Apple AirTunes private key extracted

[PascalW]

Now that the AirTunes private key is known, it could allow for 3rd party software to act like AirTunes devices. If this for example would be implemented in XBMC, Plex, Boxee etc you could send audio from your IOS device straight to XBMC using IOS built-in Airplay support.

[daeken]

Hah, awesome. Many years ago, I patched iTunes to use my own public key, so I could stream to an AirTunes server I ran on another machine. I had intended to pull the firmware off the Airport Express, but didn't have the hardware skills at the time. It's awesome to see this happen.

[Timothee]

Could someone explain the implications of this?

edit: it looks like it would allow another software to show up as an Airport Express in iTunes, thus becoming the potential target of streaming audio over WiFi from iTunes. But am I right?

[illumin8]

The Airport Express public key was previously known, which allowed anyone to write a program to stream audio to an Apple Airport Express. Now that the private key is known, anyone can write a program to receive audio from iTunes, or from another program that sends to Airport Express.

This means you will be able to easily send audio to other rooms in your house with something like XBMC running on a PC, nettop, or netbook.

edit: Just to clarify - previously you could do this:

iTunes -- stream to --> Apple Airport Express

3rd party software -- stream to --> Apple Airport Express

Now you can do this:

iTunes -- stream to --> 3rd party software/hardware

[PascalW]

See my comment http://hackerne.ws/item?id=2431331

[jedsmith]

ASCII key, from the source: http://pastebin.com/raw.php?i=RFeUcdXd

[peterwwillis]

The whole source: http://pastebin.com/raw.php?i=mXVK93sY (edit: updated with 0.03)

[acgourley]

What are the legal implications of selling a small unit that acts as an airport express, then? And what if you didn't ship the key, but it was obvious to users where to get it?

[rhizome]

"Wink wink" has been long dealt with in law. If it's a device that is useless without the key, it'd wind up as a distinction without a difference if Apple really chased this down rather than hiring the devs. "Substantial non-infringing use" is the bar to clear in patent terms.

[eli]

I doubt you'd fare much better than running a P2P service that could be used for anything, but was obviously intended for copyright infringement. And that doesn't seem to be doing so hot for Limewire.

[angusgr]

I know the OP probably isn't reading this, but I'd be curious to know what OS the Airport Express runs.

I always wondered. My guess is maybe a proprietary RTOS to perform its simple functions?

Back in the day I figured it'd make a great OpenWRT Linux box, although now boxes with those features/size/price-point are much more common.

[angusgr]

I asked the OP and they responded to me offline and confirmed vxWorks.

[jolan]

The Acknowledgements.pdf file on the software CDROM says NetBSD.

[spicyj]

I think I read somewhere that it uses vxWorks.

[Logicwax]

Works great! Even supports multiple audio streams!

For Debian/Ubuntu users, I had to do a few things to get it to compile: 1. sudo apt-get install libcrypt-openssl-rsa-perl libao2 libao-dev 2. comment out line 642 in hairtunes.c 3. 'make'

[jameshl]

Fixed the code bug in 0.02, and added this to the documentation. Thanks!

[cultureulterior]

And libssl-dev for me on lucid

[Natsu]

I wonder if people will get their IPs subpoenaed for looking at that link, as was the case with the Sony keys?

[eli]

I'm pretty sure Sony's goal there was to gather information to support their argument that a California court is the right venue and generally to intimidate geohot. Not to sue anyone who merely viewed the page.

[WiseWeasel]

Meh, they can sue me. I don't think they'll get very far.

[yardie]

Sony was using IPs to establish jurisdiction because they have a fairly weak case. AFAIK, you can't be sued for reading/looking at something.

[conradev]

This is awesome! I know many have tried before, but have not been successful.

Also, I thought i would put this out there: As with the creation of the new AirPlay protocol, the RAOP (AirTunes) protocol was also changed (to support album art and other metadata, I assume). My proof of this lies in the Apple TV. If you analyze network traffic between iTunes and the ATV's airtunesd daemon, you can see that the initial pairing does not have the 'rsaaeskey' field but instead a 'fpaeskey' field. So instead of a RSA public/private scheme, it uses something else to encrypt the session keys. I found this out when trying to reverse the airtunesd binary, trying to get the key that way. :P

[shimonamit]

So, are there no alternatives to embedding a single private key across multiple hardware devices?

[fhars]

You could store the key in a TPM, which would at least require carefully applied stong acids and an electron microscope to dump them.

[palish]

The source code is very cool. I'd encourage everyone to skim through it.

[nitrogen]

The rate synchronization code is interesting. Is that what you were referring to?

[Simucal]

Could you provide a mirror? The link seems to be dead.

[illumin8]

This is very cool. Do you know if this would work with AirPlay video streaming as well as audio? I can imagine it would be pretty cool to display video on any PC monitor.

[Timothee]

Is AirPlay encrypting streams though? There are a few apps that can playback AirPlay videos. Recently, I started to use a script that made Plex show up as an AirPlay target and it worked fine.

edit: NB: I'm not sure "encrypting" is the right word here… do not hesitate to correct me

[blasdel]

A couple years ago I unsuccessfully tried to extract the keys from the AppleTV version of OS X (which provides the same functionality).

The binaries were heavily obfuscated, and I couldn't get the IDA Pro remote to run on the AppleTV, nor could I port the binaries to run on normal OS X. Gave up after a week or so. I figured that some pro reverser would get the keys eventually that way, but I never expected that anyone would find success cracking open an Airport Express!

[_3ex7]

cool story bro

[sh1mmer]

There have been a number of manufacturers implementing 'airplay' devices that support being airtunes speakers but it's great to see this making it possible to do with open source. It would be nice to see airtunes added to some of the cheap linux wall warts on the market.

[albertzeyer]

Has someone tried it and was able to play something?

I tried it and iTunes lists it as a device but I cannot activate it in iTunes (if I select it, it immediately unselects itself). From the console output, I see that iTunes even does not try to connect to it (to TCP Port 5000).

I am currently on a Mac so I needed to do some porting (https://github.com/albertz/shairport/) but I think this shouldn't have an impact on the behavior I am getting.

[rjyo]

I got the same result at first. But after trying to play from my iPod touch, it worked.

I guess running the server and iTunes client on the same machine caused the problem.

My config: MBP on 10.6.7

And thank you for your dns-sd patch on https://github.com/albertz/shairport/

[askedrelic]

Sweet, thanks for your port! I just got everything working on my iMac. It shows up as an AirSpeaker from my iPhone on the same network and I can stream music from the iPhone to my iMac!

[albertzeyer]

With 0.03 and some further fixes, it also works on localhost now.

[snotrockets]

Author states this is broken on a Mac.

[cultureulterior]

If you disable the IPv6 address on the linux server it works.

[rafd]

Works great! Many thanks for the port.

[coffeedrinker]

For those who might not know this, you can stream the audio from one mac to another.

http://www.macgeekery.com/tips/configuration/playing_live_au...

I use it to move music streams to the other computers in the house.

[joeshaw]

Does Apple use the same protocol for streaming video to an Apple TV? If so, is the key from an Apple TV needed to emulate a video endpoint, or is just some tweaking required (presumably to the MDNS service data) to identify it as video-enabled?

[lloeki]

Video is seemingly not encrypted, only pure audio streams required the key. See Airplayer (http://ericasadun.com/ftp/AirPlay/) and apparently Airfoil Video Player (http://www.rogueamoeba.com/airfoil/mac/) for example.

[andrewcooke]

wasn't this done before, years ago, by Jon Lech Johansen? he wrote justeport - http://nanocr.eu/software/justeport/ (and i rewrote that in java as jjuste, but no longer have the code...)

here are the keys he found - http://nanocr.eu/2004/08/11/reversing-airtunes/ and http://nanocr.eu/sw/justeport/itunesrsakeys.txt

[peapicker]

Johansen found the public keys to allow you to stream music to an Airport Express... now we are talking about the private key, which lets you emulate an Airport Express with any hardware that is capable.

[tobiasbischoff]

Totally want to try this, but my Snow Leopard won't install Crypt::OpenSSL::RSA via cpan, any ideas? http://pastie.org/1783565

[gresrun]

Try this:

ARCHFLAGS="-arch i386 -arch x86_64" perl -MCPAN -e 'install Crypt::OpenSSL::RSA'

[kblnig]

i am trying to use the hairport (on apple tv1 running ubuntu hardy)... i am getting the following error:

atv@appletv-ubuntu:~/scripts/bbhoss-shairport-31cf954$ make gcc hairtunes.c alac.c -D__i386 -lm `pkg-config --cflags --libs ao openssl` -o hairtunes hairtunes.c: In function âinit_outputâ: hairtunes.c:642: error: âao_sample_formatâ has no member named âmatrixâ

Could someone help me with this matter :) ?

[kash]

awesome!, now only if we can get forked-daapd to show up under home sharing we'd be set!