HN Explorer

Show HN: Forensic evidence of iOS mesh networking bypassing Airplane Mode (github.com)

8 points by TakeFlight007 ↗ HN
I found evidence of autonomous mesh networking on iOS during Airplane Mode. What am I missing?

Did forensic analysis on my iPhone during Airplane Mode isolation. Kernel stats show 2,657 packets transmitted and 84.5MB processed through mDNSResponder while interfaces report "inactive". Found a parallel utun2 tunnel bound to IDS framework that persists during isolation. Applied Shannon-Hartley theorem to verify the channel capacity supports this volume. Either I'm misunderstanding legitimate system behavior, or this is a covert channel. Reproducible steps and raw evidence included.

https://github.com/JGoyd/NeuralNet

4 comments

[ 3.9 ms ] story [ 21.2 ms ] thread
N_Lens
I'm left wondering what this covert mesh traffic is actually accomplishing, and whether it's actually controversial or whether the researcher came across a red herring (Perhaps background file transfer such as airdrop while in airplane mode, unlikely as that sounds?).
Teknomadix
LOL. Seems like the OP is confused and misreading normal macOS/iOS behavior as a conspiracy.

Interface stats are cumulative since boot (eg: not real-time), mDNSResponder traffic includes all historical Bonjour activity. utun tunnels are standard iCloud/VPN infrastructure. Shannon-Hartley math proves WiFi can move data, not that anything covert is happening.

lucasar
Maybe the culprit is the technology and nasty tricks backing the "Find my device" feature? iOS devices will share their location (and potentially other data) with other nearby devices using a mesh network with certain frequency, even in Airplane mode. Also if the iPhone/iPad is powered off using the "power off" feature, the device will still be findable.

This capability is one of the strong selling points for consumers. The modern, average thief will often toss away these devices and settle with the rest of the loot because of this.

Sounds like OP wasn't aware of this.