Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

41–50 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#41
post #38

Sounds like you could drive someone a bit crazy with Apple's "AirTag Found Moving With You" feature, since you could rotate serial numbers. Like gluing one of these to their car in someplace not obvious.

If there’s abuse, you can count on a “report” button showing up. Or at least a “don’t show me this” tied to a specific AirTag

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#42

This is starting to remind me of when Intelligent Tracker Prevention(tm) was released and instead was a super cookie leaking history. http://blog.lukaszolejnik.com/curious-case-of-privacy-vulner... I'd be much more comfortable with Apple being Privacy, Inc. if they kept their commitment to it, too often it looks like engineers got overrode by marketing. It's v unlikely a privacy engineer signed off on something, with…

Um - I think you are totally missing the point - Apple is doing probably the only fully encrypted system - vs tile and friends where everything lives in a database. This is not compromising billions of iOS devices, which frankly remain FAR FAR more secure than 80% of the competitor handsets which in many cases seem to ship with backdoor built in by their mfgs.

Hmm, lots to unpack there, I'll stay focused on my iPhone,...I'm not so sure...the lead article on HN yesterday showed you can track people unrelated to tag's routes, live. https://www.intego.com/mac-security-blog/i-mailed-an-airtag-...

I've gathered there's a beep if this is going on for 3 days, but...still not comfy with this. And this isn't a particularly fringe opinion, plenty of comments on the article wondering how to opt out:

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#44
post #41
post #38

Sounds like you could drive someone a bit crazy with Apple's "AirTag Found Moving With You" feature, since you could rotate serial numbers. Like gluing one of these to their car in someplace not obvious.

If there’s abuse, you can count on a “report” button showing up. Or at least a “don’t show me this” tied to a specific AirTag

Right, but you can rotate arbitrary serial numbers and apple IDs on the device. Pre-create 1000 of them.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#47
post #39

This could have been an immensely powerful covert communications channel for field operators of military and intelligence services

It feels like Apple's ability to fix this is somewhat limited, since they can't change anything about Airtags that have already been produced.

Couldn't a software change on the iPhone side prevent it?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#48

This could have been an immensely powerful covert communications channel for field operators of military and intelligence services

No, they have other less detectable methods. Your idea shows an awesome train of thought though. Ever thought about switching careers?

As far as this method, the IC has thought about this very method for a long time. I’d be surprised if it wasn’t been used in the past.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#49
post #14

Earlier quoted context omitted.

Sidewalk's bandwidth and latency is a little better than this, though.

Sidewalk also has the advantage of mostly being home internet connection instead of metered wireless plans

Sidewalk is also connected to grid power, and the backbone consumer devices are in fixed locations. I don’t see grid vs battery or fixed/mobile device locations as necessary advantages or disadvantages though.

For example, the FindMy network would continue to work even in power outage scenarios like parts of the country experienced in Feb 2021.

Post reply on HN