Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

Post reply on HN
Print view View original

101–110 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#101

Post by Animats »

PurpleFoxy wrote: post #90
Animats wrote: post #88

The sending rate on the microcontroller is currently ~3 bytes/second. The latency is usually between 1 and 60 minutes. That's not much, but it has value for industrial machine-to-machine communications. (That's IoT without the hype.) Like commercial air conditioning units. They can send in minimal data ("compressor 1 running, compressor 2 stopped, system OK") to a maintenance service without needing a cellular accoun…

For critical data like that, it would make more sense to just have a modem on board. 5G should make this more possible with increased device limits.

Minimum cellular cost for very low data volumes is about $1.75/month.

5G is only useful if you need bandwith in an area with very high contention, like a stadium, or you're in an area remote enough that the lower frequencies work but the higher ones don't.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#102

Post by varenc »

tyingq wrote: post #60
tinus_hn wrote: post #54

Earlier quoted context omitted.

AirTags run firmware that can be remotely upgraded.

Any more info on "can be" ? For existing AirTags, they would have to already have that functionality (polling for updates). I can't find anything that says they do.

Their firmware can probably be updated in the same mysterious way AirPods firmware is updated.

Roughly, be in the presence of an iDevice for a certain amount of time under unknown conditions. The advice on the internet is usually something like "leave your AirPods charging and have your phone connected to them when you go to sleep, and they'll probably be updated in the morning".

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#103

Post by easton »

pbhjpbhj wrote: post #100
floatingatoll wrote: post #81

Earlier quoted context omitted.

Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!

I'm not in USA, but I've always read FCC as an administrative arm of government, do they do active monitoring and enforcement? Like of you fire up a rogue transmitter the FCC send officers to apprehend you?

They have an enforcement division. I’ve always heard if you start a pirate radio station with a bit too much signal, it’s only a matter of time before two agents come tell you to knock it off.

https://www.fcc.gov/enforcement

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#104

Post by xyzzy_plugh »

labawi wrote: post #97
xyzzy_plugh wrote: post #85

Earlier quoted context omitted.

Classically SMTP let you "relay" mail that neither originated or is destined for the specific server. Gmail, and most modern SMTP servers, only permit mail from or to a Gmail address/their primary domain. Edit: added clarification that all SMTP servers do not only permit Gmail addresses...

Is this sarcasm? As the gmail part is completely false. Relaying used to be a thing, before spammers and unwillingness to deal with it at the source (boot infected devices, originating AS / IX, .. ) resulted in a choice between a game of whack-a-mole or only accepting gmail¹. These days, relaying has to be setup on the specific relay server, the originating address needs to permit it (DNS SPF/DKIM/DMARC/whatever), an…

Ah I was a little unclear. Edited. I meant that free-for-all relaying is a thing of the past.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#105

Post by bngybmgrglflps »

refulgentis wrote: post #42
whoknowswhat11 wrote: post #16

Earlier quoted context omitted.

Um - I think you are totally missing the point - Apple is doing probably the only fully encrypted system - vs tile and friends where everything lives in a database. This is not compromising billions of iOS devices, which frankly remain FAR FAR more secure than 80% of the competitor handsets which in many cases seem to ship with backdoor built in by their mfgs.

Hmm, lots to unpack there, I'll stay focused on my iPhone,...I'm not so sure...the lead article on HN yesterday showed you can track people unrelated to tag's routes, live. https://www.intego.com/mac-security-blog/i-mailed-an-airtag-... I've gathered there's a beep if this is going on for 3 days, but...still not comfy with this. And this isn't a particularly fringe opinion, plenty of comments on the article wondering…

"Beep as anti-stalking measure" is somewhere between marketing spin and gaslighting. A lost AirTag chirps to serve its primary function of being recovered.

The timer is 3 days[1], which observers (Forbes, WaPo) agree is surprisingly unreasonable for this use case. We can infer it was never a serious design consideration.

On Android, decent Bluetooth is a gamble, but scanning will theoretically find one[2].

[1] https://daringfireball.net/linked/2021/04/20/moren-fine-prin... [2] https://lifehacker.com/try-using-a-bluetooth-scanner-app-to-...

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#106

Post by npunt »

thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

Yeah another use case is broadcasting air quality metrics for consumption by the Health app, to start capturing exposure to various air environments you spend a lot of time in (office being primary example). I talk about this air quality broadcast a bit toward the end of my piece on repositioning HomePod around air quality - https://nickpunt.com/blog/apples-next-homepod-should-monitor...

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#107

Post by geoduck14 »

thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

By the way, you can get Bluetooth telemetry sensors that connect to your phone and upload the data via cell phone.

It might be easier than any of the stuff you described above.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#108

Post by astrange »

npunt wrote: post #106
thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

Yeah another use case is broadcasting air quality metrics for consumption by the Health app, to start capturing exposure to various air environments you spend a lot of time in (office being primary example). I talk about this air quality broadcast a bit toward the end of my piece on repositioning HomePod around air quality - https://nickpunt.com/blog/apples-next-homepod-should-monitor...

Health doesn't track air quality, but HomeKit does, and I believe it already has a mesh protocol (Thread) though I don't know how it works.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#109

Post by wiml »

chris37879 wrote: post #87
laurent92 wrote: post #82

Earlier quoted context omitted.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

I had a professor that made us answer questions about the bandwidth, latency, and reliability of a stationwagon loaded with hard drives. I never imagined I'd see a practical example of that principal at work.

Cloud providers like AWS will do data import/export via racks of drives in a shipping crate, if you have that much data. [1] (Or just a few drives in the mail if you're not moving petabytes.)

On the other end of the enterpriseyness scale, but still an actual real-world use, there's SD cards attached to homing pigeons [2], in addition to numerous stunts or pranks ala RFC1149.

[1] https://aws.amazon.com/snowball/#Snowball_Data_Transfer

[2] https://www.denverpost.com/2007/06/22/homing-pigeons-get-dow...

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#110

Post by varenc »

tyingq wrote: post #62
thebean11 wrote: post #61

Earlier quoted context omitted.

I was thinking something more along the lines of rate limiting, doesn't this exploit depend on lots of spammy requests?

Rate limiting would help with the "hijacking the network to send your own data" piece in the original article. It wouldn't do much for other uses, like tracking people without their knowledge. A "faked AirTag", could, for example, rotate it's serial number to avoid triggering Apple's "AirTag Found Moving With You" feature. Or the opposite of that. You could stick a fake device on someone's car and trigger the "AirTag…

Presumably a valid serial number for each AirTag is something that can't be guessed? That's how it is with Apple's other products. Each serial number has some entropy in it and there's no way to generate a valid new one.
Post reply on HN