In a significant revelation for tech enthusiasts and everyday users alike, cybersecurity firm Oligo has unveiled a series of alarming vulnerabilities within Apples AirPlay protocol and its software development kit. These weaknesses, if exploited, could provide malicious actors with an entry point to infiltrate not just AirPlay devices but potentially any connected device on the same network. This critical information was first reported by Wired, highlighting the pressing nature of the issue.

Oligos research team has coined the term AirBorne to describe the vulnerabilities and the various types of attacks they enable. Among the two most critical flaws identified, Oligo has classified them as wormable vulnerabilities. This classification implies that attackers could seize control of an AirPlay device and disseminate malware throughout any local network that the compromised device connects to. It is important to note that for an attack to be successful, the hacker must already have access to the same network as the targeted device.

The implications of these vulnerabilities are extensive. Oligo warns that attackers could execute remote code on affected devices, a scenario commonly referred to as a Remote Code Execution (RCE) attack. This could allow hackers to access local files, harvest sensitive information, or even launch denial-of-service attacks that disrupt normal operations. For instance, a hacker could force a smart speaker to display unauthorized images or audibly listen in on conversations via the devices microphone, as demonstrated in a video featuring a compromised AirPlay-enabled Bose speaker.

Though Apple has already implemented patches to address these vulnerabilities within its own hardware, users of non-Apple AirPlay devices still face significant risks. Wired emphasizes that while the probability of a hacker being present on a private home network is relatively low, the situation changes when users connect to public networks using AirPlay-compatible deviceslike a MacBook or an iPhonethat havent been updated with the latest security patches.

The vulnerabilities are not confined to AirPlay alone; they extend to CarPlay devices as well. Oligos findings indicate that attackers could execute an RCE attack via CarPlay, particularly under conditions such as connecting to a cars Wi-Fi hotspot that employs a default or easily guessable password. Once attackers gain access, they could manipulate the cars infotainment system, display unauthorized images, or even track the vehicle's location.

A staggering number of third-party devices utilize AirPlay technology, with Oligo estimating that tens of millions of these products are in use globally. This includes various standalone speakers, home theater systems, and television sets. Furthermore, CarPlay is prevalent, being available in over 800 different vehicle models. While Apple has endeavored to create patches for affected third-party devices, a cybersecurity expert pointed out that Apple does not have direct control over the patching process for these external products, raising concerns about how quickly vulnerabilities can be addressed across this diverse ecosystem.

As the landscape of cybersecurity continues to evolve, Apples response to these findings remains crucial. At the time of this report, Apple did not immediately respond to The Verges request for additional comment, leaving users to wonder about the future of their AirPlay and CarPlay experiences in light of these vulnerabilities.