7 ms·
Openhaystack: Build 'AirTags' – track Bluetooth devices via Apple's network
- uzyn 2y agoImpressive. Would Apple be able to simply block non-Apple usage of Find My network usage simply by refusing to relay non-Apple BLE ID?
- malmeloo 2y agoNo, the BLE identities of these tags are currently practically indistinguishable from original tags, and could be made completely identical if necessary. In fact, changing the device's MAC address is part of the specification. What they could block, is the method used by these projects to fetch encrypted location reports. However, the original OpenHaystack project (this one) needs to run on macOS and lets the system handle account authentication, so it's unlikely to get blocked any time soon.
- oulipo 2y agoThere's also projects that don't need access to macOS (you still need an account) https://github.com/malmeloo/FindMy.py https://github.com/malmeloo/FindMy.py EDIT: just realized I'm replying to the author of the project lol
- Brajeshwar 2y agoIf I remember correctly, Apple was supposed to openly accept and encourage others to leverage their network and make more “AirTag” capable devices.
- heywire 2y agoA quick search on Amazon shows a number of generic trackers compatible with “Find My”. In fact, the one on my dog’s collar is one of these.
- denysvitali 2y agoYes, because they get a commission for every device registered on the network. In the join process, there is a key that is shared only for developers who paid the fee - which is why it's not really trivial to create an AirTag clone without dumping the Apple AirTag flash
- dalemhurley 2y agoThis is amazing. I love Apple AirTags but they are so bulky and an odd shape. I would love a AirTag the shape of a credit card to go into my wallet. I would love a smaller AirTag to go on my cats collar.
- sodality2 2y agoThey make super-thin AirTag compatible cards that fit in wallets.
- heywire 2y agoI’ve even seen some wallets with built in “Find My” support.
- BuildTheRobots 2y agoKindle cover would be extremely useful.
- monocularvision 2y agoA Kindle or cover with Find My support would make my wife overflow with happiness.
- denysvitali 2y agoTake a cover, place inside a credit-card sized airtag
- namibj 2y agoI wish me a budget 10000 mAh size "phone slab format/shape" power bank with like 18W output at 9~12V kind of "fast charge" style, and a built in Google air tag. They already have a button and a battery and a case; only need to add the BLE and the Google-mandated buzzer. I'd pay 5 bucks more than for the competition without the integrated tracker. That should easily cover the cost, right?
- haliskerbas 2y agoHaven’t done the research but I wonder if you can use this to piggyback with tiny arbitrary data data payloads.
- nik282000 2y agoYup, there was a project recently that used the airtag network to transmit data from a hardware keylogger. The computer could be totally gapped and the data still gets home via the typist's iPhone.
- xuki 2y agoIt's not airgapped if it has bluetooth access.
- roywiggins 2y agoPresumably you stick the bluetooth antenna in the physical keylogger.
- nissarup 2y agoSounds like a line from a conversation between a couple of pre-teen AIs.
- deleted 2y ago[deleted]
- 3eb7988a1663 2y agoI am guessing this is the story: Keylogger leaks data via Apple AirTag network https://news.ycombinator.com/item?id=38126302 https://news.ycombinator.com/item?id=38126302
- LelouBil 2y agoI saw someone use this to track his mail state. They have a contact sensor inside their mailbox that rotates the broadcasted key based on the trigger count. If the key changed, aka a new different device is visible, you know mail has been dropped in, very clever !
- gtirloni 2y agoPrevious: https://news.ycombinator.com/item?id=26342504 https://news.ycombinator.com/item?id=26342504
- pyronik19 2y agoWould there be a way for the bluetooth device to rotate its broadcast keys in a predictable way to avoid the iphone notification of "unknown airtag close by" messages? Seems like this could be exploited for surveillance.
- mrshadowgoose 2y agoSure, that works. One can also just cycle through a sufficiently large bank of pre-allocated keys, such that a findmy receiver doesn't see the same key too frequently.
- denysvitali 2y agoYou just need to derive a new key, this process is already part of the protocol to avoid being tracked while you wear your airtag
- denysvitali 2y agoTechnically it would need to rotate every 15 minutes or so - the notification you're talking about happens when the device is in "lost mode" (away from its owner): in that case the key is rotate every 24 hours
- alphan0n 2y agoYes, the FindYou project [0] has shown this to be possible. [0] https://github.com/positive-security/find-you https://github.com/positive-security/find-you
- abalaji 2y agoLooking through the code, it looks like this uses your personal Apple Mail entitlements to pull the locations that get collected by devices on the FindMy network: https://github.com/seemoo-lab/openhaystack/blob/8d214aa5eb68fa0e6bca8bfa65443a79dd2216d4/OpenHaystack/OpenHaystackMail/OpenHaystackPluginService.m#L81 https://github.com/seemoo-lab/openhaystack/blob/8d214aa5eb68... I wonder if this were also possible by making an Apple developer account.
- denysvitali 2y agoThere are versions that do not require the interaction with Apple Mail. All you need is an Apple account - the code doesn't have to run on Apple HW: https://github.com/biemster/FindMy https://github.com/biemster/FindMy
- amluto 2y agoCan these be paired with the actual Apple Find My app and found in the app?
- 2Gkashmiri 2y agohttps://robu.in/product/nrf51822-cfac-r-bluetooth-3-1edr-ble-2mbps-3v-medical-2-4ghz-soc-ulp-48-pin-qfn/ https://robu.in/product/nrf51822-cfac-r-bluetooth-3-1edr-ble... Will this chip work ?
- denysvitali 2y agoYes. I did it with that too. Basically all nrf51 / nrf52 are compatible with the protocol. In my case I've written the code in Rust - but it's pretty much the same thing as the example
- bhaney 2y agoThis is a technically interesting project, but is there any situation at all where it's worth using? It seems like it just allows you to build airtag-like devices that sorta work on the Find-My network with some rough edges, but I can buy proper AirTag clones in various form factors for a couple bucks - far cheaper than I could ever make a custom bluetooth device using this project. Am I missing a use-case?
- crummy 2y agoIf you had a laptop with Bluetooth, you could install this on it and find it if it were lost, I think.
- bhaney 2y agoOkay yeah, that appears to be true. Looks like the broadcast part currently only runs on Linux (or microcontroller firmware), while the client only works on macOS, so you'd need to lose your Linux laptop and then find it with your Apple computer, but it does seem like that setup would work if you had it. Maybe it'll be ported to other OSs at some point, if that's even possible.
- jjallen 2y agoWould your computer have to be open and running I’m guessing?
- bpbp-mango 2y agoAre the clones any good though? Where do you even get them?
- bhaney 2y agoThey've been perfect for me. I buy them on Temu for around $2.50 each and they work exactly like normal AirTags minus the ultra wideband precision finding. I pair and track them in the normal iOS FindMy app. Haven't been using them long enough to know how long the batteries last, but they advertise >1 year and they still all report pretty full batteries after a few months of usage, so I'm hopeful. The credit card form factor ones for wallets are more expensive ($10) but can be wirelessly recharged on Qi chargers.
- solarkraft 2y agoI wish it had a way to integrate with the Find My app instead of having to go through their own (wonky) process to retrieve locations. The chinese clones can do it (even with their own branding), so it must be possible somehow.
- alibarber 2y agoI think that's the wall in Apple's walled garden here. From reading the official Apple spec. for partners a while back, as part of the pairing process, something is signed by the device with a cert/key that apple issued to that developer (after coming to an agreement i.e - $$) - and, crucially, is different from the keypair that the device will use to actually broadcast. This is then validated by apple and thus allowed to be added to that apple-id's account and hence on to the app. The keys broadcasted by the devices themselves in 'lost' mode (i.e. not in 2 way contact with the owner's device) are arbitrary and completely opaque, Apple doesn't have any way of tying them to an ID or device or developer. This is how the proposed project here works - these keys will always find their way to the apple server. It seems like the knockoff ones have just hijacked a legit key for the pairing process. This means if Apple desires and finds out the key, it can probably remove all devices from all accounts - although the devices themselves will keep on broadcasting and their locations could be accessed in the above janky way. I wonder too if the original key owner might get a large bill for per-device royalties if/when Apple searches it's DB for a count of 'devices-added-to-an-apple-id-signed-by-this-key'...
- nl 2y agoThis isn't actually the case. Apple supports 3rd party trackers - see https://mfi.apple.com/ https://mfi.apple.com/ and https://developer.apple.com/find-my/ https://developer.apple.com/find-my/
- alibarber 2y agoYes, this is exactly what I’m saying. Apple officially supports third party trackers, who’s manufactures are issued, by apple as a part of their MFI programs, keys with which these third party devices must use to sign their pairing requests to the users apple account. Perhaps these $5 devices do indeed include legitimate keys from apple to use from this, perhaps they have copied one from another device.
- raffraffraff 2y agoHmmm, but can you use it to set up an actual AirTag without having another apple device like iPhone or Mac?
- oulipo 2y agoI think you can (haven't tried), check this repo https://github.com/malmeloo/FindMy.py/blob/main/examples/real_airtag.py https://github.com/malmeloo/FindMy.py/blob/main/examples/rea...
- raffraffraff 2y agoWould love to know who downvoted this and why. Is this not a valid question?
- phcreery 2y agoPossible with https://github.com/dchristl/macless-haystack https://github.com/dchristl/macless-haystack
- letters90 2y ago> All you need to use is a mac. Might as well require you to pay 1000$ up front to use.
- xyst 2y agoI wonder what’s the upper limit of transmissions a single device can upload to Apple servers? If the Apple device has no cell service or WiFi, how long will the history of that location ping reside on device? Also, is there a DoS vector here? - attacker manages to simulate 1M+ Bluetooth devices - victim randomly passes by and it crashes their phone due to a massive number of devices in single location and constantly uploading to Apple servers
- sorenjan 2y agoI wish there was a good option for non Apple users. From what I've heard Google made their version pretty bad, as expected. They rate limit how often you can search for your own tags, they won't show the location until a tag has been seen by multiple phones, there's poor coverage. One test I saw showed that Samsung's network was better, which makes no sense since Samsung phones should be a subset of all Android phones in Google's network, but that's Google products for you. Sounds good in theory but poorly executed, even years after Apple showed how to do it. https://security.googleblog.com/2024/04/find-my-device-network-security-privacy-protections.html https://security.googleblog.com/2024/04/find-my-device-netwo... https://9to5google.com/2024/08/01/find-my-device-stress-test-how-good-is-googles-tracking-network-video/ https://9to5google.com/2024/08/01/find-my-device-stress-test... https://9to5google.com/2024/08/03/google-android-find-my-device-network-airtag/ https://9to5google.com/2024/08/03/google-android-find-my-dev... https://www.androidcentral.com/accessories/testing-new-google-find-my-device-trackers https://www.androidcentral.com/accessories/testing-new-googl...
- garbagewoman 2y agoI dunno, a less than perfectly all-seeing omnipresent tracking network actually is a little comforting
- sorenjan 2y agoIt's not very useful for tracking your things though, which arguably is why you would use it. I wouldn't trust Google's network to find a stolen bike or lost luggage for instance, but air tags are used for that all the time[0]. Finding my lost keys at home is a perfectly valid use case for tags, but you don't need a network for that, just some Bluetooth and maybe UWB. [0] https://www.forbes.com/sites/barrycollins/2024/12/17/lost-luggage-share-your-airtag-location-with-these-airlines/ https://www.forbes.com/sites/barrycollins/2024/12/17/lost-lu... https://help.vanmoof.com/hc/en-us/articles/16053155393181-How-can-I-connect-my-VanMoof-to-Apple-Find-My https://help.vanmoof.com/hc/en-us/articles/16053155393181-Ho...
- wasmitnetzen 2y agoGoogle is still seeing everything, of course, just not the plebs.
- deleted 2y ago[deleted]
- exabrial 2y agoCan someone point me to something I saw earlier? Apple alerts users to "tags that might be following you". Someone made an implementation that used a KDF to rotate the mac address or private key or something, but it was predictable in a way you could track each derivation of the of the mac/private key. There is a really obnoxious petty theft problem where I live, and the time it takes to constantly get my windows fixed or forced entry crap removed is worth a significant amount of my personal time. I have zero desire to confront anyone, but I'd like to be able to create a track for a PI or Law enforcement some day.
- stavros 2y agoHm, AFAIK AirTags rotate their private key anyway, so I don't know if that will help your problem. Maybe they rotate it slowly, though, I'm not very familiar with the exact algorithm.
- hattmall 2y agoYou can buy GPS cellular trackers. Then just get a really cheap or even free IOT sim. Alternatively you could probably just walk to your nearest drug addict hangout with case of bottled water and ask them to stop breaking into your stuff.
- IshKebab 2y agoCan you though? Every time airtags come up here someone is like "you can get GPS trackers already! they're cheap!" but I actually looked and actual GPS trackers that don't require a subscription or have various other flaws seem to be very difficult to find. If there's a GPS tracker that uses an eSIM and isn't sketchy af and has decent battery life and isn't £100 let me know! I would love that for my bikes.
- snug 2y agoYup, usually $20-30 per month is what I found. It would be cheaper to just use an old phone and use a cheap pay as you go cell service
- 2y ago
- 1024core 2y agoQQ: Why would one build your own? Is the cost of building one's own lower than just buying an Airtag off the shelf? I recently bought some for about $15. Would building my own be cheaper?
- culi 2y agoI used to put one on my indoor/outdoor cat. She was a small cat so I always felt bad by how large the airtag was. If we were still doing this, I would consider building an optimized one that's smaller and a better shape for her Another use-case could be to build a tag that is able to leverage multiple different networks (Tile, Chipolo, etc)
- mannyv 2y agoSo would this allow you to track a fleet in mostly realtime?
- pishpash 2y agoSo, how exactly do you "build your own tags"? You need Bluetooth-enabled devices that can run this software?