[HN Gopher] Bypassing regulatory locks, hacking AirPods and Fara...
       ___________________________________________________________________
        
       Bypassing regulatory locks, hacking AirPods and Faraday cages
        
       Author : rithvikvibhu
       Score  : 558 points
       Date   : 2024-11-12 18:50 UTC (1 days ago)
        
 (HTM) web link (lagrangepoint.substack.com)
 (TXT) w3m dump (lagrangepoint.substack.com)
        
       | post_break wrote:
       | Does this reset itself after a certain amount of time or is it
       | one and done? I'd be worried about the feature being removed when
       | the iPad or airpods decide they've been in India for too long.
        
         | thel3l wrote:
         | Heya! One of the authors here.
         | 
         | Nope, its a one time thing. When the feature is enabled, a flag
         | is set on the iCloud account, so you can travel anywhere and
         | have it work. At the same time, a EQ profile is pushed to the
         | transparency mode of the Airpods, enabling the hearing aid
         | features.
         | 
         | Once done, it sticks with the Airpods, unless you reset them.
         | 
         | However, an interesting quirk is that if you enable this on
         | someone's airpods, and _their_ device/account does not have it
         | 'available', they wont be able to tweak the settings on their
         | device.
        
           | post_break wrote:
           | Very cool, glad it sticks.
        
           | ilt wrote:
           | I live in India and I have been using hearing aid feature
           | since at least March when I bought Airpods Pro. Only that it
           | wasn't called as such earlier. It uses the audiogram I had
           | provided it which it used to create a customized equalizer
           | for my hearing disability. I am sure they must have improved
           | upon the capability in new OS versions but functionally it
           | has been present for a while now.
        
             | _rs wrote:
             | I suppose the difference is 1st party support for creating
             | the audiogram, plus the clearance from the US gov to market
             | it the way they want as OTC hearing aids
        
               | lathiat wrote:
               | It also applied the same profile to both ears, which
               | matters for some. My hearing loss is highly asymmetric.
        
               | ilt wrote:
               | Does it still do that? I understand it had problems with
               | asymetric hearing loss earlier.
        
           | _rs wrote:
           | I wonder if the flag gets reset every so often if the device
           | doesn't think it's in the US for a long period of time. I've
           | heard Apple considered that for some of the other EU
           | restrictions
        
             | rtkwe wrote:
             | Probably not to account for people spending lots of time
             | outside the US. The main restriction is not selling items
             | with particular features outside of approved countries but
             | them getting used after being bought elsewhere isn't
             | usually a big deal. India doesn't care about my Grandma
             | wearing her hearing aids because they're not approved in
             | India and if the government doesn't care where's the
             | incentive for Apple to break functionality for customers?
        
       | pomian wrote:
       | Looking forward to further write ups on faraday cages, design and
       | uses. That was great what you did with the air pods.
        
       | thel3l wrote:
       | Hey! I'm Rithwik, one of the authors of the article, happy to
       | answer questions etc!
        
         | carbonguy wrote:
         | Mainly just wanted to say, this is an absolutely fantastic hack
         | and I loved reading about it - thank you for sharing!
         | 
         | I guess if I have one question, it would be... what else are
         | you planning to do with your new Faraday cage?
        
           | thel3l wrote:
           | Thank you for reading and the kind words! We're almost
           | looking forward to this loophole being shut down to really
           | make things a tad bit more challenging haha
           | 
           | We've got some ideas for the Faraday cage--a whole bunch of
           | networks research and hacking that we can do without messing
           | up live systems! It's also really nice to be able to test a
           | device in isolation, without worrying about whether it's
           | phoning back home in some way.
        
             | ryandrake wrote:
             | > We're almost looking forward to this loophole being shut
             | down to really make things a tad bit more challenging haha
             | 
             | This is a great attitude in the face of a pretty sad 2024
             | reality: that the manufacturer of a device is expected to
             | intentionally go out of its way to remotely stop users from
             | using the device they bought in the way they want to use
             | it.
        
           | itsarnavb wrote:
           | I'm thinking of making it easy to "teleport" to any location
           | within the cage
           | 
           | Imagine typing in coordinates or picking a location on a map,
           | and then suddenly your phone or any other device is at that
           | location inside the cage, by a combination of GPS, cellular
           | and WiFi spoofing
           | 
           | My former manager called it a portal haha:
           | https://x.com/masadfrost/status/1856467695606345756
        
         | vintagedave wrote:
         | Awesome article. This kind of hacking casually showing iOS app
         | behavior is another world, especially because I thought they
         | were so locked down. How did you get started, any
         | recommendations?
         | 
         | Since you did not end up having bought yourself a very
         | expensive set of earphones, what earphones do you use -- or
         | want to get?
        
           | thel3l wrote:
           | haha, I think I've got many miles to go before I'm qualified
           | to answer this :')
           | 
           | I've just been hacking away at things since I was in middle
           | school, am lucky that there's some transfer. LLMs have also
           | been a huge unlock--really cool to be able to try things at
           | near speed of thought!
           | 
           | > what earphones do you use -- or want to get? I'm very happy
           | with my Shure Aonic 3s, a very loyal IEMs guy!
        
             | username135 wrote:
             | In the true spirit of 2600!
        
         | enjaydee wrote:
         | Maybe I missed it but did you make or buy the Faraday cage?
        
           | thel3l wrote:
           | We built it ourselves actually!
           | 
           | The first prototype was just aluminium foil, tape and hope,
           | but we wanted something more solid so we built one out of
           | ndeg100 copper mesh and some 2020 aluminium extrusions!
        
             | avidiax wrote:
             | You can use a microwave oven as a very cheap faraday cage.
             | Just don't turn it on.
        
               | staticfish wrote:
               | I assume he needed it to have a small opening in the cage
               | to shove the Raspberry Pi through it (to broadcast new
               | SSIDs)
        
               | wiml wrote:
               | The door of a microwave typically doesn't form an RF-
               | tight seal. Instead there's a groove that forms a
               | resonant trap at the microwave's operating frequency. So
               | it'll probably block 2.4-GHz ISM-band stuff like
               | Bluetooth (I don't actually know how wide the trap band
               | is compared to a BT or wifi channel), but outside that
               | band all bets are off.
        
               | NavinF wrote:
               | You are replying to the article author. He knows you can
               | use a microwave oven as a very cheap faraday cage. He
               | tried that, but it wasn't good enough.
        
         | tumblestick wrote:
         | Hi Rithwik -- great work. My Nana would have been thrilled to
         | know this was possible :)
         | 
         | If I can ask -- what program did you use to generate the code
         | maps in your article?
        
           | _rs wrote:
           | They look a lot like the graphs that Hopper produces :)
        
           | saagarjha wrote:
           | It's Binary Ninja: https://binary.ninja
        
           | thel3l wrote:
           | Binary Ninja: https://binary.ninja/ :)
           | 
           | Think someone has already linked it below!
        
         | JSR_FDED wrote:
         | Loved the article, thank you for sharing. How happy are the
         | grandparents with the hearing aid functionality? Is it working
         | well for them and how is the battery life?
        
           | thel3l wrote:
           | It's all too early to tell, but we'll know after a week or
           | so. The battery life thing is not seeming like a big problem,
           | since the existing device needs batteries changed every few
           | days or charged every night.
           | 
           | As for the sound quality, a few of our grandparents have
           | tried it, and while they say it sounds 'different', it's not
           | necessarily bad. Grandma was actually quite content even with
           | just the old EQ settings that shipped pre iOS 18 for folks
           | with hearing issues.
           | 
           | Thanks for the kind words!
        
             | dmcc365 wrote:
             | The hearing test on one of the images shows a 'profound
             | loss'. Does the hearing aid feature work for such a
             | significant loss, or does it disable for any result beyond
             | moderate loss?
        
         | gorbypark wrote:
         | I'm a bit perplexed about region handling, maybe you could shed
         | some light on it. I have an iPhone from Canada, with a Canadian
         | Apple account (Canadian CC/billing address, set location to
         | Canada in App Store), but live in Spain for the last few years.
         | I am still fully "Canadian" according to Apple. I don't get any
         | of the 3rd party App Store stuff that's region locked to the
         | EU, and have access to Apple Intelligence and other features
         | not available in the EU.
         | 
         | I can't give the hearing aid feature a test because it's not
         | available in either Canada or Spain, but I am wondering what
         | the difference is (if any) between the hearing aid region lock
         | and other geo-locked/geo-enabled features Apple has.
        
           | withinboredom wrote:
           | You can login with a second account that is an EU account, my
           | wife went this route. You get the best of both worlds.
           | 
           | I ended up transferring my account to an EU account (pro-tip,
           | you may be on the phone with Apple support for 6+ hours if
           | the automation fails). I still have access to both US-
           | specific features (like Apple Cash in USD and the feature in
           | this article) and EU-specific features (like the new app
           | store stuff).
        
         | dnh44 wrote:
         | That's a really awesome hack, thanks for sharing. I was
         | slightly surprised that you had to go as far as spoofing a wifi
         | network actually but it's great you figured it out.
        
       | kristofferR wrote:
       | Does anyone know what the Hearing Protection mode does? It's not
       | available in Norway (or anywhere outside of NAmerica).
       | 
       | I've used the AirPods Pro 2 as hearing protection for some stuff
       | before, it works fine. Is it just due to the words ("Hearing
       | Protection") which they are only allowed to use only in America
       | or is it actually better than regular Pro 2 noise-cancelling?
        
         | grahamj wrote:
         | I'm pretty sure all that's new is the hearing test app and
         | marketing. AirPods already had these features.
         | 
         | From listening to it work HP sounds to me like multiband
         | compression, in other words divide up the audible spectrum into
         | multiple bands and apply compression on each one individually.
         | Again it was already doing this though.
        
       | tzs wrote:
       | > Hearing aids typically cost anywhere from [?] 50,000 to upwards
       | of [?] 8L depending on the correction capability
       | 
       | For those who don't recognize the [?] symbol it is the symbol for
       | the Indian Rupee and an "L" after a number means 100,000, so [?]
       | 8L is [?] 800,000.
       | 
       | At current exchange rates that puts hearing aids in India from
       | $600 to upwards of $9,500.
       | 
       | AirPods Pro 2 are [?] 24,900 ($295).
        
         | hoistbypetard wrote:
         | Thanks for posting this. I recognized the currency symbol but
         | was confused by the "L".
        
           | JumpCrisscross wrote:
           | The Indian numbering system marks odd power of ten, _i.e._ 10
           | ^ {1, 3, 5, 7}. Unit, thousand, lakh, crore [1].
           | 
           | Ours, on the other hand, does it mod 3, _e.g._ 10 ^ {1, 3, 6,
           | 9}. Thousands, millions, billions, _et cetera_.
           | 
           | [1] https://en.m.wikipedia.org/wiki/Indian_numbering_system
        
             | eru wrote:
             | > Ours, on the other hand, does it mod 3, e.g. 10 ^ {1, 3,
             | 6, 9}. Thousands, millions, billions, et cetera.
             | 
             | To make matters more confusing, for American English it
             | goes millions, billions, trillions. For British English it
             | used to go millions, milliards, billions, billiards,
             | trillions, trilliards. (That 'long scale' is still the way
             | German used to work ten years ago. No clue if it changed in
             | the meantime.)
        
               | andreareina wrote:
               | I still mourn the long scale. A billion is obviously a
               | million millions.
        
               | SushiHippie wrote:
               | Thanks! In germany we use the long scale, and this is the
               | first time it clicks.
               | 
               | "Eine Billion" is Million2 bi -> 2 "Eine Billiarde" is
               | 1000 * Million2 "Eine Trillion" is million3 tri -> 3
               | "Eine Trilliarde" is 1000 * Million3 And so on
               | 
               | Yes I knew what a million, milliard, billion, billiarde
               | and so on are, but it never made click that the long
               | scale makes so much sense.
        
               | lotsofpulp wrote:
               | I feel like at that point, I would rather just use
               | scientific notation (10^x).
               | 
               | I also like the easy suffix for thousand (k), million
               | (M), billion (B), trillion (T), quadrillion (Q) for
               | written conversation. $10B revenue, 5k liters, 300M
               | people, etc.
        
               | s1artibartfast wrote:
               | It is less intuitive for me as an outsider that a
               | trillion would be a million million millions instead of a
               | billion billions
        
               | Lio wrote:
               | Haven't we given up on our scale in the UK to match the
               | US system?
               | 
               | i.e. the milliard was replaced with the US billion.
        
               | Lalabadie wrote:
               | Anecdotally, a milliard in French is a billion in
               | English.
        
         | greggsy wrote:
         | I'm not across the scope of hearing aid technology, but what
         | does the product at that upper tier actually look like, and how
         | much does it cost in another country?
         | 
         | I'm envisioning some highly specialised and tuned implant at
         | that price.
        
           | bayindirh wrote:
           | You generally get a custom mold for your ear canals and a
           | specially tuned DSP for your frequency curves + BT connection
           | to your phone for calls, at least. Your device can be retuned
           | over and over as long as it functions, too.
           | 
           | What drives the prices up is a multitude of factors: High end
           | DSPs, micro speakers which can do good sound reproduction at
           | required frequencies, relatively low sales volume, R&D
           | expenses and of course an insatiable appetite for profits.
           | 
           | These things always cost and arm and a leg in here, too.
        
             | TrickyRick wrote:
             | Not to mention that this is paid by insurance in many
             | countries which means there is little incentive for
             | individuals to shop around.
        
               | bayindirh wrote:
               | It might be, but in my country, you buy them for the most
               | occasions. I'm not aware if any insurance policy pays for
               | them, even.
        
       | userbinator wrote:
       | _It appears that the Hearing Aid feature is actually an equalizer
       | preset that is pushed to the AirPods and will replace your
       | transparency mode._
       | 
       | Apple could've just not marketed these as "hearing aids" or used
       | the medical terminology, as every other TWS with parametric EQ
       | and transparency mode can do the same thing, and they wouldn't
       | have the regulatory hawks going after them. They only lose the
       | marketing edge, but perhaps that was a huge calculated risk.
       | 
       | There's an incredible amount of processing power and flexibility
       | in these things. Even the sub-$10 ones using the infamous JieLi
       | SoCs - a 160MHz 32-bit computer in each ear. I'm surprised there
       | hasn't yet been any TWS advertised with open-source firmware,
       | although there's been some work in the usual Chinese (and
       | Russian) communities on customisations.
        
         | nfriedly wrote:
         | > _I 'm surprised there hasn't yet been any TWS advertised with
         | open-source firmware_
         | 
         | Let me introduce you to the PineBuds Pro:
         | https://pine64.com/product/pinebuds-pro-open-firmware-capabl...
        
           | userbinator wrote:
           | _User can flash in PINE64 community open firmware when
           | becomes[sic] available._
           | 
           | I did manage to find the firmware, but it says that it
           | doesn't have ANC, which the factory firmware does. Good start
           | nonetheless.
        
           | aftbit wrote:
           | >Excessive flashing Pinebuds can potentially brick the
           | device.
           | 
           | Jeez that's not great. Hard to develop on these devices when
           | too many flashes kills them.
        
             | userbinator wrote:
             | The flash on these SoCs is usually designed to be
             | programmed once at the factory, and then perhaps the
             | occasional firmware update. Endurance is in the ~100 cycles
             | range.
        
         | cheschire wrote:
         | They may have been trying to target the crowd that uses FSA/HSA
         | to pay for medical related expenses.
        
         | darreninthenet wrote:
         | But can you play Doom on them?
        
         | emmelaich wrote:
         | Is that the only concern? That's good because Apple probably
         | won't go and turn the feature off.
         | 
         | I was worried that there might have been some other regulatory
         | concern, perhaps to do with volume. Though I can't think what
         | that might be.
        
         | justinclift wrote:
         | For anyone else wondering, apparently "TWS" means "True
         | Wireless Stereo":
         | 
         | https://audiochamps.com/what-does-tws-mean/
         | 
         | So, Bluetooth.
        
           | notpushkin wrote:
           | Bluetooth headphones have many form factors. TWS in
           | particular means you have two buds that aren't joined in any
           | way.
        
             | userbinator wrote:
             | This is what a non-TWS Bluetooth earphone looks like:
             | 
             | https://5.imimg.com/data5/SELLER/Default/2023/5/311562137/U
             | E...
        
               | wongarsu wrote:
               | Or more commonly:
               | 
               | https://kagi.com/proxy/1462421?c=3_iinnNGr4mThI2-fwchjJtC
               | nBS...
        
         | makeitdouble wrote:
         | > They only lose the marketing edge
         | 
         | This is a bigger deal than it may sound. Apple isn't operating
         | in a vacuum, sony[0] and bose are also targeting the market and
         | they'll also probably do their marketing push as they see fit.
         | 
         | Apple only having a "kinda works as a hearing aid" is a
         | sizeable disadvantage when the other brands will have posters
         | in prominent places at sales points. Apple would still win on
         | online sales and people who don't need that much reliability of
         | course.
         | 
         | [0] https://electronics.sony.com/otc-hearing-aids
        
           | criddell wrote:
           | How do Sony or Bose have any kind of retail advantage? What
           | stores that sell Sony and Bose don't also sell Apple stuff?
           | Plus Apple has their own stores which make more money per
           | square foot than just about any other retailer.
        
             | talldayo wrote:
             | Sony has great audio codecs and doesn't treat my Linux
             | desktop as a second-class citizen. I have zero reason to
             | even consider Airpods as a serious alternative for as long
             | as they treat multipoint bluetooth as an optional feature.
             | 
             | Once you factor price into the equation, there's very
             | little reason for an educated customer to pick the Airpods
             | besides marketing. Apple doesn't give people a good reason
             | unless they already own thousands of dollars in other Apple
             | hardware.
        
             | hofo wrote:
             | Because they're about to sell their products as hearing
             | aids due to the recent OTC hearing aid regulation change.
        
           | mananaysiempre wrote:
           | Funnily enough, the company that bought out the consumer
           | audio division of Sennheiser some time ago is a manufacturer
           | of hearing aids. (No hearing aid features have manifested in
           | the Momentum True Wireless series thus far.)
        
         | grahamj wrote:
         | > every other TWS with parametric EQ and transparency mode can
         | do the same thing,
         | 
         | AirPods too! I'm am yet to be convinced that this is any
         | different than using a different hearing test app like Mimi and
         | applying the resulting audiogram, as has been possible for
         | years.
        
         | throawayonthe wrote:
         | the point is that they can do, in an FDA-approved manner a
         | hearing test + tuning the hearing aid + hearing protection all
         | in one device
         | 
         | and this means both that they don't have to use weasel legal
         | language to avoid "the regulatory hawks" AND that they gain a
         | huge air of legitimacy in their marketing as a medical device
        
         | rustcleaner wrote:
         | I own AAPL for that marketing edge! I bought more AAPL after
         | they announced locking down macOS to prevent third party
         | sourced applications from running, because Apple customers are
         | the kind who'll interpret such news as daddy protecting them
         | and looking out for babies' best interests, which means more
         | money going into the Apple tax to pay AAPL holders!
         | 
         | Fwiw I refuse to own Apple, I only own AAPL.
        
           | l33t7332273 wrote:
           | You do know you can still use macOS to run third party closed
           | source applications, right?
        
             | galad87 wrote:
             | An even unsigned x86_64 apps and ad-hoc signed arm64 apps.
        
       | myself248 wrote:
       | This is fantastic! We're building a walk-in-closet-sized Faraday
       | cage at i3Detroit, though of course we're in the US so we won't
       | need it for this specific hack, there's a zillion reasons it's
       | fun to have one!
       | 
       | Off the top of my head:
       | 
       | The biggie is that we're right down the street from WOMC's
       | transmitter, which is 135,000 watts EIRP. It gets into EVERYTHING
       | and makes other RF measurements more difficult, so if you're
       | trying to align an amplifier or something, it's nice to start
       | from a quiet place and get the basics solid, and only THEN add
       | sources of potential intermod and stuff.
       | 
       | Debugging wifi, bluetooth, and other wireless stuff without a
       | zillion other nodes in view. Yes you can filter the output of a
       | sniffer, but it's more fun to filter the input. ;)
       | 
       | Lighting up a 1G or 2G cellular network without worrying about
       | spectrum licensing.
       | 
       | Practicing offensive wifi techniques or other stuff that might
       | interfere with the hackerspace's existing network.
       | 
       | Playing with GPS spoofers in an FCC-free zone. Or anything else
       | you might find amusing but want to do responsibly.
       | 
       | Locking an iPhone in there to see if it reboots itself... (rofl)
        
         | thel3l wrote:
         | Yes!!
         | 
         | Shocked we made it this far in life without one! Itching to put
         | devices inside and light the air inside up without worrying
         | about licensing!
         | 
         | We actually ended up seeing a life size Faraday cage at Indian
         | Institute of Science--felt good to see that the construction
         | was similar to our approach
        
       | rkagerer wrote:
       | Is the hearing aid feature unavailable if you use the AirPods
       | with an Android?
        
         | jijji wrote:
         | I'm not a genius but it seems pretty trivial to take the input
         | from a microphone and pipe it to the output of a speaker, the
         | hardest part probably is the device drivers for the airpods (or
         | any bluetooth ear buds for that matter). It looks like others
         | have already done this in hardware [0] for $84.99 on
         | amazon.com. There is also "Sound Amplifier" app for Apple
         | iPhone [1] that amplifies the surrounding voice near the phone.
         | 
         | [0] https://www.amazon.com/Hearing-Seniors-Rechargeable-
         | Bluetoot...
         | 
         | [1] https://apps.apple.com/us/app/sound-amplifier/id1615079093
        
           | ilt wrote:
           | It's really not that simple. AirPods settings where you can
           | tune audio for vocal range, balanced tone, brightness or your
           | audiogram - which does much more fine tuning to the sounds
           | you hear than just amplification.
        
           | grahamj wrote:
           | It sounds like they also do multiband compression (hearing
           | protection) and multiband transparency/cancelling mixing
           | (adaptive mode) on top of applying EQ (audiogram support) and
           | things like accelerometer and wideband tracking for spatial
           | audio.
           | 
           | There's quite a bit of processing going on on-device.
        
         | geku3 wrote:
         | You need to set it up using Apple device, then it works with
         | Android.
        
       | RobMurray wrote:
       | Is this actually different from the custom transparency mode in
       | accessibility / headphone accommodations that existed before they
       | even announced the hearing aid feature? It can use an audiogram
       | stored in the health app. sounds pretty terrible with custom
       | transparency mode though, a bit like a comb filter.
        
         | ilt wrote:
         | Exactly. I don't think it's different. I have been its user
         | since March.
        
       | sagz wrote:
       | Can this be used to get EU specific features too? (AltStore and
       | such)
        
         | nsokolsky wrote:
         | Don't see any reason why it wouldn't work. I suspect you don't
         | even need a microwave in most places.
        
         | thel3l wrote:
         | Probably would work, however I suspect the changes would not be
         | as sticky.
         | 
         | Apple has some slightly more complex checks that they have used
         | in the past to georestrict stuff like ECG, by using MCC/MNC
         | codes from your mobile network. I suspect that the alt stores
         | would be region locked and stop working outside the EU--but
         | that remains to be tested, and seems like a fun thing to
         | experiment with.
        
       | notpushkin wrote:
       | Certificate pinning should be pretty easy to solve in this
       | particular case: just get a proxy/VPN! The Faraday cage
       | shenanigans are pretty cool though.
        
         | nimih wrote:
         | You might need to explain how a VPN solves the certificate
         | pinning issue; the author is already modifying the phone's
         | HTTP/S traffic via a proxied network connection, and a VPN
         | doesn't (to my knowledge) allow you to forge valid HTTPS
         | responses using the pinned server certificate.
        
           | notpushkin wrote:
           | Sorry, should have clarified: _instead_ of faking the
           | response, you can connect to Apple's servers through a US
           | proxy. They will see you have a US IP address and return the
           | corresponding location code, all over properly signed HTTPS.
           | 
           | There are a few caveats (e.g. using a residential or mobile
           | proxy would look less suspicious, in case Apple looks out for
           | datacenter IP ranges), but I think it should work.
        
             | NavinF wrote:
             | He tried that. The phone knows its location using GPS and
             | wifi. Apple doesn't care about your IP
        
           | tim-- wrote:
           | You don't need to modify the HTTPS traffic. You get a VPS
           | that is in the US, and set the device up so that when it
           | requests the domain (gspe1-ssl.ls.apple.com) that the IP
           | address returned is not an Apple IP address, but the VPS IP.
           | 
           | The VPS simply forwards traffic on port 443 to
           | gspe1-ssl.ls.apple.com.
        
             | dmcc365 wrote:
             | Have you seen success with this method?
        
         | rty32 wrote:
         | Eh, how does using a VPN make it easier to MITM attack yourself
         | and modify the response of that GET request?
        
           | notpushkin wrote:
           | Sorry, should have made it more clear! Basically there's no
           | need to MITM at all here:
           | https://news.ycombinator.com/item?id=42122270
        
         | thel3l wrote:
         | That's exactly what we did in the end--used a commercial VPN
         | and provided internet to the device over the USB cable. Could
         | have probably used a Tailscale on a VPS somewhere too.
        
           | mkagenius wrote:
           | What he meant to say is, all your efforts were of no use,
           | just use VPN in the ipad and the location will change.
           | 
           | But I suppose, in this case Apple is deliberately using the
           | wifi signals, not relying on IP so "just use VPN" doesn't
           | work.
        
       | auspbro wrote:
       | awesome hacking...
        
       | jrockway wrote:
       | > Since WiFi and a microwave operate at the same frequency
       | (2.4GHz), we ran our leaky microwave at full power to block out
       | any persistent network signals in the air.
       | 
       | Incidentally, WiFi tries to intentionally avoid this
       | interference. Microwaves output no power during the zero crossing
       | of the AC line that's driving it, and in this interval, there is
       | no signal in the air to jam things. WiFi listens before sending
       | (so as to avoid stepping on other stations), and the microwave's
       | signal is enough to trigger this. (I forget if microwave ovens
       | are "half wave" and you get 1/120th of a second 60 times a
       | second, or if there is just a threshold near the zero crossing
       | where there isn't enough power to interfere.)
       | 
       | I would say it's likely that the microwave oven didn't really do
       | much here.
        
         | subarctic wrote:
         | Whatever the theoretical analysis tells you, I've been able to
         | reproduce a microwave interfering with a wifi signal with at
         | least one microwave and router. I've had other times where it
         | didn't have a noticeable effect though.
        
           | jrockway wrote:
           | The key to happiness in WiFi is that all the stations have to
           | "hear" each other, or the listen-before-talk algorithm can't
           | work and you end up stepping on valid transmissions that you
           | can't hear. This ruins it for the stations that are the
           | targets of that transmission but can also hear the first
           | station. This is why WiFi tends to degrade at longer ranges;
           | with a topology like <computer A> <---> <access point> <---->
           | <computer B>, both computers can hear the access point, but
           | can't hear each other. This means that they step on each
           | other when talking to the access point; when this happens,
           | the access point sees the sum of the two signals which is has
           | to discard as garbage. As a result, whenever you see
           | enterprise WiFi that actually works, you'll probably be able
           | to see a ton of access points covering a large room. This is
           | so that they can transmit at low power, causing devices in
           | the above topology to roam to a different access point before
           | they enter the failure mode of not hearing other stations
           | connected to that access point.
           | 
           | Now that I think about it, in OP's case, it's quite possible
           | that the iPad can "hear" the microwave, but the access point
           | can't, so the access point will send out its SSID broadcast
           | while the microwave is interfering. This is great because you
           | WANT that packet to get corrupted. So maybe the microwave
           | does help!
        
             | withinboredom wrote:
             | You'll also see this in wireshark as retransmissions of
             | packets. It's really great for discovering that a service
             | you've written isn't filling packets and can only get
             | 50-ish bps throughput due to head-of-line blocking and
             | sending lots of tiny packets.
        
             | shagie wrote:
             | > As a result, whenever you see enterprise WiFi that
             | actually works, you'll probably be able to see a ton of
             | access points covering a large room.
             | 
             | IETF attendees reengineer their hotel's Wi-Fi network -
             | https://www.computerworld.com/article/1448494/ietf-
             | attendees... ( https://news.ycombinator.com/item?id=3771876
             | 31 comments)
             | 
             | > "There was no WiFi signal when on the desk in front of
             | the window in my room, but after some experiments, I
             | discovered that the signal was quite good... on the ceiling
             | of the bathroom," emailed Marc Petit-Huguenin.
             | 
             | > "I have a Nexus S phone, so I taped it on the ceiling of
             | the bathroom, and used tethering over Bluetooth to bridge
             | the gap to the desk," he explained. This is a slow
             | connection, but good enough to send emails over SMTP or use
             | vi [the popular Unix text editor] over SSH."
             | 
             | > ... Working behind the scenes, a team of IETF attendees
             | negotiated with the hotel and were granted access to the
             | wireless network by Sunday night. ...
             | 
             | > The changes made by the IETF makeover team included:
             | 
             | > - Decreasing the AP receiver sensitivity ([changing]
             | HP/Colubris configuration "distance" from "large" to
             | "small");
             | 
             | > - Increasing the minimum data and multicast rate from
             | 1Mbps to 2Mbps;
             | 
             | > - Decreasing the transmit power from 20dBm to 10dBm;
             | 
             | > - And, turning off the radios on numerous APs to reduce
             | the [RF] noise.
             | 
             | > ...
             | 
             | > Each floor now has approximately two access points on
             | each of these four channels, with the channels staggered on
             | adjacent floor. That design maximizes the distance between
             | access points on the same channel. "I hope this will
             | significantly improve the coverage in some rooms that had
             | marginal or no signal while also improving the signal to
             | noise ratio for all," he said
             | 
             | ----
             | 
             | Note that the changes were being made to _decrease_ the
             | power being used.
        
           | xanderlewis wrote:
           | I've had a microwave oven interfere quite clearly (correlated
           | with turning it on and off) with my AirPods before.
        
         | rollulus wrote:
         | > Microwaves output no power during the zero crossing of the AC
         | line Why is this? Do microwaves by design modulate their 2.4gHz
         | on top of 50/60Hz?
        
           | RF_Savage wrote:
           | The magnetron needs about -4.4kV to work and food does not
           | care about the purity of the signal, only net energy
           | delivered.
           | 
           | So the transformer based microwave oven power supplies have a
           | 2.2kV transformer and then double that to 4.4kV for the
           | magnetron.
           | 
           | There is no filtering or smoothing, as those parts would cost
           | money and present a danger to the service technician.
           | 
           | So the voltage feeding the magnetron is not even sinusoidal.
        
             | jrockway wrote:
             | Yup, exactly. Compare the price of a PC power supply, which
             | outputs a very smooth constant voltage, to a microwave
             | oven. The microwave oven is cheaper, and uses all 1800W of
             | your circuit. A DC power supply that does that is much more
             | expensive.
             | 
             | It is truly amazing how cost-optimized microwave ovens are.
        
         | RobotToaster wrote:
         | So two leaky microwaves on different mains phases would block
         | (2.4ghz) wifi?
        
         | Etheryte wrote:
         | In theory, yes, but in practice microwaves messing with wifi is
         | such a well known phenomenon that there's an XKCD about this.
        
       | tanvach wrote:
       | Don't know if running the microwave does much, since there are
       | plenty of 5Ghz access points around too.
        
         | thel3l wrote:
         | 5GHz has quite low penetrating power, so for the most part our
         | issue was 2.4GHz.
        
       | eliasdaler wrote:
       | This showcases why free software is important. Geo-locking is a
       | such hostile practice which makes zero sense here.
       | 
       | If the software/firmware was free and open, you'd be able to
       | patch out/disable the geo-lock. But it probably wouldn't be there
       | in the first place...
        
         | pasc1878 wrote:
         | Yes it does make sense in the general case.
         | 
         | In the approved countries a regulatory body has had to approve
         | this as a medical aid. If medical aids etc did not have to be
         | approved then things that actually hurt and kill people could
         | be sold as medical aids.
         | 
         | The issue here is that this case appears to be a non damaging
         | aid and so it looks silly to ban it. But regulations have to
         | work otherwise they are of no use.
         | 
         | The issue here is either regulators in other countries are slow
         | or in the worst case Apple has not applied for approval.
        
           | afh1 wrote:
           | Thank God for regulators! How dangerous would life be
           | otherwise. How could we live without them?
        
           | immibis wrote:
           | Then you still have the issue of whole-system incentives.
           | With free software, there is no incentive to prevent
           | OpenHearingAids from working in France, since it's provided
           | at the user's own risk, and installed by the user themselves,
           | who don't have to ask permission to do so. But when a company
           | controls the process, that company is responsible for
           | everything.
           | 
           | It's somewhat similar in spirit to the end-to-end encryption
           | issue: government agencies can demand platforms hand over
           | copies of users' messages if they have them, but they can't
           | force platforms to have them, resulting in platforms going
           | out of their way to not have copies of users' messages. If a
           | platform went out of its way to not have control over the
           | software its users run (this describes most non-Apple general
           | computing platforms) then it can't be forced to regulate that
           | software. If it does, it can.
        
       | PeterStuer wrote:
       | Reminds me on how I setup laptops these days for geodisplaced vpn
       | enjoyment.
       | 
       | Have the laptop on the vpn even during OS install. Never run the
       | vpn client on the laptop. Never connect to any other network. Use
       | the target's localisation (language, kb, timezone) during
       | install. Have a dedicated browser with detailed location features
       | turned off for your target sites.
        
       | biosboiii wrote:
       | Does anyone know which decompilation tool produces these graphs,
       | as shown in the blog post?
        
         | biosboiii wrote:
         | Found it out myself, https://binary.ninja/
        
           | thel3l wrote:
           | Yep, sorry!
           | 
           | It is Binary Ninja
        
       | ryanmccullagh wrote:
       | I bought AirPods Pro this year and it has been disappointing
       | compared to the first gen non pro I had previously.
       | 
       | Somehow they fall out of my if i adjust my head down.
       | 
       | Battery life is good though
        
         | udp wrote:
         | I've found that aftermarket memory foam eartips work much
         | better than the stock ones for keeping them in my ears.
        
           | grahamj wrote:
           | Yep. I'm kind of shocked Apple doesn't offer these as they
           | must be a huge moneymaker.
        
           | astrange wrote:
           | SednaEarFit Crystal work best for me - they're sticky and
           | sound better than the foam ones.
        
       | trhway wrote:
       | >modern devices position you within cities by using a combination
       | of WiFi SSIDs + MAC addresses of routers and devices around you
       | as well as GPS to triangulate your location. This was also the
       | reason that our WiFi only iPad was able to display an accurate
       | location in apps even though it had neither GPS nor cellular.
       | 
       | can't wait for this to find its way into Tomahawk missiles as a
       | fallback for the jammed GPS environment
        
         | rtkwe wrote:
         | They can already perform accurate strikes without GPS with
         | terrain following and INS so not sure this would actually help
         | it that much.
        
       | shawa_a_a wrote:
       | A commenter on Reddit [1] pointed out that you can access the
       | hearing test feature directly by using a special URL:
       | x-apple-health://HearingAppPlugin.healthplugin/HearingTest
       | 
       | I wonder if there's a similar deep link to be found to enable
       | Hearing Aid mode?
       | 
       | 1:
       | https://www.reddit.com/r/AirpodsPro/comments/1gftyqo/is_the_...
        
         | thel3l wrote:
         | This was one of the rabbitholes I chased down, but didn't find
         | anything.
         | 
         | At some level, this was just the easier approach :)
         | 
         | I'm sure there's something though. Apple changed the URL
         | handler schemes for iOS 18, so a lot of old repos that
         | reference that don't work anymore.
        
       | supersing wrote:
       | Some Chinese users have discovered a more effective way to bypass
       | geo-locking, even on iPhones (some Apple Health features require
       | approval and can only be enabled on iPhone, not iPad).
       | 
       | TLDR, iPhones prioritize external GPS devices over internal ones.
       | All you need is a "fake" lightning or USB-C external GPS device
       | that tells your device where you want it to think it is.
       | 
       | Source: https://www.v2ex.com/t/1075937
        
         | thel3l wrote:
         | Yeah, Apple sometimes checks MCC/MNC on the cellular network as
         | well, for some reason they chose not to lock it down that way
         | here.
         | 
         | However, if they did lock it to require an iPhone, the way we
         | would activate would be by using our Faraday cage to spoof GPS
         | inside it, and maybe a spoofed base station.
        
       | kuon wrote:
       | How can the GET request be modified if it uses HTTPS? You can
       | spoof certificates on iOS devices with dev tools?
        
       ___________________________________________________________________
       (page generated 2024-11-13 23:01 UTC)