Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

Post reply on HN
Print view View original

121–130 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#121

Post by bscphil »

tyingq wrote: post #38

Sounds like you could drive someone a bit crazy with Apple's "AirTag Found Moving With You" feature, since you could rotate serial numbers. Like gluing one of these to their car in someplace not obvious.

> since you could rotate serial numbers

Wait, maybe I'm confused, but isn't the point behind rotating serial numbers that the person couldn't just click ignore? But how much sense does that make, if people are routinely ignoring tracking devices glued to their cars instead of finding and disabling them, that seems like... a problem. A tracking device that decides to re-alert you to its presence rather than remain hidden and silent seems like a less dangerous tracking device, rather than the other way around.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#122

Post by amelius »

etskinner wrote: post #80
amelius wrote: post #43

Would it be possible to relay communication between iPhone and the AirTag, making the iPhone think the tag is in a different location than it actually is?

The communication is one-way, and the only thing transmitted from the lost device is the bluetooth public key, so no. The device that detected the AirTag encrypts the location with the public key and transmits it to Apple, not the AirTag itself.

But what if there is a man in the middle, X: tag sends Bluetooth key to X, then X relays that (e.g. over the internet) to Y which sends it to an IPhone.

And since the communication is one way, there is no encryption (I suppose), so replay-attacks should be possible unless it uses a clock.

Someone could write an app which reads Bluetooth IDs and then transmits them at random times.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#123

Post by tialaramex »

mhandley wrote: post #64
tialaramex wrote: post #56

Earlier quoted context omitted.

Suppose a real AirTag owner is wondering where their lost tag is. Although it would be ideal to learn where it is right now they'd be somewhat happy to know where an iPhone "saw" it two hours ago, or indeed a week ago... and Apple's system deliberately stores up to a week of data. A week is about 700 keys to check. For one "lost" device, but as you note Apple are happy for you to buy more than a dozen, and of course…

It's not the number of keys you check - that can indeed be large. It's the number of responses for different keys you receive with recorded receipt timestamps in the same 15 minute interval. If that is greater than 16 (or perhaps 32 given a normal tag can send two different keys in the same 15 min interval), Apple will know you're either querying more than 16 tags, or have tags using more than one key each.

The timestamps are useful to Apple only so that its storage needs don't grow continuously over time, it gets to throw away material it was told about seven days ago.

Because AirTag is designed not to chew battery lifetime on the various Apple devices which are effectively drafted to report they saw an AirTag those devices have no limit on how long they can take to get around to telling Apple what they saw. So Apple does have a "timestamp" but that doesn't tell them when the BLE happened, it just helps them purge their database tables.

Either the site linked or the paper (I can't remember which) has a chart showing that it can take at least hours for some iDevices to be comfortable that it's time to tell Apple. Maybe they're configured not to spend $$$ on mobile Internet and waited until they saw a friendly WiFi AP, maybe they got low on battery and went dormant until charged that evening.

Apple's main "defence" appears to be, as usual, that stuff is designed to be hard to use unless you've given Apple money, thus defending Apple's profitability but not really its customers of course. So a Mac can easily be tricked into doing this stuff (as was done for the article), but you'll need to do a bunch of custom reverse engineering to write a PC app and periodically Apple will casually break it, not because this helps their users but because it protects revenue. I predict some researchers will do that reverse engineering work, Bad Guys will just buy a MacBook.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#124

Post by saagarjha »

varenc wrote: post #102
tyingq wrote: post #60

Earlier quoted context omitted.

Any more info on "can be" ? For existing AirTags, they would have to already have that functionality (polling for updates). I can't find anything that says they do.

Their firmware can probably be updated in the same mysterious way AirPods firmware is updated. Roughly, be in the presence of an iDevice for a certain amount of time under unknown conditions. The advice on the internet is usually something like "leave your AirPods charging and have your phone connected to them when you go to sleep, and they'll probably be updated in the morning".

AirPods have a consistent source of power, though. AirTags run off a coin cell.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#125

Post by tyingq »

bscphil wrote: post #121
tyingq wrote: post #38

Sounds like you could drive someone a bit crazy with Apple's "AirTag Found Moving With You" feature, since you could rotate serial numbers. Like gluing one of these to their car in someplace not obvious.

> since you could rotate serial numbers Wait, maybe I'm confused, but isn't the point behind rotating serial numbers that the person couldn't just click ignore? But how much sense does that make, if people are routinely ignoring tracking devices glued to their cars instead of finding and disabling them, that seems like... a problem. A tracking device that decides to re-alert you to its presence rather than remain hid…

You can either rotate it after the time period where it alerts them, to be annoying (they have to keep dismissing it). Or, you rotate it before it alerts them, and stitch the tracking together. That's the more dangerous bit. Apple only alerts if a specific tag is following you for more than X whatever.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#126

Post by angry_octet »

baby-yoda wrote: post #18

does apple provide a way to opt out of the FindMy network?

You can opt your phone out of participating, but of course that won't stop other people's iPhones and iPads reporting the position of any AirTags they see near you.

It's unfortunate that, even though your phone can leave FindMy, it isn't as straightforward as going into Airplane Mode. You certainly can't choose to disable it at certain locations.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#127

Post by angry_octet »

amelius wrote: post #122
etskinner wrote: post #80

Earlier quoted context omitted.

The communication is one-way, and the only thing transmitted from the lost device is the bluetooth public key, so no. The device that detected the AirTag encrypts the location with the public key and transmits it to Apple, not the AirTag itself.

But what if there is a man in the middle, X: tag sends Bluetooth key to X, then X relays that (e.g. over the internet) to Y which sends it to an IPhone. And since the communication is one way, there is no encryption (I suppose), so replay-attacks should be possible unless it uses a clock. Someone could write an app which reads Bluetooth IDs and then transmits them at random times.

I think spoofing will be difficult unless you can dump the key from a specific AirTag (already done, but it's a manual process involving disassembly and advanced skills and equipment).

Replay attacks may be possible, but we will have to wait to see if the protocol is entirely passive. The iPhone could broadcast a challenge to the AirTag and transmit the signed response and response delay. The delay should be fairly tightly bounded.

The AirTags do have a clock as I understand it, but drift is inevitable, so it wouldn't be a tight bound.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#128

Post by BenjiWiebe »

yftsui wrote: post #114
PurpleFoxy wrote: post #90

Earlier quoted context omitted.

For critical data like that, it would make more sense to just have a modem on board. 5G should make this more possible with increased device limits.

5G is notoriously known for smaller coverage area than LTE, it made IOT impossible instead of possible.

I believe the 5G standard also includes a low-band protocol as well, which to my understanding is strictly superior to 4G.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#129

Post by floatingatoll »

pbhjpbhj wrote: post #100
floatingatoll wrote: post #81

Earlier quoted context omitted.

Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!

I'm not in USA, but I've always read FCC as an administrative arm of government, do they do active monitoring and enforcement? Like of you fire up a rogue transmitter the FCC send officers to apprehend you?

USPS has an enforcement division as well!

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#130

Post by YeBanKo »

It’s interesting, that this use case is only possible because Apple tries to preserve privacy of the devices. Unlike Amazon Sidewalk, that requires to authentication of the IoT device, Apple does not, allowing unauthorized devices using the network.
Post reply on HN