5 ms·
With physical access to the inside of the device, a security researcher was able to change the URL of the NFC tag. That's literally all that happened here.
by jaywalk 6y ago
With physical access to the inside of the device, a security researcher was able to change the URL of the NFC tag. That's literally all that happened here.
- Someone1234 6y agoExtracting, modifying, and re-flashing the fireware for the first time would be worthy of discussion alone, but modifying it to do something useful is especially noteworthy. As the extracted firmware is analyzed further interesting discoveries/capabilities could be found.
- jaywalk 6y agoIs the simple passive NFC functionality even handled the same way as the much more complex AirTag functionality? With this NFC URL modification, does the regular AirTag functionality even still work? I love seeing things hacked like this, but for all we know this same thing could have been accomplished by swapping out the guts of the device. (Note: I'm not saying the demo is a fraud, I know stacksmashing is legit) There aren't many details in the article, and the demo doesn't really show much.
- post_break 6y agoSo redirect them to a fake iCloud page. Now you can phish their iCloud account. Or wait for a nice iPhone 0 day. See if you can get them to install an App that has a $9.99 per week subscription, etc etc. Lots of attack vectors in a url. Especially one that seems like a legit airtag you happened to find. At $25 a pop cheap to sprinkle around airports.
- sombremesa 6y ago> See if you can get them to install an App that has a $9.99 per week subscription This is easy enough to do today without all the extra work. https://news.ycombinator.com/item?id=26794228 https://news.ycombinator.com/item?id=26794228
- pjerem 6y agoThere really is no need to hack the firmware to do that. You just have to replace the battery with a cheap passive nfc tag configured with your malicious URL.