Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Find You: Building a stealth AirTag clone

positive.security

Post reply on HN
Print view View original

41–50 of 105 posts

Re: Find You: Building a stealth AirTag clone

#41

Post by stefan_ »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

AirTags exist and they work perfectly fine in all these conditions. We would need to turn the clock back a few years for this comment to make sense, in an universe where AirTags didn't yet exist.

Your phone takes it's last position from GPS, refines it with RSSI of nearby WiFi networks and then you add in the broadband stuff they have to localize the tag further.

Re: Find You: Building a stealth AirTag clone

#42

Post by xt00 »

IshKebab wrote: post #30
mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

Yeah I don't understand this. Surely airtags have to be registered, and when an iPhone sees tag 3957375967 Apple's servers look that up and say "oh it's registered to Billy Bob; I'll tell them". But if your fake airtag rotates through 2000 IDs how do you register them all?

Seems like the end-game for this is to change things around like this:

1. you can't track items outside of some distance from you in real-time

2. items marked as lost would need to be sent to a review team inside apple (contractors I imagine) that would then log your information, require you to explain what the item is, and generally make it very cumbersome to get the actual location or history of the location

3. then very likely a neutral 3rd party would have to go to the location to determine if the claim seems to be legitimate, or this is a case of somebody stalking somebody else or something

4. likely would require police getting involved somehow

The idea that people can be vigilante's and track down their own stolen bike is a great idea, but it basically equates to "stalking somebody".. any work-arounds for android users and iphone users will either only work in certain circumstances (what if you only live 1 mile away from the bars downtown -- then now the stalker knows where you live and the device was with you a super short period of time -- maybe 2-5 mins depending upon method of travel)... the only way around this is to block people from being able to get the raw information -- sure the data might be collected, but giving it directly to the customer is both the best and worst thing about this.

Re: Find You: Building a stealth AirTag clone

#43

Post by mmastrac »

mox1 wrote: post #40
anchpop wrote: post #38

Earlier quoted context omitted.

A core selling point of Airtags is that other people's iPhones help you find your AirTag. That's also what makes them effective trackers. It's a bit of an unsolvable problem.

Yes, and Apple 100% has the capacity / ability to filter out "fake" AirTags on their back-end. All they need to do is setup a manufacturing process that captures the public keys. So the phones will still relay the beacons to Apple, who can then do things and just reject messages from these fake tags. (I worked for a Medical Device Company that set all of this up within our supply chain).

If they haven't been doing this so far, it seems like it will be a tough job to record them after the fact. Perhaps they could interrogate each device and require it to be re-adopted, then record the data at that point but it seems like an arms race they won't win.

Re: Find You: Building a stealth AirTag clone

#44

Post by gumby »

smithza wrote: post #21
mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

Apple will probably say something to the effect of, "we didn't have to put anti-stalking technology in, and it works well for the 99% of use cases." The common stalker will not have the technical skills to build their own custom-firmware version of a BLE-enabled system. I don't think this revelation will kill the product line.

> The common stalker will not have the technical skills to build their own custom-firmware version of a BLE-enabled system.

The state or corporate actor will have those skills.

The common stalker will simply buy them online.

Re: Find You: Building a stealth AirTag clone

#45

Post by gumby »

mmastrac wrote: post #43
mox1 wrote: post #40

Earlier quoted context omitted.

Yes, and Apple 100% has the capacity / ability to filter out "fake" AirTags on their back-end. All they need to do is setup a manufacturing process that captures the public keys. So the phones will still relay the beacons to Apple, who can then do things and just reject messages from these fake tags. (I worked for a Medical Device Company that set all of this up within our supply chain).

If they haven't been doing this so far, it seems like it will be a tough job to record them after the fact. Perhaps they could interrogate each device and require it to be re-adopted, then record the data at that point but it seems like an arms race they won't win.

They are just getting started. They could add this to their production — the old ones would quickly become a tiny percentage

Re: Find You: Building a stealth AirTag clone

#46

Post by stefan_ »

mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

The mental model I had is that AirTags are manufactured with a private/public key pair burned into them that allows Apple to validate the thing you are linking to your account on initial setup is really a legit AirTag.

It appears none of that was ever true and you can register just anything as an AirTag that speaks the right BLE with no secrets required for a world full of iPhones to start tracking them.

So yeah, expect chinese clones to show up within a month, for five dollars each and certainly no speaker included.

Re: Find You: Building a stealth AirTag clone

#47

Post by planb »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

> Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7?

Yes of course. That's how these phones are supposed to work. I don't have time to micromanage my devices. As long as I get a day of usage, why would I bother?

Re: Find You: Building a stealth AirTag clone

#48

Post by jimjambw »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

Why wouldn't you leave those things on? Apple designed iOS for those things to be handled and turned on when needed. BLE is quite low in power, GPS is only on when location services need it. These are concerns I would have had about 10-15 years ago, but I don't now.

Re: Find You: Building a stealth AirTag clone

#49

Post by air7 »

It seems to me that this attack leaves a very easy to detect signature of several tags that were seen only once by the same device. To counter being detected, an attacker would need to fake other readings of the same single-use "tags" by other devices. This is somewhat similar to the detecting fake spam accounts in social networks. It's a cat-and-mouse game, but it seems that in this case the cat has the upper hand unless the mice are willing to put in a lot of effort to fake "realness", which might make the attack not feasible.

Re: Find You: Building a stealth AirTag clone

#50

Post by jaywalk »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

> Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7?

Absolutely, yes.

> What happens inside buildings when the phone doesn't have a fix?

Have you never used your phone inside a building before? It still has a very good idea of your location, it doesn't rely solely on GPS signals.

Post reply on HN