CalvinBackup/iOS-18.5-Bluetooth-Privacy-Vuln
1
0
Fork 0
mirror of https://github.com/JGoyd/iOS-18.5-Bluetooth-Privacy-Vuln.git synced 2026-08-29 13:40:36 +02:00
Code Issues Packages Projects Releases Wiki Activity

README.md

Browse Source
This commit is contained in:
JGoyd
2025-08-17 12:44:07 -04:00
committed by GitHub
parent 63ba79315f
commit 1b7f26db39
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+26
View File
@@ -0,0 +1,26 @@
# iOS 18.5 Bluetooth Privacy Vulnerabilities
> ⚠ Silent BLE Scanning, Metadata Exposure, and Covert GPS Activation on iPhone
---
## Overview
This repository documents a high-severity set of privacy violations in **iOS 18.5**, where multiple native Apple system processes (daemons) perform unauthorized actions related to Bluetooth and location services — all without user awareness or consent.
The research was performed using official Apple tooling (Console.app) on a **stock iPhone 14 Pro Max** running **iOS 18.5**, with **no jailbreak**, **no MDM**, and **no third-party apps**.
---
## Report Summary
| ID | Component | Description | Impact |
|----------|------------------------|--------------------------------------------------|--------------------------------------------|
| VF-001 | `audioaccessoryd` | Surfaces Bluetooth trust metadata (e.g. IRKs) | Passive identity tracking |
| VF-002 | `SPCBPeripheralManager`| Triggers silent BLE scans in background | Device becomes discoverable without notice |
| VF-003 | `locationd` | Covert GPS harvesting without UI or consent | Silent location tracking |
| VF-004 | `tccd` | Bypasses TCC privacy permissions using a flag | Consent enforcement disabled |
| VF-005 | `bluetoothd` | Continues trust logic after crypto failures | Weakens BLE trust enforcement |
---