors, Live Demos, and Disclosure
Four vectors cover the full exposure: 200,000 internet-facing devices on Shodan, same-network targets advertised over MDNS, browser-reachable port 7000, and physical proximity within Wi-Fi or Bluetooth range. The Bose home speaker root shell demo (28:11) dropped a root reverse shell, then downloaded and displayed an image. The macOS UAF zero-click demo (29:26) overwrote the music-app pointer inside Control Center without a user click.
“when was the last time you’ve updated your speaker?” — Uri Katz
Apple patched all 23 CVEs in a coordinated release. Cisco listed 63 affected products at disclosure. Some IoT devices will never be patched.
Notable Quotes
only two out of these 23 vulnerabilities were in the SDK. And one of these vulnerabilities is a stock buffer overflow. Yes, in 2025. Uri Katz · ▶ 15:57
when was the last time you’ve updated your speaker? Uri Katz · ▶ 29:17
not my code equals not my responsibility Gal Elbaz · ▶ 35:00
Key Takeaways
- Patch every AirPlay-capable device now — IoT vendors may never ship a fix, leaving millions of speakers, TVs, and car head units permanently exploitable.
- A single SDK stack buffer overflow propagates across every certified third-party device; audit your dependencies, not just your own code.
- AirPlay’s proximity and same-network attack vectors require no prior access — disable the AirPlay receiver on any device you do not actively use as a display.