Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FindMy Flipper – AirTag and SmartTag Emulator

github.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: FindMy Flipper – AirTag and SmartTag Emulator

#41

Post by teaearlgraycold »

gruez wrote: post #32
nom wrote: post #19

Earlier quoted context omitted.

If it's not patched yet: I heard you can just power cycle a tag on a timer to evade detection. Add a large battery with a simple timer circuit, remove the beeper and you got yourself an amazing tracking device. IIRC this came up in the context of tracking shipments with expensive equipment, where it can be in transit for many months. The tags are so power efficient that they work for ages on a large battery, existing…

>If it's not patched yet: I heard you can just power cycle a tag on a timer to evade detection I'm not sure how apple could ever patch it. If you were willing to add a power-cycling microcontroller to your airtag, it wouldn't be that much effort to also add a bank of airtags to cycle through, which would make the apparatus totally indistinguishable from a group of airtags coming in and out of range constantly.

Well, not totally indistinguishable. But hard to write hard coded rules for.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#43

Post by panki27 »

theturtletalks wrote: post #40
_lvbh wrote: post #26

Earlier quoted context omitted.

Not OP but I still use mine quite frequently. - My family’s old subhz car keys are dying so I cloned it & use the flipper when the real one doesn’t work. It’s a car from before the 2000s so no security whatsoever. - Apartment, lift, gym rfid. Don’t need to bring multiple sets of cards - IR is also helpful as a backup while I procrastinate going out and buying batteries for some remotes.

I thought many gym and apartment key fobs can’t be replicated due to rolling keys. Has this been addressed or flipper works on older fobs?

Rolling keys is more of an RF thing, fobs are NFC or RFID (rolling key is still vulnerable to a simple replay attack).

For NFC/RFID it depends entirely on the card. You can easily clone Mifare Classic, but on newer ones there's no way I know of, and the software does not (yet) have support for Legic (which has been broken for over a decade).

Re: FindMy Flipper – AirTag and SmartTag Emulator

#44

Post by dpifke »

phasE89 wrote: post #9
nunobrito wrote: post #8

Still using flipper a few times per week. Looking forward to the next edition with Wi-Fi and other frequencies.

What do you use it for?

My dogs' microchips have a body temperature sensor. When one of them is acting like they might be sick, I can take their temperature with via my Flipper's RFID reader.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#45

Post by Nereuxofficial »

stavros wrote: post #4
xnzakg wrote: post #2

Sadly this requires a "donor" tag to impersonate (which then can't be used for as long as you want this to work), or using OpenHaystack which requires using a Mac in order to get the data.

It doesn't, I use it without an AirTag on my Linux machine. It works fine.

How do i use it without an Airtag? At the step number 9 the setup asks me to enter an Apple ID, which i do not have. Is there a way to track it on Android or Linux without an Apple ID?

Re: FindMy Flipper – AirTag and SmartTag Emulator

#46

Post by withinboredom »

dmitrygr wrote: post #24
compsciphd wrote: post #15

Earlier quoted context omitted.

right, I'm actually wondering if one could build an esp32 device that did this itself (i.e. without the need of a flipper zero). Basically something in a similar form factor of an actual air tag. the anti-stalking features make airtags less useful for anti-theft (or theft discovery), as any aware thief can just disable the tag due to the anti-stalking feature (apple does note that its not designed for anti-theft purp…

> law enforcement mode > provide legally recognized law enforcement the ability to request the tracking record Where do you live where law enforcement cares about stolen property? 1985 America?

For anything that may be insured, they likely just want to get you your paperwork, so you can file a claim. Why bother getting something you can replace? For other things, they may care if there is an evidence trail to follow.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#47

Post by stavros »

Nereuxofficial wrote: post #45
stavros wrote: post #4

Earlier quoted context omitted.

It doesn't, I use it without an AirTag on my Linux machine. It works fine.

How do i use it without an Airtag? At the step number 9 the setup asks me to enter an Apple ID, which i do not have. Is there a way to track it on Android or Linux without an Apple ID?

You don't need a Mac to create an Apple ID, no? You just create one on the site. To be fair, I created mine years ago.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#48

Post by withinboredom »

ensignavenger wrote: post #35
circustaco wrote: post #23

Earlier quoted context omitted.

In the case that one is using an airtag for ant-theft purposes and they do not want to alert the thief of the existence of the airtag while maintaining the intention of the alerts (anti-stalking). ex. You notice your bike is stolen. immediately turn on law enforcement mode. The anti-stalking notifications are disabled but the owner can no longer track the airtag. However, after alerting the police, they could access…

"they could access the location of the device and investigate or recover the bike." Umm, where do you live that the police give a hoot about a stolen bike? Maybe Japan?

If a bunch of bikes keep ending up in the same place, they can likely sting some organized crime. That actually happens here in the Netherlands.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#49

Post by ForOldHack »

xyst wrote: post #22

very interesting project, but one of the downstream dependencies used here is insecure by default: https://github.com/biemster/FindMy/blob/113ebf4017729b92a381... Seems to be auth lib for iCloud. Also seems to hard code a MacBook device agent in order to associate the generated keys with a device. As with anything in the centralized world, I wouldn’t use this on an account with a high number of services/digital asset…

The auth lib for iCloud is inherently insecure, for you, and obviously not for Apple, Inc. I would fork this project into two separate products, which is abhorrent to do, but it must be done.

I would never consciously integrate a library from a third party. I am in the middle of scanning every single release of 'VenToy' into virus scanners, awaiting for the moment when an NZ-type vulnerability proves true.

Its not that Apples payment stream depends on this, its their subscription model.

Beware of offering a feature free that Apple thinks is interesting, they will lock you out, and start charging people for it.

Doubly beware of p*ssing off geeks, the will go to bed on Friday, in an angry state, and fervently work all weekend both to black box your product, but to trivialize the implementation of it. Now those are the really scary people.

Re: FindMy Flipper – AirTag and SmartTag Emulator

#50

Post by kstrauser »

phasE89 wrote: post #9
nunobrito wrote: post #8

Still using flipper a few times per week. Looking forward to the next edition with Wi-Fi and other frequencies.

What do you use it for?

Not OP, but I've used it to clone (my own!) hotel key cards. I've accidentally left my key in the room when I unlocked the door, then absentmindedly tossed the card onto the dresser instead of putting it right back into my wallet. It's nice to have a backup in my bag.

Other hotels have an iPhone app you can use to unlock your door. That's another nice backup, but I've found I can have my Flipper out and the room door open faster than I can open my phone, find the app, launch it, inevitably have to log back in because it's been more than 30 seconds since I last opened it, etc.

Post reply on HN