Is AirDrop secure? What you need to know before using it

AirDrop is a useful tool for transferring files that’s built into most Apple devices, but it can also open you up to certain threats. Though there are protective measures in place, AirDrop could be used to infect your device with malware or lead to the exposure of your personal information.

Given the very real security concerns, it’s wise to familiarize yourself with the risks and best practices. By the end of this article, you’ll know what AirDrop is, how it works, and how to stay safe.

What is AirDrop?

AirDrop is Apple’s wireless file-sharing feature. It allows users to quickly send any type of file to nearby devices, all without using a cloud service or additional physical hardware.

Tied to your device and Apple ID, AirDrop is available on iPhones, iPads, and Mac computers.

What can you use AirDrop for?

AirDrop can be used to share all kinds of information. Here are some examples:

• Photos and videos: Send entire albums or single clips instantly, without any compression or loss of quality.
• Documents and PDFs: Transfer important documents such as work files, contracts, or any other documents.
• Notes and text files: Share reminders, drafts, or other written messages.
• Contact cards: Swap full address book entries without typing out all the details.
• Website and app links: Send links to websites or apps to those nearby.
• Map locations: Share pins or locations from Apple Maps.

How does AirDrop work?

AirDrop creates a secure, peer-to-peer connection between Apple devices using Bluetooth and Wi-Fi. First, Bluetooth scans for nearby devices and establishes an initial handshake. Next, the devices create a temporary, encrypted connection known as Apple Wireless Direct Link (AWDL). This allows your phone to send files directly to another device without using external networks or additional hardware.

Because it uses Bluetooth, AirDrop only works over short distances, typically around 30 feet (9 meters). The process is generally secure in that it uses encryption and can’t be easily exploited by someone wanting to gain control of your device.

How to send and receive files with AirDrop

Using AirDrop is quite simple. To start, both the sender and the recipient need to enable AirDrop in their device’s settings. They must be signed into their Apple ID and need to be within Bluetooth range. Finally, both devices need Wi-Fi and Bluetooth turned on, but personal hotspots turned off.

To send a file:

1. Open the photo, file, link, or other data you want to share.
2. Tap Share.
   
3. Choose AirDrop.
   
4. Find and select the recipient. Tap Send.
   

To receive a file:

1. A pop-up will appear showing the sender and information about what is being sent.
2. Tap Accept to save or Decline to ignore.

Is AirDrop safe to use?

The technology behind AirDrop is generally safe, but avoiding potential dangers requires you to manage your settings appropriately and exercise a degree of caution. Temporarily leaving AirDrop open to everyone allows anyone to send you any file they want. This can result in offensive or harmful files being sent to your phone.

When you AirDrop a file to someone or receive one yourself, a direct link is created between the two devices. This provides peer-to-peer encryption to files as they’re in transit. There isn't any easy way for the other person or a third party to exploit the connection to gain control of your device or steal your data.

Can you get hacked through AirDrop?

Direct hacking through AirDrop is rare but theoretically possible. In the past, iOS vulnerabilities allowed attackers within Bluetooth range to exploit AirDrop and install malicious software onto someone's device. This software would grant the attacker unauthorized access.

Somewhat less seriously, there have also been reports of metadata leaks due to AirDrop use. This included victims’ Apple IDs and phone numbers. This data was only harvested in an obfuscated form but could still theoretically have resulted in security incidents.

Apple has since patched these flaws and made it significantly harder to AirDrop malicious files. That said, the risk still exists, highlighting why you need to protect your Apple devices.

Common security risks of AirDrop

AirDrop is generally safe, but it’s not without risks. Here are the most common threats associated with AirDrop:

Phishing attempts

Phishing attempts are likely the most common threat delivered via AirDrop. These involve an attacker sending links to websites designed to steal your personal information or assets.

A common form involves a cybercriminal claiming that the target has won free crypto. If the victim clicks the link and goes on to connect their wallet, the attacker will be able to steal their funds.

AirDrop phishing scams rely on social engineering to trick victims. Be wary of any unsolicited AirDrops containing links, particularly those that promise some kind of reward or demand that you take immediate action.

Malware transfers

AirDrop can be used to distribute malware, especially disguised payloads like infected PDFs, rogue app installers, and .exe applications. While it’s rare for a direct attack to happen, you should be just as cautious about unexpected files as about links.

Malware delivered by AirDrop can take several forms, including cryptojackers and fake scareware alerts designed to trick you into downloading fake cybersecurity software. Though unlikely, it’s even possible that an AirDrop file request could be the first step in a chain that leads to an attacker mirroring your iPhone.

While Apple’s built-in security is good enough to prevent most harmful software from auto-installing, you can still manually install malware by opening an AirDrop.

Personal data exposure

Accepting files from unknown sources could inadvertently result in you leaking your data. Some files, like contact cards or shared documents, might trigger system processes that reveal more than intended or contain spyware that continues to monitor you long after accepting the file.

In any case, you might also share a seemingly innocuous link or file that contains sensitive metadata about you without your knowledge. There’s also the simple risk of accidentally sharing something with the wrong person.

Finally, new exploits or vulnerabilities could be found that might enable threat actors to collect metadata or other personal information by connecting via the AirDrop feature.

How to use AirDrop safely

AirDrop is convenient, but using it improperly can present several security risks. Luckily, there are some fairly easy steps you can take to mitigate the danger.

Adjusting your AirDrop settings for maximum security

To minimize your risk of being targeted through the AirDrop feature, you’ll want to know how to alter your discovery settings and potentially change your device’s name. Here’s how:

Change your AirDrop settings to Contacts Only or turn it off

On your iPhone or iPad:

1. Go to Settings and open General.
   
2. Tap AirDrop.
   
3. Choose Contacts Only so only people in your address book can find you, or pick Receiving Off to block all new requests.
   

On a Mac:

1. Open Finder and select AirDrop from the sidebar.
   
2. In the bottom of the window, click Allow me to be discovered by.
   
3. Choose either Contacts Only or No One.
   

Use Control Center for quick toggling

1. Swipe down from the top-right of your screen, or up on older devices.
   
2. Long-press the network block, then tap AirDrop.
   
3. Switch to Contacts Only or Receiving Off.
   

Change your device name

A generic or anonymized device name will potentially prevent people nearby from harvesting your data or targeting you. Using something like “My iPhone” is one option, or you can choose something else that your friends will still be able to identify.

Here’s how you can change your device’s name:

1. Go to Settings and open General.
   
2. Choose About.
   
3. Find the Name option.
   
4. Change your name to something generic that cannot be linked back to you.
   

Disable AirDrop entirely with Screen Time

You can also completely turn AirDrop off to avoid any possible threat.

1. Open Settings and tap Screen Time.
   
2. Choose Content & Privacy Restrictions.
   
3. Toggle Content & Privacy Restrictions on.
   
4. Open your Allowed Apps & Features.
   
5. Find and then turn off AirDrop. This stops it from being re-enabled without your passcode.

Who can see your device? Understanding visibility options

AirDrop’s discoverability settings control who can find and send files to your device. If set to Everyone, any compatible device within Bluetooth range can detect yours and try to send you files. To reduce the risk of misuse, Apple has made it so this setting only lasts for 10 minutes before reverting to Contacts Only.

When set to Contacts Only, your device will only be discoverable to people saved as contacts in your iCloud. This is the default setting for AirDrop and helps limit your exposure to harmful content and spam. There is a small risk that someone could compromise a friend’s account or spoof their information to send you malicious files, but the attacker would still need to be nearby.

Turning AirDrop off hides your device completely, preventing any potential incoming threat or annoyance. Remember that AirDrop doesn’t rely on the internet, so even if you have no cell service and aren’t connected to a network, someone nearby can still find you if AirDrop is enabled.

For maximum security, you should keep AirDrop turned off and only briefly enable it when you need to send or receive something.

Best practices for safe file sharing

When file sharing, you should keep the following principles in mind:

• Keep your software up-to-date: New iOS and macOS updates patch security vulnerabilities that could let attackers exploit AirDrop and send disguised malicious files. Make sure automatic updates are enabled so you’re always protected.
• Set AirDrop to Contacts Only or Off: Restricting AirDrop to “Contacts Only” ensures only people in your address book can see your device. When you’re out in public or don’t plan on sharing anything, switch to “Receiving Off” to stay hidden.
• Always confirm the sender: Before accepting a file, double-check the sender’s name. If you weren’t expecting anything from that person or don’t know them, decline the request. Due to the limits of Bluetooth, the sender should be nearby, so it’s a good practice to ask them directly.
• Be cautious with unknown files: Avoid opening files with unexpected types, like .zip, .exe, or unfamiliar app installers. These can harbor malware. If you’re not sure what someone has sent or why, don’t open it.
• Use a strong device passcode: Use a complex password, hard-to-guess PIN, or biometric lock (like Face ID) to prevent unauthorized access to your device. This can also prevent someone from making changes to your security settings that might make you more vulnerable to future attacks.
• Manage your privacy settings: In addition to AirDrop-specific settings, you can follow this simple guide to optimize your Apple security.

How to stop getting random AirDrop requests

If you’re getting random AirDrop requests, it’s because your device is discoverable by everyone nearby. To fix this problem, you’ll need to change your settings.

Why do you receive AirDrops from strangers

If you’ve set AirDrop to Everyone, strangers can freely AirDrop files to you for the next 10 minutes. This is convenient among friends or at social events, but it exposes you to random strangers in crowded places.

If you’re constantly getting AirDrops from strangers, particularly in public spaces, set the feature to Contacts Only or disable AirDrop entirely until you need it.

Should you use AirDrop or turn it off?

AirDrop is generally safe and convenient to use, but there are several key privacy risks to consider. If you set it to “Everyone,” you’ll be opening yourself up to random users for the next 10 minutes. Beyond being bothersome, these requests could contain offensive messages or be the first step in a scheme to compromise your device or steal your data.

The default setting, which only allows saved contacts to send you AirDrops, is much safer. As an added precaution, you can keep the feature off and only enable it for contacts when you need to send or receive something.

Overall, AirDrop is a useful tool that’s fairly secure due to the fact that data is encrypted during transit.