6 ms·
Apple AirTag Hacked
- randyrand 5y agoI'm surprised this isn't custom silicon? I thought the U1 chip was required and Apple made?
- detaro 5y agoU1 is only the UWB wireless interface.
- randyrand 5y agoIt likely still includes a small micro thats sufficient. But you need something for the DAC/Speaker and Bluetooth LE, so that may have influenced adding another micro.
- tuankiet65 5y agoSeems like there's an nRF52.
- londons_explore 5y agoKinda surprising Apple uses such a common bit of hardware. What's next - the next MacBook battery controller Arduino controlled?
- angry_octet 5y agoHow long before AirTags are modified to hop between iCloud identities to subvert anti-tracking? Also, shoutout to the dickhead who said no one would be able to RE them.
- lykr0n 5y agoHacked in the "I figured out how to modify the device" since and not the "You can exploit it to track someone" way.
- yokaze 5y agoThat has been already done, as far as I know: https://www.reddit.com/r/apple/comments/n3ht2a/how_to_disable_the_speaker_in_airtags/ https://www.reddit.com/r/apple/comments/n3ht2a/how_to_disabl...
- geoah 5y agoghidraninja mannaged to modify the software side of the airtag (dump and reflash), not the hardware.
- sergiomattei 5y agoYeah, bit of a misleading title.
- EE84M3i 5y agoWhat security boundary is being violated here? DRM?
- bri3d 5y agoThe microcontroller is supposed to provide read/write protection for the firmware, but is vulnerable to a voltage glitching attack.
- fortran77 5y agoThere is another very obvious “security hole” with this device: I can use an air tag to tell if someone had an iPhone nearby. Suppose you’re at a site where phones are prohibited. (Like certain comedians who prohibit phones.) If your AirTag is spotted, someone has a phone!
- spaceywilly 5y agoAny BLE scanner app will tell you how many iPhones are nearby, unless the user has disabled the bluetooth radio through the settings menu.
- deftnerd 5y agoI remember reading about a year ago how thieves have been seen using BLE scanner apps walking through parking garages looking for computers and phones to steal. Even in "sleep state" many of them are discoverable through bluetooth.
- tashoecraft 5y agoWait 3 seconds until someone takes their phone out, boom, now you know what phone they have
- barbegal 5y agoThe AirTag is based on an nRF52 Bluetooth microcontroller which should have protection against firmware extraction. Last year an exploit was found to bypass this using a glitch in the power supply at the right time in the boot up process. Now hackers have applied this process to get the firmware from the AirTag. The microcontroller doesn't have a secure boot process so you can use JTAG to flash it with new firmware. As for stalking, it was only ever going to be a matter of time before devices were small enough and power efficient enough to be tracked for prolonged periods of time. I think there is probably a market for an Android app which can detect if any Bluetooth devices appear to be following you.
- gruez 5y ago>I think there is probably a market for an Android app which can detect if any Bluetooth devices appear to be following you. how do you handle mac address changes?
- barbegal 5y agoIt turns out that it is easy to detect that since the signal strength remains about the same, the new MAC appears just after the old one disappears and the contents of the Bluetooth advertisement remain broadly the same. However you do have to be continually scanning for this to work.
- infofarmer 5y agoShould be trivial to thwart all three with slight changes in firmware.
- lozaning 5y agoYou didn't need to do any firmware fuckery to stalk people. If you wanted to stalk someone with an iphone, just 'give' them a Samsung Galaxy tag, if you want to stalk someone with a Samsung phone, 'give' them an airtag. Neither company bothered to make the anti stalking functionality of their products cross platform.
- jaywalk 5y agoWith physical access to the inside of the device, a security researcher was able to change the URL of the NFC tag. That's literally all that happened here.
- Someone1234 5y agoExtracting, modifying, and re-flashing the fireware for the first time would be worthy of discussion alone, but modifying it to do something useful is especially noteworthy. As the extracted firmware is analyzed further interesting discoveries/capabilities could be found.
- jaywalk 5y agoIs the simple passive NFC functionality even handled the same way as the much more complex AirTag functionality? With this NFC URL modification, does the regular AirTag functionality even still work? I love seeing things hacked like this, but for all we know this same thing could have been accomplished by swapping out the guts of the device. (Note: I'm not saying the demo is a fraud, I know stacksmashing is legit) There aren't many details in the article, and the demo doesn't really show much.
- post_break 5y agoSo redirect them to a fake iCloud page. Now you can phish their iCloud account. Or wait for a nice iPhone 0 day. See if you can get them to install an App that has a $9.99 per week subscription, etc etc. Lots of attack vectors in a url. Especially one that seems like a legit airtag you happened to find. At $25 a pop cheap to sprinkle around airports.
- sombremesa 5y ago> See if you can get them to install an App that has a $9.99 per week subscription This is easy enough to do today without all the extra work. https://news.ycombinator.com/item?id=26794228 https://news.ycombinator.com/item?id=26794228
- pjerem 5y ago
- amelius 5y agoIn the 80s I had a keychain whistle finder. I.e. whistle twice and the device responds by beeping. It seems the AirTag is similar technology but 10x as expensive, with only little more real value. Am I missing something?
- invalidusernam3 5y agoIs the keychain going to hear your whistle on the other side of town?
- birdyrooster 5y agoThere is a network of people all using the Whistle Finder online and they work together to find items around the world on Discord.
- dylan604 5y agoThis has to be the most internet thing to hear about today.
- amelius 5y agoWill you be able to locate your AirTag in an area with no iDevices?
- function_seven 5y agoNo, but the difference is huge. With the whistle, your range is what, 40m radius? With this, it's every populated place. They won't work if you lost something on a back country hike, but 95% of the world (that you'd visit) will have other iDevice users pass by within a day.
- amelius 5y agoMy point was also about the technology not just about possible applications. Also, I don't see how you'd lose something so important that you'd tag it. E.g. I'd tag my camera, but then I wouldn't lose it because it is precious to me.
- c7DJTLrn 5y agoI'm still having trouble understanding the purpose of these things. There are way too many unethical applications of this technology, and what kind of person loses things so often that they need to buy trackers?
- zrail 5y agoI have ADHD-adjacent symptoms which include losing my keys quite often, which is why I bought some AirTags.
- picklebutter 5y agoI have no use for them either. My guess is for people traveling? Or for possible expensive equipment that might get stolen? Maybe someone that has a use case for these will chime in. Might be some in one of the other announcement threads I'd have to go look.
- sleepybrett 5y agoI misplace my keys, often. Even after placing a small dish near my front door and trying to form a habit around using it. I opted into a Tile as soon as they came to market. It works great, not only can I find my keys if I have my phone, but also visa versa (tile has a button that causes your phone to chime as long as it's in range). I have a little 'tile dot' (smaller form factor) attached to my wireless headphones charging case. It's black and hard to see via 'scanning'.. I see other headphones now have this tech integrated into the device, that seems awesome. It's also a very cheap way to do gps type things, this is going to be especially effective with air tags I suspect. The tile trackers are essentially bluetooth beacons and all tiles can be detected by any phone that has the tile app on it (i assume, I'm only familiar with the apple side of this particular equation). I expect that number is growing but fairly low. However every moderish iphone will be detecting airtags, that's going to give you a ton of coverage. This opens up some other things like 'find my car's airtag in this huge parking lot'
- deleted 5y ago[deleted]
- 5y ago