It was always possible to configure a victim device to be a Bluetooth beacon if you had root on the victim device. You just clone an AirTag to the victim by cha

It was always possible to configure a victim device to be a Bluetooth beacon if you had root on the victim device. You just clone an AirTag to the victim by changing the victim's Bluetooth address (using root access) and start broadcasting FindMy beacons. What is novel in this attack is that you can use non-root access. You observe the victim's fixed Bluetooth address, and then craft a FindMy beacon that happens to match. Since the FindMy beacon is basically just a public key that the receiver uses to encrypt location data, crafting the beacon is just finding a public/private key pair that matches the victim's Bluetooth address. Since broadcasting a beacon requires less rights (less than root), this is much more broadly exploitable (excluding the expensive precomputation step).