{"id":13647284,"url":"https://github.com/ECTO-1A/AppleJuice","last_synced_at":"2025-04-22T02:31:20.748Z","repository":{"id":190452490,"uuid":"682539864","full_name":"ECTO-1A/AppleJuice","owner":"ECTO-1A","description":"Apple BLE proximity pairing message spoofing","archived":false,"fork":false,"pushed_at":"2024-06-17T19:37:23.000Z","size":5786,"stargazers_count":1757,"open_issues_count":34,"forks_count":150,"subscribers_count":22,"default_branch":"main","last_synced_at":"2025-04-15T02:06:26.616Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ECTO-1A.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-24T11:47:11.000Z","updated_at":"2025-04-07T15:29:36.000Z","dependencies_parsed_at":"2024-01-14T10:02:53.784Z","dependency_job_id":"863cb05e-15bd-4ca6-aeee-45132c6eb30d","html_url":"https://github.com/ECTO-1A/AppleJuice","commit_stats":null,"previous_names":["ecto-1a/applejuice"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ECTO-1A%2FAppleJuice","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ECTO-1A%2FAppleJuice/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ECTO-1A%2FAppleJuice/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ECTO-1A%2FAppleJuice/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ECTO-1A","download_url":"https://codeload.github.com/ECTO-1A/AppleJuice/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250163638,"owners_count":21385278,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:03:27.840Z","updated_at":"2025-04-22T02:31:20.207Z","avatar_url":"https://github.com/ECTO-1A.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# AppleJuice\n#### Apple BLE Proximity Pairing Message Spoofing\n\n\u003e ### :red_circle: Disclaimer\n\u003e These scripts are an experimental PoC that uses Bluetooth Low Energy (BLE) to send proximity pairing messages to Apple devices.\\\n\u003e This project is created for educational purposes and cannot be used for law violation or personal gain.\n\u003e The author of this project is not responsible for any possible harm caused by the materials of this project.\n\n## Updates\n\n**9/21/23** \u003cbr\u003e\n\u003cbr\u003e\nThanks to [0DayCTF](https://github.com/0dayctf) the random option has been added!\u003cbr\u003e \n\u003cbr\u003e\n*To run with random :* \u003cbr\u003e\n```python3 app.py --random``` \u003cbr\u003e\n*or* \u003cbr\u003e\n```python3 app.py -r -i 20``` \u003cbr\u003e\nto set to it to random and the time interval to 20ms, making it more spammy.\u003cbr\u003e\n\u003cbr\u003e\n**9/13/2023** \u003cbr\u003e\n\u003cbr\u003e\nAfter [Techryptic's attempt to steal the work of myself and WillyJL](https://techcrunch.com/2023/09/05/flipper-zero-hacking-iphone-flood-popups/), Willy has taken the time to give an insanely in-depth timeline of the events and proof of the work being stolen (Git and my typos dont lie!) Check out the full report below and please help us spread the word that the person who has been all over the news outlets claiming this as their work, stole the code and gave none of the actual developers credit.\u003cbr\u003e\n\u003cbr\u003e\n[The Controversy Behind Apple BLE Spam](https://willyjl.dev/blog/the-controversy-behind-apple-ble-spam)\n### Flipper Zero\n\nThanks to the amazing work of [Willy-JL](https://github.com/Willy-JL/Willy-JL) this has been added to the [Flipper Zero Momentum Firmware](https://github.com/Next-Flip/Momentum-Firmware).\n#### To install it now, follow the guide below from the Momentum Firmware page to clone and compile the current build that contains the Apple BLE Spam app.\n\n\u003e :warning: **Warning!** \u003cbr\u003e\n\u003e We will not give basic support for compiling in our server. This is intended for people that already *know* what they are doing!\n\n```bash\nTo download the repository:\n$ git clone --recursive --jobs 8 https://github.com/Next-Flip/Momentum-Firmware.git\n$ cd Momentum-Firmware/\n\nTo flash directly to the Flipper (Needs to be connected via USB, qFlipper closed)\n$ ./fbt flash_usb_full\n\nTo compile a TGZ package\n$ ./fbt updater_package\n\nTo build and launch a single app:\n$ ./fbt launch APPSRC=your_appid\n```\n\n### ESP-32\n\nThanks to [ronaldstoner](https://github.com/ronaldstoner) for porting this over to the ESP-32\n\n### Android\n\nCheck out this in-depth walk though by [Mobile Hacker](https://www.mobile-hacker.com/2023/09/07/spoof-ios-devices-with-bluetooth-pairing-messages-using-android/) about running AppleJuice on a rooted Android phone.\n\n## About This Project\nThis was created in response to the various AppleTV spoof messages being sent out during [DEF CON 31](https://techcrunch.com/2023/08/14/researcher-says-they-were-behind-iphone-popups-at-def-con/). After experiencing it first hand, I had to figure out what was happening. The existing research projects I could find (see *credits*) had great info but were both a couple years out of date with broken package dependencies, so I decided to take what I could from them and start building from there.\n\n## Hardware Requirements\n\nTo run these scripts you need a Linux machine with an internal Bluetooth card or a USB Bluetooth adapter.\n\nAll original testing was done on a Lenovo T480 with a built-in Bluetooth adapter.\\\nLater tested on Raspberry Pi 3B+ and Raspberry Pi Zero W running Kali Linux with a [Zexmte Long Range USB Bluetooth 5.1 Adapter with Dual Antenna](https://zexmte.com/collections/bluetooth-adapter/products/plug-play-long-range-bluetooth-5-1-usb-adapter).\u003cbr\u003e\n\n\u003cimg src=\"https://github.com/ECTO-1A/AppleJuice/assets/112792126/a6f2b9fa-ca26-45c1-a440-681beb55c76e\" width=\"300\"\u003e\u003cbr\u003e\n\n\u003e **Range** \u003cbr\u003e\n\u003e Range of messages by device type\n\n| Device    | Range |\n|:----------|:----------|\n| Lenovo    | Couple feet from machine |\n| Raspberry Pi and long range adapter   | 20+ feet indoors in heavy BLE traffic |\n\n## Installation Instructions\nPlease follow in this exact order or you might run into issues with bluetooth dependencies.\n\n### Clone the Main Repo\n```bash\ngit clone https://github.com/ECTO-1A/AppleJuice.git \u0026\u0026 cd ./AppleJuice\n```\n\n### Install dependencies\n```bash\nsudo apt update \u0026\u0026 sudo apt install -y bluez libpcap-dev libev-dev libnl-3-dev libnl-genl-3-dev libnl-route-3-dev cmake libbluetooth-dev\n```\n\n### Dependencies requiring manual installation\n\u003e :warning: **Warning** \u003cbr\u003e\n\u003e The `pybluez` library is broken on GitHub and needs to be installed manually\n```bash\nDownload the latest version \npip install git+https://github.com/pybluez/pybluez.git#egg=pybluez\n\npycrypto is not maintained, be sure to install pycryptodome instead \npip install pycryptodome\n```\n\n### Install requirements\n```bash\nsudo pip install -r requirements.txt\n```\n### Execute scripts without `sudo`\n\u003e To be able to run without sudo, you need to set the capabilities of the python binary to allow it to access raw sockets. This is done with the following command \n\n```bash\nsudo setcap cap_net_raw,cap_net_admin+eip $(eval readlink -f $(which python))\n```\n\n### Reboot Machine\nSeveral users have reported the need for a reboot after installing the bluetooth packages in order for everything to work properly.\n\n## Usage\n\n#### Before running the script, check that your Bluetooth adapter is connected and showing as `hci0`\nRun `hcitool dev` to get a list of connected adapters\n```bash\nhcitool dev\nDevices:\n    hci0    00:00:7C:00:3A:13\n```\n\u003e :memo: **Note** \u003cbr\u003e\n\u003e If the adapter is showing as `hci1` you will need to edit the `dev_id` variable in the scripts to match\n\n### Available options\n\nAll messages have been combined into a single app. You can now run `app.py` to get a list of available options.\u003cbr\u003e\nTo run the script use `-d (number of message)`  \n\u003e **Example** \u003cbr\u003e \n\u003e `app.py -d 13`\n\n```python\npython3 app.py\nPlease select a message option using -d.\nAvailable message options:\n1: Airpods\n2: Airpods Pro\n3: Airpods Max\n4: Airpods Gen 2\n5: Airpods Gen 3\n6: Airpods Pro Gen 2\n7: PowerBeats\n8: PowerBeats Pro\n9: Beats Solo Pro\n10: Beats Studio Buds\n11: Beats Flex\n12: BeatsX\n13: Beats Solo3\n14: Beats Studio3\n15: Beats Studio Pro\n16: Beats Fit Pro\n17: Beats Studio Buds+\n18: AppleTV Setup\n19: AppleTV Pair\n20: AppleTV New User\n21: AppleTV AppleID Setup\n22: AppleTV Wireless Audio Sync\n23: AppleTV Homekit Setup\n24: AppleTV Keyboard\n25: AppleTV 'Connecting to Network'\n26: Homepod Setup\n27: Setup New Phone\n28: Transfer Number to New Phone\n29: TV Color Balance\n```\n\n## Examples\n\n`beatssolopro.py`\n\u003e **Model**: Beats Solo Pro\n\n\u003cimg src=\"https://github.com/ECTO-1A/AppleJuice/assets/112792126/c3218a09-7aef-483b-957d-f3c19a55fc08\" width=\"300\"\u003e\n\n`airpods_max.py`\n\u003e **Model**: Airpods Max\n\n\u003cimg src=\"https://github.com/ECTO-1A/AppleJuice/assets/112792126/5eea40e8-d7c1-4324-9f3d-1425228d0458\" width=\"300\"\u003e\n\n### Credit\n- [FuriousMAC](https://github.com/furiousMAC/continuity) and [Hexway](https://github.com/hexway/apple_bleee) for all the prior research on Apple BLE, Continuity, and building the Wireshark disector.\n- [Jae Bochs](https://infosec.exchange/@jb0x168/110879394826675242) for [exposing this to me at DEF CON 31](https://techcrunch.com/2023/08/14/researcher-says-they-were-behind-iphone-popups-at-def-con/) which made me jump into learning about BLE.\n- Guillaume Celosia and Mathieu Cunche for reverse engineering [Proximity Pairing](https://petsymposium.org/2020/files/papers/issue1/popets-2020-0003.pdf\") \n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FECTO-1A%2FAppleJuice","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FECTO-1A%2FAppleJuice","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FECTO-1A%2FAppleJuice/lists"}