Live data from Hacker News

Bypassing regulatory locks, hacking AirPods and Faraday cages

lagrangepoint.substack.com

81–90 of 202 posts

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#82

It appears that the Hearing Aid feature is actually an equalizer preset that is pushed to the AirPods and will replace your transparency mode. Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but per…

For anyone else wondering, apparently "TWS" means "True Wireless Stereo":

https://audiochamps.com/what-does-tws-mean/

So, Bluetooth.

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#85

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#86

It appears that the Hearing Aid feature is actually an equalizer preset that is pushed to the AirPods and will replace your transparency mode. Apple could've just not marketed these as "hearing aids" or used the medical terminology, as every other TWS with parametric EQ and transparency mode can do the same thing, and they wouldn't have the regulatory hawks going after them. They only lose the marketing edge, but per…

For anyone else wondering, apparently "TWS" means "True Wireless Stereo": https://audiochamps.com/what-does-tws-mean/ So, Bluetooth.

Bluetooth headphones have many form factors. TWS in particular means you have two buds that aren’t joined in any way.

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#87

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

Eh, how does using a VPN make it easier to MITM attack yourself and modify the response of that GET request?

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#88
post #85

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.

Sorry, should have clarified: instead of faking the response, you can connect to Apple’s servers through a US proxy. They will see you have a US IP address and return the corresponding location code, all over properly signed HTTPS.

There are a few caveats (e.g. using a residential or mobile proxy would look less suspicious, in case Apple looks out for datacenter IP ranges), but I think it should work.

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#89
post #87

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

Eh, how does using a VPN make it easier to MITM attack yourself and modify the response of that GET request?

Sorry, should have made it more clear! Basically there’s no need to MITM at all here: https://news.ycombinator.com/item?id=42122270

Re: Bypassing regulatory locks, hacking AirPods and Faraday cages

#90
post #85

Certificate pinning should be pretty easy to solve in this particular case: just get a proxy/VPN! The Faraday cage shenanigans are pretty cool though.

You might need to explain how a VPN solves the certificate pinning issue; the author is already modifying the phone's HTTP/S traffic via a proxied network connection, and a VPN doesn't (to my knowledge) allow you to forge valid HTTPS responses using the pinned server certificate.

You don't need to modify the HTTPS traffic. You get a VPS that is in the US, and set the device up so that when it requests the domain (gspe1-ssl.ls.apple.com) that the IP address returned is not an Apple IP address, but the VPS IP.

The VPS simply forwards traffic on port 443 to gspe1-ssl.ls.apple.com.

Post reply on HN