Skip to content
Naked Security Naked Security

Woman targeted with 120 images on public transport via AirDrop

Bluejacking is back, this time via Apple's AirDrop technology, allowing strangers to bombard women with unwanted photos

On pretty much any given day, you’d rather spend your morning on the subway reading the newspaper, drinking your coffee, or catching up on Instagram than have photos of a stranger’s genitals up on your iPhone.

Unfortunately, the return of an ancient fad known as bluejacking has meant that the air in subway cars has increasingly been polluted by unwanted intimate pictures.

As you may or may not recall, bluejacking first popped up in 2003. It allowed pranksters to exploit mobile phones’ Bluetooth technology, which lets devices communicate with each other up to a range of about 30 feet. When Bluetooth is activated, it automatically seeks out other Bluetooth devices in the vicinity, and that lets people send anonymous messages – or, say, pictures of their junk, as goes the modern rendition – to each other.

As Sophos technical support reported many moons ago, getting anonymous messages panicked some users into thinking they might be under attack from a mobile phone virus.

That’s exactly what bluejackers were after: that shocked look on a recipient’s face as they blasted out unexpected junk.

Ironically enough, the idea for bluejacking was originally that of a woman, and the first victim was a man, though there are other origin stories about it having been first carried out by a Malaysian IT consultant who used his phone to advertise Sony Ericsson. At any rate, as the BBC tells it, a woman going by the name of Ellie had said that the “priceless” expression on the face of her first victim as he tried to work out what was going on had turned her into a regular bluejacker.

She reportedly put up a tutorial on a message board that, back then, was a favorite among owners of SonyEricsson phones, explaining that …

[The victim’s expression], mixed with not knowing whether the victim will react in an amused/confused or negative way gives me an adrenaline rush.

Fourteen years after adrenaline junkies were getting high on bluejacking, we now have AirDrop: an iPhone file-sharing app that enables users to send photos, videos and documents instantly over a wireless connection.

Nowadays, many people have AirDrop enabled. They’ll turn it on to use it once, then they’ll forget to turn it off. That means there are plenty of phones that are beaming out come-hither signs over the airwaves, and there are plenty of perverts ready to freely spew their pixels on to them.

And that’s exactly what’s happening. The reference to 120 penis portraits wasn’t an exaggeration: Sophie Gallagher, a writer for Huffington Post UK, on Tuesday posted a story about having been cyber-flashed with a flock of more than 100 down-the-pants images via AirDrop while traveling on the London Underground.

That’s 120 images, to be exact, she later reported in a post that took people to task for blaming the victim.

“Stop telling me to turn my AirDrop off,” she said, in spite of the fact that, well, shutting your Wi-Fi up would in fact stop the weiner parade:

Yes, turning it off stops me from receiving the pictures, it makes it harder for the perverts to contact you when you have the nerve to leave the house in the morning.

But it doesn’t stop the offender from sending them to someone else, from believing that they can hide behind their phone screen and cause harm and distress to unsuspecting people around them.

And quite honestly it is insulting to men to suggest that the only way they can resist making sex offenders of themselves is to block their methods of communication.

Insulting? Well, it might be more like “pragmatic”. Dr Justin Lehmiller, a Harvard University psychology professor, has suggested (in the absence of much research on the topic) that the (extremely) common phenomenon of sending unwanted penis pictures to women could be attributed to cognitive biases that have evolved to help with reproduction.

I suspect that the most likely explanation is that men are simply misperceiving women’s interest in receiving photos of their junk. There’s a large body of research indicating that men aren’t very good at determining how interested women are in sex.

In fact, research has shown that men often mistake friendliness for flirting. Basically, women have to club them with eggplants – did you know that the eggplant emoji is a stand-in for “penis?” – to get across the idea that they don’t want to get a closeup of their zucchinis.

How should one react when one receives images of a stranger’s floppy flesh? It’s advisable to report the matter to police. As the HuffPo has reported, few women do so, and London police, at least, seem to think that there’s no epidemic going on. (New York police seem to know better.)

It’s well worth reporting incidents to the police, both to get them up to speed with the frequency of unsolicited photos and to get the senders caught.

Because yes, it’s a crime. In England, sending indecent images is classified under section 66 of the Sexual Offences Act (2003), given that it’s the same as exposing genitals and intending that the recipient “see them and be caused alarm or distress”. The penalty for breaking the law is a prison term of up to two years.

Detective chief inspector Kate Forsyth from the British Transport Police told HuffPost UK:

My message to offenders is clear, while you might think you can hide behind modern technology in order to carry out abuse, you leave a digital footprint and stand a very good chance of being caught, arrested and ending up on the sex offenders’ register.

And that might be a lot of offenders finding their way on to the register: a survey of more than 5,500 American singles found last year that 53% of the women they asked had been on the unwilling receiving end of an unsolicited picture. People, just don’t send photos of your junk to someone else unless you know it will be welcome – and by “know it will be welcome”, we mean “that you’ve got explicit consent to send”.


21 Comments

I can see marketing managers out there trembling with anticipation, thinking they can put Bluetooth devices everywhere that will push adds to everyone that leaves the option on….
But, does this work on iphones? seeing how I can’t upload files to it even when connected directly to my PC :/

Yes, AirDrop is an Apple feature. We’ve got more on this from a couple of years ago, including some suggestions on what to do and how to get to the relevant iPhone settings menus:

https://nakedsecurity.sophos.com/2015/08/14/how-not-to-be-cyberflashed-on-your-iphone/

It’s not insulting to me that Ms. Gallagher would block communication. In fact, it seems like common sense that she should block any communication that she is not actively using. It’s a little insulting that she seems to be generalizing all men from her experience.

It’s also not victim blaming. If you say I don’t like this and I tell you how to prevent it from happening it doesn’t mean that I blame you as the cause.

+1.

You shouldn’t have to lock your bike (with a really decent lock, too) every time you want to leave it unattended for a few minutes outside a shop. You shouldn’t have to slow your bicycle to a crawl every time you pass a pedestrian on the footway (sidewalk) in Oxford, just in case they step out into the road without looking to get a cool angle for a selfie of themselves in front of a famous building. You shouldn’t have to instruct people not to send you spam because they’ve added you to their mailing lists and started sending you their electronic dross without permission.

Anyway, as you say, unless you actively want to receive AirDrops from “everyone”, good security practice says not to turn that feature on – it’s always worth reducing your attack surface area, whether the potential attack is by malware, hackers or a creepy cyberstalker.

“It’s also not victim blaming. If you say I don’t like this and I tell you how to prevent it from happening it doesn’t mean that I blame you as the cause.” Add another +1
It’s not blaming the victim to give good advice to protect yourself. Is recommending SOPHOS antivirus blaming the victim of a computer virus? No.

She’s absolutely right…
It’s a shame that we are telling women to walk around with blindfolds on because there are too many flashers on the underground. It’s time to call these “Cyber” offences what they are.
Hackers who steal are muggers and thieves, these “Cyber flashers” are sex offenders.

This article mentions AirDrop is need for NFC payments. It’s not.

But I still don’t really understand the issue. First off, AirDrop can be set to accept connections only from people in your Contacts list. That seems like a reasonable compromise. If you need to accept something from someone you don’t know too well they won’t know who you are either so there will be a dialog. At that point it’s a quick press of a finger to temporarily turn AirDrop on for everyone or to add the person to your contacts. Further, AirDrop doesn’t just save a picture onto your device — it asks you to accept the picture first.

One issue with AirDrop – last time we wrote about it, anyway…

https://nakedsecurity.sophos.com/2015/08/14/how-not-to-be-cyberflashed-on-your-iphone/

…is the workflow.

The dialog where you choose [Accept] or [Decline] is there so that crooks can’t upload just anything to your phone without permission. So far so good, but when the upload is a photo, it shows you a thumbnail to help you decide. In other words, you have to, ahem, be confronted by the image (albeit at a smaller size than normal) to decide that you do not want to by confronted by it. And once you’ve seen it, you can’t unsee it.

Having said that, it’s IMO a bad idea to have AirDrop set to “Everyone”, not just because of bellendery, but because it’s easy to make the wrong choice by mistake. (The AirDrop prompt doesn’t come up syncronhously, while you are already knowingly in the AirDrop app – it pops up asyncronhously, at a moment determined by the sender, much like a phone call. And we’ve all hit [Answer] when we meant to [Reject] :-)

I think adults should not freak out over every little thing that bothers them because of their conservitive upbringing.

I just had a look at my phone and it seems by default only my contacts can airdrop me things.
Am I correct in assuming that these Victims have gone and opened that to say everyone can airdrop things to me?

If that is the case it is like having an anonymous FTP server open on the net and complaining when it fills up with junk.

I can’t recall the default, but it’s not unusual for someone to switch to “Everyone” for a moment, just to get one file from an acquaintance or colleague who isn’t already a contact. There’s nothing much wrong with doing that if the person is next to you and you know they are sending you a file.

Easy to forget to turn it off afterwards, though.

An AirDrop option to “shut off automatically after N minutes” (or to “autodisable when phone next locks”) would be handy IMO.

Blaming “biology” for sexualising harassment is getting a bit old. There’s a big difference between “oh hey she looked at me she might be keen” and a bombardment of cock pics.

Most children can grasp that, grown men have no excuse and I agree that women shouldn’t have to cripple their digital connections because some men are idiots.

Some of the comments on the recent articles like this are quite disturbing.

Woman has private intimate photos stolen or otherwise shared without her consent? It’s her fault for allowing them to be taken in the first place.

Woman gets “upskirted” by a pervert? It’s her fault for not dressing like a nun.

Man deliberately takes photo of his junk and broadcasts it to random women? It’s her fault for not blocking every possible means of communication.

What’s next? Blame the woman who gets “flashed” by a pervert for not being blind? Blame the woman who gets raped on a night out for not being teetotal, or for wearing nice clothes?

But I forgot: it’s not victim blaming, it’s just “common sense”. Because the only way us men can avoid being massive perverts is for women to stop “tempting” us by being female in public.

Oh, and throw in a quick “not all men” comment, so we can dismiss the problem and move on.

Which of the comments on this article said that this issue “is her fault for not blocking every possible means of communication”?

(I don’t own a car but I hire vehicles for a day or two several times a year. Every one I’ve had since about 2013 has come with automatic central locking, where the car locks all the doors for me a few seconds after I drive off. Do you think that Hyundai, Peugeot, Volvo, Ford, Toyota, Fiat and more are all trying to tell me that carjacking is somehow my fault because they protect me from it? )

I am one of the people who recommend not using AirDrop in “Everyone” mode and I am pretty uncomfortable with the implication that my comments, amongst others, might be seen as “quite disturbing” for that reason…

I’m sure it is a good idea to change the settings from their defaults. But failing to do so is *not* the cause of women being harassed by perverts. There’s only one thing that causes that: perverts.

Nobody would suggest that the police should ignore car-jackers because cars come with decent security kit these days. But a lot of people do seem to think that men bombarding women with pictures of their genitals isn’t a *real* problem, because the women can just change the settings on their phones.

There’s a fine line between giving advice to avoid harassment, and dismissing the harassment of people who haven’t followed your advice.

Here , in year 2020, Google is trying to release same feature on Android.
[URL removed]

Comments are closed.

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?