# SiriSpy - iOS bug allowed apps to eavesdrop on your conversations with Siri

Any app with Bluetooth permission could subscribe to AirPods' DoAP GATT service and record Siri/dictation audio without microphone permission; on macOS a mach service lacked entitlement checks.

- Payout: $29,500
- Severity: high
- Program: Apple
- Credited: Guilherme Rambo
- Disclosed: 2022-10-26
- CVE: CVE-2022-32946
- Write-up quality: 9/10
- Original: https://rambo.codes/posts/2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop
- Library page: https://bugbountylibrary.com/r/blog%3Arambo-codes-posts-2022-10-25-sirispy-ios-bug-allowed-apps-to-eavesdrop
- Tags: domain:desktop domain:mobile impact:data-leak impact:privesc kind:bounty platform:blog sev:high technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:info-disclosure

**Target:** AirPods DoAP BLE GATT service and BTLEServerAgent mach service
**Root cause:** The DoAP GATT service (9bd708d7-64c7-4e9f-9ded-f6b6c4551967) streamed unencrypted Opus audio to any BLE subscriber, and macOS BTLEServerAgent's com.apple.BTLEAudioController.xpc mach service lacked entitlement/TCC checks.
**Steps:**
1. Grant an app Bluetooth permission.
2. Connect to AirPods over BLE and discover service `9bd708d7-64c7-4e9f-9ded-f6b6c4551967` (DoAP).
3. Subscribe to its characteristics for notifications.
4. Trigger Siri or dictation on the AirPods; receive Opus-encoded audio frames.
5. Decode Opus packets to WAV to recover the user's speech.
6. On macOS, alternatively connect to mach service `com.apple.BTLEAudioController.xpc` exposed by BTLEServerAgent with no entitlement check to request DoAP audio on demand.
**How found:** While adding GATT notification subscription to his bleutil tool for AirBuddy development, the author noticed AirPods exposed a notifiable service; invoking Siri produced a stream of changing hex bytes, suggesting live audio. He then checked other Apple platforms and identified Opus as the codec from system components.
**Exploitation:** A malicious app with Bluetooth permission silently subscribes to DoAP notifications, decodes Opus audio to WAV in the background, and records Siri/dictation conversations with no microphone prompt and no Control Center indicator naming the app. On macOS the mach service allows on-demand audio without any permission.
**Escalation:** Chained the BLE GATT flaw with a missing entitlement check on the macOS BTLEServerAgent mach service to achieve a full TCC bypass requiring no permissions at all and enabling on-demand recording.
**Insight:** Vendor 'deny lists' of forbidden BLE GATT services are a real attack surface: enumerate all notifiable characteristics on a paired accessory and correlate byte streams with user actions to spot sensor/audio data leaking outside TCC. Also probe mach services exposed by system daemons for missing entitlement checks.