From 1b7f26db39816099f89a068ce8c5a72580cb8781 Mon Sep 17 00:00:00 2001 From: JGoyd Date: Sun, 17 Aug 2025 12:44:07 -0400 Subject: [PATCH] README.md --- README.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..5515739 --- /dev/null +++ b/README.md @@ -0,0 +1,26 @@ +# iOS 18.5 Bluetooth Privacy Vulnerabilities + +> ⚠ Silent BLE Scanning, Metadata Exposure, and Covert GPS Activation on iPhone + +--- + +## Overview + +This repository documents a high-severity set of privacy violations in **iOS 18.5**, where multiple native Apple system processes (daemons) perform unauthorized actions related to Bluetooth and location services — all without user awareness or consent. + +The research was performed using official Apple tooling (Console.app) on a **stock iPhone 14 Pro Max** running **iOS 18.5**, with **no jailbreak**, **no MDM**, and **no third-party apps**. + +--- + +## Report Summary + +| ID | Component | Description | Impact | +|----------|------------------------|--------------------------------------------------|--------------------------------------------| +| VF-001 | `audioaccessoryd` | Surfaces Bluetooth trust metadata (e.g. IRKs) | Passive identity tracking | +| VF-002 | `SPCBPeripheralManager`| Triggers silent BLE scans in background | Device becomes discoverable without notice | +| VF-003 | `locationd` | Covert GPS harvesting without UI or consent | Silent location tracking | +| VF-004 | `tccd` | Bypasses TCC privacy permissions using a flag | Consent enforcement disabled | +| VF-005 | `bluetoothd` | Continues trust logic after crypto failures | Weakens BLE trust enforcement | + +--- +