Drive-by Apple TVing

I was working from home yesterday, when I suddenly noticed that the TV switching and changing HDMI inputs from the Sky Q box to the Apple TV.  The following appeared on the TV screen:

Who you gonna call?  Zoe.  Zoe did a bad thing.  Arrest Zoe.  Bad Zoe.  Naughty Zoe.

I paniced at first, thinking that the Apple TV (and indeed most of my Appley things) were fully locked down.  I changed the admin and Wi-Fi passwords on my router as a precaution and went to do a bit of Googling.

It turns out that while a passocde is required to pair an AirPlay client (in this case, “Zoe’s iPhone“), and that you should only be able to display or stream anything on the same ethernet or Wi-Fi network the Apple TV is on – it turns out that it’s still possible for somebody to AirPlay to your Apple TV device if they are close enough.  Which suggests Bluetooth shennanigans.

Thankfully Bluetooth between neighbouring buildings isn’t good enough to pick up devices I don’t own, though through Wi-Fi scanning I do pick up the neighbours’ TVs.  I have seen the odd (non-Apple) mobile phone pop up when connecting to/repairing a Bluetooth device, but nothing as exciting as this!

I can only assume that somebody directly outside the house was having a bit of a tinker, or it was my immediate neighbour.  But it spooked me enough to do a thorough inspection of the wired and wireless networks.

In order to disable the ability to allow somebody to connect to your Apple TV (albeit it they can’t actually do anything other than make the initial connection, since they’ll be prompted for a number on the screen) – you need to go to the AirPlay settings in tvOS:

Apple needs to set “Also Allow Nearby to AirPlay” to off by default!

This should stop strange people attempting to send you photos or stream dodgy videos at you when you least expect it!