mstute

There is no need to brute force. We can build a rainbow table with valid phone numbers, which we can use to lookup a phone number hash in real time (about 50ms on a regular desktop machine). PoC available here: https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-...

It has been available since iOS 13/macOS 10.15

The reverse engineering was already done and everything is described our the paper (https://www.usenix.org/conference/usenixsecurity19). We just have not implemented it yet.

Yes, unless your AP and ad hoc networks are on the same channel, you need two Wi-Fi radios to support this. AWDL "solves" this problem by quickly switching between these channels and schedules frame transmissions when the radio is tuned to the correct channel so the operation is (almost) transparent for the user (obviously, you loose some airtime for channel switching and your average latency increases).

The degradation happens only when you explicitly start using a service (such as AirDrop) that uses AWDL. The AWDL interface becomes inactive once there is no more traffic on the interface. In the measurements, we show the performance when both infrastructure and AWDL traffic is present (i.e., the Wi-Fi radio needs to switch channels in between).

In fact one could argue that AWDL actually reduces "interference" because two neighboring devices can communicate directly and do not need to go an additional one-hop detour over an access point.