5 ms·

Turning a Bluetooth device into an Apple AirTag without root privileges

505 points by layer8 2y ago

ohxhgtj 2y ago
[flagged]
mmastrac 2y ago
Interesting. They seem to be abusing a hole where Apple wasn't confirming that the broadcast addresses were valid for tags (ie: "random static" addresses rather than public ones). The BLE broadcast stores part of the lost message public key in the advertising message's address, and part of it in the payload -- they are just using a "normal" BLE address and then reverse-engineering a key from that. > The Find My network specification mandates the use of ran- dom static addresses for advertising lost messages. However, our research reveals that public addresses, resolvable private addresses, and non-resolvable private addresses can also serve this purpose without any issues. This implementation vulner- ability is exploited by our attack to track Linux, Android, and Windows systems. > Our work uncovered a vulnerability in the Find My ser- vice that permitted all types of BLE addresses for advertis- ing. Exploiting this vulnerability, we proposed a novel at- tack, nRootTag, which transforms a Bluetooth device into an “AirTag” tracker without requiring root privilege escalation. By utilizing over a billion active Apple devices as finders, the attack is able to accurately track user devices. Through rainbow table-based offline key search or GPU-accelerated online key search, an infected computer can be quickly turned into a tracker. Notably, the online key search cost does not in- crease as the number of tracked devices grows. The evaluation shows that the attack is effective across various devices, in- cluding desktops, laptops, smartphones, and IoT devices, and worked on Linux, Windows, and Android platforms. We also discussed how the attack could be extended to track Apple devices.
- deleted 2y ago
  [deleted]
- Domenic_S 2y ago
  > they are just using a "normal" BLE address and then reverse-engineering a key from that. It's really clever - the BLE spec limits message size, so Apple uses the BLE address as part of the message (the first part of the public key). But since the public address of a BLE chip has 24 bits of "Company ID" (similar to MAC addresses I guess?), and the registry records are public, they were able to precompute a bunch of public/private keypairs.
  - krupan 2y ago
    Apple used the company ID as part of the key material??
    - gruez 2y ago
      No. Read the paper again, specifically figure 3.
sedatk 2y ago
> This work was supported in part by the US National Science Foundation (NSF) under grants CNS-2304720, CNS-2310322, CNS-2309550, and CNS-2309477 Good old days.
- lynndotpy 2y ago
  People will still be finding these vulnerabilities. Just fewer of them, and fewer of them from within the United States, and fewer of them publishing the details publicly.
  - deskr 2y ago
    [flagged]
    - dang 2y ago
      Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
  - chefandy 2y ago
    My gut says a lot of vulnerabilities disclosed like this had probably already been found by those people that won’t disclose them publicly. Programs that expose these vulnerabilities, funded by countries that can afford it, are probably the biggest stopgaps keeping it mostly in the realm of sketchy nation-state intelligence agency shenanigans rather than organized crime with ransomware-gang-level technical savvy and terrorist organizations. The frustrating thing is that there’s no way you can guarantee that some future problem would have been prevented by a program like this — it’s just good societal-level stewardship of our communications infrastructure. People that consider it reasonable for regular people to defend themselves against things like this without societal support and guidance are delusional. Beyond that, if we think we’re going to maintain dominance in the digital space, removing our collective investment in figuring out what that entails based on a dubious assumption that private industry will pick up the slack unprompted is as penny wise and pound foolish as you get.
internetter 2y ago
How does this differ from https://github.com/seemoo-lab/openhaystack https://github.com/seemoo-lab/openhaystack Edit: It works without root. Follow up question: Can these discoveries improve openhaystack?
- layer8 2y ago
  It doesn’t require installing a custom Bluetooth firmware.
- saagarjha 2y ago
  Well they copied the diagrams from there for one
- malmeloo 2y ago
  This won't really affect OpenHaystack in any meaningful way. The only additional thing this paper shows is that it is possible to brute-force the key necessary to broadcast a valid FindMy BLE message, without needing to change the advertised MAC address (which generally requires root privileges). If you wanted to turn your own devices into Airtags, you could just change the advertised MAC with root permissions to skip the brute-force step.
hackernudes 2y ago
Here is my quick summary: Apple devices listen for BLE advertisements of a certain form to indicate a "Find My" network lost device. The lost device advertisements mainly contain the public key part of a key pair. The public key does not fit in the in payload of the advertisements, so it is stuffed into the address field. Edit: Only 46 bits of the full 224 bit public key is stored in the address field. In general anyone can make a "lost device" advertisement as demonstrated by OpenHayStack[1]. The requirement is the address field needs to be fully controllable. BLE advertisements have a header that indicates what kind of address is present (specified by 3 bits: Public, NRPA, RPA, Random Static). The lost device advertisements are supposed to be "Random Static", but the researchers found that Apple "Find My" listeners ("finders") will accept advertisements for any address type. They use this fact to generate the private key part of a public key that matches an existing host adapter BLE address. The host adapter BLE address cannot generally be changed unless user has root/superuser privileges. This step is computationally expensive. However, private keys can be precomputed (rainbow tables) because a large chunk of the address is a manufacturer code (OUI). [1] https://github.com/seemoo-lab/openhaystack https://github.com/seemoo-lab/openhaystack
- krupan 2y ago
  Hold up, how are they generating a private key from a public key? That's supposed to be very difficult. Are you saying that a large chunk of the key (private key or public key?) is a manufacturer code? That's insane
  - rahimnathwani 2y ago
    They pregenerate the key pairs. The trojan sends the MAC to the server, and the server looks in its (precomputed) stash of key pairs, to find a public key that matches.
  - avidiax 2y ago
    > Hold up, how are they generating a private key from a public key? They are not. They are generating a private/public key pair where the first 46 bits of the public key happen to match the victim's BLE address. The find-my network then accepts beacons (encrypted with the attacker's private key) from this address, and stores it in iCloud to be retrieved by the attacker via the 46-bit prefix.
sodality2 2y ago
An interesting thing to note from the article is that this isn't just a garden variety jailbreak/adversarial interoperability with a BLE protocol. It lets you turn someone else's device into an airtag, then track its location. > In addition, we appreciate the help from the Apple Security Team for their prompt responses and acknowledgement. Apple recently released patches in iOS 18.2, visionOS 2.2, iPadOS 17.7.3, 18.2, watchOS 11.2, tvOS 18.2, macOS Ventura 13.7.2, Sonoma 14.7.2, Sequoia 15.2 to fix the vulnerability. However, the attack remains effective as long as unpatched iPhones or Apple Watches are in the proximity of the computer running our trojan. Seems like a pretty bad vulnerability to just hope 1.5B iPhones alone update soon enough. I know people still on iOS 17/16... All of them are now complicit. But I'm happy to see my state represented in security research :)
- rahimnathwani 2y ago
  It lets you turn someone else's device into an airtag, then track its location. Only if you can get their device to run your code.
  - Limeray 2y ago
    No, read the summary from the top comment.
    - larusso 2y ago
      The patch for iOS is not to stopp the potential hijack via a Trojan software but to stopp the mesh of iOS devices to broadcast the find my messages around.
    - hug 2y ago
      Actually, very much yes. The device to be tracked needs to be exploited somehow in order to run the code to advertise its existence via BLE. FTA's "Architecture of nRootTag": > (1) The Trojan code runs on the computer to be tracked.
      - raudette 2y ago
mannyv 2y ago
The problem with this exploit is it needs something on the device that sends out BLE packets. This is hardly the problem that it's made out to be. Excellent PR team - every other site reporting makes it sound like they broke FmF. but with a process on the device the device has already been pwnd.
- jeroenhd 2y ago
  It's a matter of time before advertising SDKs within any ad-supported apps will start leveraging this to geolocate users without additional permissions. Especially for apps that already have location permissions (something as simple as a weather app) this will hardly be noticed.
  - dmitrygr 2y ago
    Won't work on iOS. An app cannot simply get the local MAC address on iOS. Privacy reasons. And trying all the (2^8)^3 options will also not work - for power reasons you'll be quickly throttled.
    - jimiasty 2y ago
      You don't need MAC address - you just need the iPhone to broadcast specific BLE advertising packet/payload. Using Core Bluetooth API it is trivial, but you need to either: a) create an app that does it and user has to download it b) modify SDKs existing in apps (e.g. Ad SDKs) Also turning app/phone into a "BLE beacon" is only possible when app running in the foreground (on iOS).
      - dmitrygr 2y ago
        Please read the original source again. You need to KNOW (or guess) own mac address as it becomes a part of the key.
        jimiasty 2y ago
        Yes, you are correct! Knowing the MAC makes the attack reasonable - let's say 5 hours compute for 3080Ti. Not knowing the MAC makes it exponentially harder. You can still "guess" it, but the search-space is vast and that would take bazillion-years. So to attack iOS device: - user has to download the app - app has to broadcast fake BLE - some other devices (e.g. Android/RasPi would need to pickup that MAC and pass it to you
devmor 2y ago
Does anyone know if the fix for this vulnerability removes the ability to use your own arbitrary BLE devices on the FindMy network? I haven't personally looked through the technical details of how that has been accomplished in the past, but it sounds up front like it might.
- rahimnathwani 2y ago
  It does not remove that ability.
jeroenhd 2y ago
Seems like a good way to physically pin down where a hacked computer may be located. Could be useful for people like ransomware authors who infect devices all over the world. Nothing new, really. Apple created a worldwide network of location scanning devices and this is just leveraging the power Apple already has. The genie is out of the bottle now, and live location tracking has become almost trivial. So, seeing how this is able to allow a device to be tracked without an alternative bluetooth stack: could the Find My network be (ab)used to geolocate devices without a GPS receiver? If a device broadcasts BLE packets and then queries its own location, that should give a pretty accurate location, shouldn't it? Might save some power if the 5G antenna is active already anyway, assuming there's an Apple user nearby.
ck2 2y ago
um, can't this be abused to flood the system like a ddos?
prepend 2y ago
I wonder if Apple will keep this open out of the kindness of their heart. Or all these unintended uses will result in them locking down their network. I guess all my Apple devices are looking for this and sharing it to Apple and wonder how much that data adds up.
- layer8 2y ago
  They already fixed it in recent updates, but many non-updated devices will remain around for quite a while. It’s not fixable server-side.
  - lgats 2y ago
    what's the fix for this sort of exploit? Narrowing the accepted packets to airtag specific packet types?
- malmeloo 2y ago
  OpenHaystack has been around for a long time, and they don't really seem to care much
kittikitti 2y ago
So whatever happened to Big Tech's eNd TO EnD enCRYptIOn? If I had to guess, this was an intentional backdoor that was just discovered.
- layer8 2y ago
  It’s still end-to-end-encrypted, but the attacker effectively controls both ends. There is no backdoor.
ww520 2y ago
I never knew Apple let anyone access the lost announcement messages from the AirTags sent through iCloud.
- layer8 2y ago
  You need the private key associated with the AirTag in order to decrypt the result.
  - octoberfranklin 2y ago
    ... and an Apple Account with an SMS-verified telephone number. And of course by requesting a result, you're letting Apple know that your Apple Account cares about a particular Airtag. All the FindMy anonymity claims go out the window as soon as you actually lose something and want to find it. It's only anonymous if you don't query the network.
    - malmeloo 2y ago
      Actual Airtags rotate their keys on a daily basis (when in lost mode), and Apple can't predict those keys. Theoretically they could tell that you're looking for a tag reported by devices x y and z, but the actual locations are encrypted.
ctkhn 2y ago
I get that this is an attack, but if I could get this on my own non-apple bluetooth devices that would be really convenient.
- 1024core 2y ago
  This was posted a month ago: https://news.ycombinator.com/item?id=42835772 https://news.ycombinator.com/item?id=42835772
ohxhgtj 2y ago
[flagged]
Rebelgecko 2y ago
Nice. I have some Chipolo trackers but the tracking is pretty bad compared to air tags. Would this approach let me make them trackable via Apple's network too?
- malmeloo 2y ago
  Only if you manage to flash custom firmware on them. But there's already been many efforts on creating firmware for devices costing only a few bucks each, so that's probably easier.
deleted 2y ago
[deleted]
rubatuga 2y ago
For those who don't want their iPhone participating in the Find My network, from my understanding, turning off iCloud disables the sharing of BLE advertisements.
- Angostura 2y ago
  Simply turning off Find My Phone does the same, I believe
reader9274 2y ago
Something straight out of Samy Kamkar's book. Nice
slicktux 2y ago
So, this vulnerability requires root access to a device… That means I can make my own laptop broadcast lost beacons and I’ll have free anti-theft tracking of my device!?
tensility 2y ago
In the spirit of constructive criticism, I'd suggest that the GPU section of the summary feels like a fish out of water and should probably either be removed or supplemented with a bit more context from the actual paper. Cheers.
cantrecallmypwd 2y ago
Seems like this opens up the possibility of open source hw/sw compatible AirTags and virtual AirTags, yeah?

505 points by layer8 2y ago

[flagged]

Interesting. They seem to be abusing a hole where Apple wasn't confirming that the broadcast addresses were valid for tags (ie: "random static" addresses rather than public ones). The BLE broadcast stores part of the lost message public key in the advertising message's address, and part of it in the payload -- they are just using a "normal" BLE address and then reverse-engineering a key from that. > The Find My network specification mandates the use of ran- dom static addresses for advertising lost messages. However, our research reveals that public addresses, resolvable private addresses, and non-resolvable private addresses can also serve this purpose without any issues. This implementation vulner- ability is exploited by our attack to track Linux, Android, and Windows systems. > Our work uncovered a vulnerability in the Find My ser- vice that permitted all types of BLE addresses for advertis- ing. Exploiting this vulnerability, we proposed a novel at- tack, nRootTag, which transforms a Bluetooth device into an “AirTag” tracker without requiring root privilege escalation. By utilizing over a billion active Apple devices as finders, the attack is able to accurately track user devices. Through rainbow table-based offline key search or GPU-accelerated online key search, an infected computer can be quickly turned into a tracker. Notably, the online key search cost does not in- crease as the number of tracked devices grows. The evaluation shows that the attack is effective across various devices, in- cluding desktops, laptops, smartphones, and IoT devices, and worked on Linux, Windows, and Android platforms. We also discussed how the attack could be extended to track Apple devices.

deleted 2y ago
[deleted]
Domenic_S 2y ago
> they are just using a "normal" BLE address and then reverse-engineering a key from that. It's really clever - the BLE spec limits message size, so Apple uses the BLE address as part of the message (the first part of the public key). But since the public address of a BLE chip has 24 bits of "Company ID" (similar to MAC addresses I guess?), and the registry records are public, they were able to precompute a bunch of public/private keypairs.
- krupan 2y ago
  Apple used the company ID as part of the key material??
  - gruez 2y ago
    No. Read the paper again, specifically figure 3.

sedatk 2y ago

> This work was supported in part by the US National Science Foundation (NSF) under grants CNS-2304720, CNS-2310322, CNS-2309550, and CNS-2309477 Good old days.

lynndotpy 2y ago
People will still be finding these vulnerabilities. Just fewer of them, and fewer of them from within the United States, and fewer of them publishing the details publicly.
- deskr 2y ago
  [flagged]
  - dang 2y ago
    Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- chefandy 2y ago
  My gut says a lot of vulnerabilities disclosed like this had probably already been found by those people that won’t disclose them publicly. Programs that expose these vulnerabilities, funded by countries that can afford it, are probably the biggest stopgaps keeping it mostly in the realm of sketchy nation-state intelligence agency shenanigans rather than organized crime with ransomware-gang-level technical savvy and terrorist organizations. The frustrating thing is that there’s no way you can guarantee that some future problem would have been prevented by a program like this — it’s just good societal-level stewardship of our communications infrastructure. People that consider it reasonable for regular people to defend themselves against things like this without societal support and guidance are delusional. Beyond that, if we think we’re going to maintain dominance in the digital space, removing our collective investment in figuring out what that entails based on a dubious assumption that private industry will pick up the slack unprompted is as penny wise and pound foolish as you get.

internetter 2y ago

How does this differ from https://github.com/seemoo-lab/openhaystack https://github.com/seemoo-lab/openhaystack Edit: It works without root. Follow up question: Can these discoveries improve openhaystack?

layer8 2y ago
It doesn’t require installing a custom Bluetooth firmware.
saagarjha 2y ago
Well they copied the diagrams from there for one
malmeloo 2y ago
This won't really affect OpenHaystack in any meaningful way. The only additional thing this paper shows is that it is possible to brute-force the key necessary to broadcast a valid FindMy BLE message, without needing to change the advertised MAC address (which generally requires root privileges). If you wanted to turn your own devices into Airtags, you could just change the advertised MAC with root permissions to skip the brute-force step.

hackernudes 2y ago

Here is my quick summary: Apple devices listen for BLE advertisements of a certain form to indicate a "Find My" network lost device. The lost device advertisements mainly contain the public key part of a key pair. The public key does not fit in the in payload of the advertisements, so it is stuffed into the address field. Edit: Only 46 bits of the full 224 bit public key is stored in the address field. In general anyone can make a "lost device" advertisement as demonstrated by OpenHayStack[1]. The requirement is the address field needs to be fully controllable. BLE advertisements have a header that indicates what kind of address is present (specified by 3 bits: Public, NRPA, RPA, Random Static). The lost device advertisements are supposed to be "Random Static", but the researchers found that Apple "Find My" listeners ("finders") will accept advertisements for any address type. They use this fact to generate the private key part of a public key that matches an existing host adapter BLE address. The host adapter BLE address cannot generally be changed unless user has root/superuser privileges. This step is computationally expensive. However, private keys can be precomputed (rainbow tables) because a large chunk of the address is a manufacturer code (OUI). [1] https://github.com/seemoo-lab/openhaystack https://github.com/seemoo-lab/openhaystack

krupan 2y ago
Hold up, how are they generating a private key from a public key? That's supposed to be very difficult. Are you saying that a large chunk of the key (private key or public key?) is a manufacturer code? That's insane
- rahimnathwani 2y ago
  They pregenerate the key pairs. The trojan sends the MAC to the server, and the server looks in its (precomputed) stash of key pairs, to find a public key that matches.
- avidiax 2y ago
  > Hold up, how are they generating a private key from a public key? They are not. They are generating a private/public key pair where the first 46 bits of the public key happen to match the victim's BLE address. The find-my network then accepts beacons (encrypted with the attacker's private key) from this address, and stores it in iCloud to be retrieved by the attacker via the 46-bit prefix.

sodality2 2y ago

An interesting thing to note from the article is that this isn't just a garden variety jailbreak/adversarial interoperability with a BLE protocol. It lets you turn someone else's device into an airtag, then track its location. > In addition, we appreciate the help from the Apple Security Team for their prompt responses and acknowledgement. Apple recently released patches in iOS 18.2, visionOS 2.2, iPadOS 17.7.3, 18.2, watchOS 11.2, tvOS 18.2, macOS Ventura 13.7.2, Sonoma 14.7.2, Sequoia 15.2 to fix the vulnerability. However, the attack remains effective as long as unpatched iPhones or Apple Watches are in the proximity of the computer running our trojan. Seems like a pretty bad vulnerability to just hope 1.5B iPhones alone update soon enough. I know people still on iOS 17/16... All of them are now complicit. But I'm happy to see my state represented in security research :)

rahimnathwani 2y ago
It lets you turn someone else's device into an airtag, then track its location. Only if you can get their device to run your code.
- Limeray 2y ago
  No, read the summary from the top comment.
  - larusso 2y ago
    The patch for iOS is not to stopp the potential hijack via a Trojan software but to stopp the mesh of iOS devices to broadcast the find my messages around.
  - hug 2y ago
    Actually, very much yes. The device to be tracked needs to be exploited somehow in order to run the code to advertise its existence via BLE. FTA's "Architecture of nRootTag": > (1) The Trojan code runs on the computer to be tracked.
    - raudette 2y ago

mannyv 2y ago

The problem with this exploit is it needs something on the device that sends out BLE packets. This is hardly the problem that it's made out to be. Excellent PR team - every other site reporting makes it sound like they broke FmF. but with a process on the device the device has already been pwnd.

jeroenhd 2y ago
It's a matter of time before advertising SDKs within any ad-supported apps will start leveraging this to geolocate users without additional permissions. Especially for apps that already have location permissions (something as simple as a weather app) this will hardly be noticed.
- dmitrygr 2y ago
  Won't work on iOS. An app cannot simply get the local MAC address on iOS. Privacy reasons. And trying all the (2^8)^3 options will also not work - for power reasons you'll be quickly throttled.
  - jimiasty 2y ago
    You don't need MAC address - you just need the iPhone to broadcast specific BLE advertising packet/payload. Using Core Bluetooth API it is trivial, but you need to either: a) create an app that does it and user has to download it b) modify SDKs existing in apps (e.g. Ad SDKs) Also turning app/phone into a "BLE beacon" is only possible when app running in the foreground (on iOS).
    - dmitrygr 2y ago
      Please read the original source again. You need to KNOW (or guess) own mac address as it becomes a part of the key.
      - jimiasty 2y ago
        Yes, you are correct! Knowing the MAC makes the attack reasonable - let's say 5 hours compute for 3080Ti. Not knowing the MAC makes it exponentially harder. You can still "guess" it, but the search-space is vast and that would take bazillion-years. So to attack iOS device: - user has to download the app - app has to broadcast fake BLE - some other devices (e.g. Android/RasPi would need to pickup that MAC and pass it to you

devmor 2y ago

Does anyone know if the fix for this vulnerability removes the ability to use your own arbitrary BLE devices on the FindMy network? I haven't personally looked through the technical details of how that has been accomplished in the past, but it sounds up front like it might.

rahimnathwani 2y ago
It does not remove that ability.

jeroenhd 2y ago

Seems like a good way to physically pin down where a hacked computer may be located. Could be useful for people like ransomware authors who infect devices all over the world. Nothing new, really. Apple created a worldwide network of location scanning devices and this is just leveraging the power Apple already has. The genie is out of the bottle now, and live location tracking has become almost trivial. So, seeing how this is able to allow a device to be tracked without an alternative bluetooth stack: could the Find My network be (ab)used to geolocate devices without a GPS receiver? If a device broadcasts BLE packets and then queries its own location, that should give a pretty accurate location, shouldn't it? Might save some power if the 5G antenna is active already anyway, assuming there's an Apple user nearby.

ck2 2y ago

um, can't this be abused to flood the system like a ddos?

prepend 2y ago

I wonder if Apple will keep this open out of the kindness of their heart. Or all these unintended uses will result in them locking down their network. I guess all my Apple devices are looking for this and sharing it to Apple and wonder how much that data adds up.

layer8 2y ago
They already fixed it in recent updates, but many non-updated devices will remain around for quite a while. It’s not fixable server-side.
- lgats 2y ago
  what's the fix for this sort of exploit? Narrowing the accepted packets to airtag specific packet types?
malmeloo 2y ago
OpenHaystack has been around for a long time, and they don't really seem to care much

kittikitti 2y ago

So whatever happened to Big Tech's eNd TO EnD enCRYptIOn? If I had to guess, this was an intentional backdoor that was just discovered.

layer8 2y ago
It’s still end-to-end-encrypted, but the attacker effectively controls both ends. There is no backdoor.

ww520 2y ago

I never knew Apple let anyone access the lost announcement messages from the AirTags sent through iCloud.

layer8 2y ago
You need the private key associated with the AirTag in order to decrypt the result.
- octoberfranklin 2y ago
  ... and an Apple Account with an SMS-verified telephone number. And of course by requesting a result, you're letting Apple know that your Apple Account cares about a particular Airtag. All the FindMy anonymity claims go out the window as soon as you actually lose something and want to find it. It's only anonymous if you don't query the network.
  - malmeloo 2y ago
    Actual Airtags rotate their keys on a daily basis (when in lost mode), and Apple can't predict those keys. Theoretically they could tell that you're looking for a tag reported by devices x y and z, but the actual locations are encrypted.

ctkhn 2y ago

I get that this is an attack, but if I could get this on my own non-apple bluetooth devices that would be really convenient.

1024core 2y ago
This was posted a month ago: https://news.ycombinator.com/item?id=42835772 https://news.ycombinator.com/item?id=42835772

ohxhgtj 2y ago

[flagged]

Rebelgecko 2y ago

Nice. I have some Chipolo trackers but the tracking is pretty bad compared to air tags. Would this approach let me make them trackable via Apple's network too?

malmeloo 2y ago
Only if you manage to flash custom firmware on them. But there's already been many efforts on creating firmware for devices costing only a few bucks each, so that's probably easier.

deleted 2y ago

[deleted]

rubatuga 2y ago

For those who don't want their iPhone participating in the Find My network, from my understanding, turning off iCloud disables the sharing of BLE advertisements.

Angostura 2y ago
Simply turning off Find My Phone does the same, I believe

reader9274 2y ago

Something straight out of Samy Kamkar's book. Nice

slicktux 2y ago

So, this vulnerability requires root access to a device… That means I can make my own laptop broadcast lost beacons and I’ll have free anti-theft tracking of my device!?

tensility 2y ago

In the spirit of constructive criticism, I'd suggest that the GPU section of the summary feels like a fish out of water and should probably either be removed or supplemented with a bit more context from the actual paper. Cheers.

cantrecallmypwd 2y ago

Seems like this opens up the possibility of open source hw/sw compatible AirTags and virtual AirTags, yeah?