CVE-2019-8575: Apple AirPort Firmware Data Deletion Vulnerability
On July 4th, 2018, I reported a security/privacy problem to Apple regarding the firmware on its now-discontinued AirPort wireless access points.
Per Apple’s website, a “factory-default reset” of an AirPort should “remove any saved configurations and profiles” and should be sufficient for “selling or giving away your base station”.
On at least AirPort Extreme AP firmware 7.7.9 and AirPort Express firmware 7.6.9 (the newest available for each device at the time of reporting), a “factory-default” reset just moves the configuration file to a new location on the device, and the old file and up to two additional previous configurations remain accessible on the device.
A new owner of a used Apple AirPort that has been “factory-default reset” with a vulnerable firmware version can still retrieve at least:
- the previous owner’s wireless network name,
- the previous owner’s wireless security (such as WPA2) key,
- the previous owner’s Apple ID (usually an e-mail address) and “infinite access token” if “Back to My Mac” had been enabled,
- and any other configured ACP properties such as a RADIUS server IP and secret if WPA2 Enterprise was configured, though this is not very common.
The level of access granted to the account with just an Apple ID and “infinite access token” is unknown.
After writing about enabling SSH on the AirPort access points back in June of last year, a reader reached out to me asking for a filesystem dump of one of them.
To make sure none of my private information would be left on the device dump, I did a “factory-default” reset of my device, then set it up as a new network in AirPort Utility with a unique network name and password.
I joined the wireless network, then enabled SSH on the AirPort access point and did a filesystem dump of it (via
dd over SSH) and examined the filesystem image with
To my surprise, my old network name was still in the image binary. Assuming it was just an
unlinked file no longer referenced, I looked into which file the data was previously stored in, but discovered the file was not deleted.
A further investigation showed that there were files in
ACPData.bin.3 which were backup copies of old configurations (the current one being
Per the instructions on Apple’s website, a “factory-default reset” of an AirPort can be done by disconnecting power, holding down the reset button, then reconnecting power while continuing to hold down the reset button for six seconds.
The AirPort Utility on macOS or iOS can be used to setup the AirPort with a new network name and WPA key. Once joined to the new network (assuming the AirPort is at
10.0.1.1), enable SSH on it and reboot it:
$ python -m acp -t 10.0.1.1 -p (password) --setprop dbug 0x3000 $ python -m acp -t 10.0.1.1 -p (password) --reboot
Then copy the
ACPData.bin.1 file containing the previous configuration information (the current being at
ACPData.bin and other previous configurations at
$ scp [email protected]:/mnt/Flash/ACPData.bin.1 .
To find the previous owner’s Apple ID (“
$ strings ACPData.bin.1 | grep -A1 pappleID pappleID [email protected]
To find the previous owner’s wireless network name (“wifi”):
$ strings ACPData.bin.1 | grep -A1 praNm praNm pwifi
To find the previous owner’s wireless network password (“password”):
$ strings ACPData.bin.1 | grep -A1 psyPW psyPW ppassword
An “infinite token” is available which may give some kind of access to the previous user’s Apple account, but I have not investigated this. These two values are only present if the previous owner had logged into an Apple account and enabled Back to My Mac on the AirPort.
$ strings ACPData.bin.1 | grep -A1 pmmeBTMMInfiniteToken pmmeBTMMInfiniteToken pAQAAAABbPVeQoIF8o[snipped] $ strings ACPData.bin.1 | grep -A1 purl purl phttps://p36-btmm.icloud.com:443/v1/hello
When doing a factory reset, repeat the process at least three additional times to cycle the data out of
Update AirPort devices to firmware 7.9.1 released May 30, 2019 which will properly erase the flash partition during a later factory reset. This firmware update also patches some other more critical kernel vulnerabilities. Apple security updates are available via the Software Update mechanism and manual download.
Note that just applying the firmware update does not delete old
ACPData.bin.* files from previous factory resets.
If you’ve already sold or given away your old Airport devices before being able to update them to this new firmware, and your replacement access point uses the same WiFi network name and password, you may want to change them.
2018-07-04 (+0d) – I reported the issue by e-mail to [email protected] and received an auto-reply.
2018-07-05 (+1d) – I received a reply from Scotty of Apple Product Security confirming the issue, noting they do not automatically provide status updates.
2018-07-19 (+15d) – I e-mailed Apple Product Security for an update and received a reply from Scotty of Apple Product Security again stating they are investigating the issue.
2018-08-15 (+42d) – I e-mailed Apple Product Security for an update.
2018-08-22 (+49d) – I received a reply from Scotty of Apple Product Security again stating they are investigating the issue.
2018-10-01 (+89d) – I e-mailed Apple Product Security for an update.
2018-10-04 (+92d) – I received a reply from Scotty of Apple Product Security:
A security update for AirPort basestations is currently scheduled for release in early 2019 to address this issue. […]
In the near term, we temporarily removed the “Factory-default reset” section from our support article at https://support.apple.com/HT201945. During our investigation, our team uncovered a workaround that allows users to fully erase the device by repeating the factory default reset process four times. While this is not the long-term plan to address this issue, our AppleCare Advisors have access to this information for customers that call in wanting to perform a factory default reset on their AirPort basestation.”
2019-02-04 (+215d) – I e-mailed Apple Product Security for an update.
2019-02-08 (+219d) – I received a reply from Scotty of Apple Product Security stating he is looking into it.
2019-02-15 (+226d) – I had a conference call with Scotty of Product Security, an Airport firmware engineer, and a couple others from the privacy team at Apple, discussing disclosure and a timeline for a new firmware release. I asked what kind of access is granted by the “infinite token” stored on an Airport, but Scotty could not disclose any information about it. I reiterated my concern for a timely disclosure as these devices are now being cycled out of production due to their age and my concern that customers need a fix before they get rid of their devices.
2019-03-26 (+265d) – I received a pre-release version of a firmware update and confirmed that doing a factory reset after applying the update does delete the old
ACPData.bin files. The entire flash device mounted at
/mnt/Flash is now erased during a factory reset.
2019-04-29 (+299d) – I e-mailed Apple Product Security for an update.
2019-05-14 (+314d) – I received a reply from Scotty of Apple Product Security with a public release date estimation for the new firmware.
2019-05-17 (+316d) – I received an e-mail from Apple Product Security indicating this vulnerability has been assigned CVE-2019-8575.
2019-05-30 (+329d) – I received Apple’s announcement e-mail of the public release of firmware 7.9.1.