Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Find You: Building a stealth AirTag clone

positive.security

Post reply on HN
Print view View original

51–60 of 105 posts

Re: Find You: Building a stealth AirTag clone

#51

Post by gruez »

mox1 wrote: post #26
smithza wrote: post #24

Earlier quoted context omitted.

It is a difficult technical problem for Apple to solve all of the corner-cases. The article shows the screenshot of seemingly 100 unique FindMy devices around this guy's personal residence... there may be some characterization work that can help solve that so an iPhone user would get the alert message. But Apple will continue to promote it and dismiss or downplay these security concerns.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

> The problem is easy to solve, just store copies of all public keys of each air tag you send out.

that kills the privacy aspect of it, because it also means apple knows about the exact whereabouts of each tag. airtags are specifically designed/marketed so apple can't do that.

Re: Find You: Building a stealth AirTag clone

#52

Post by gruez »

giaour wrote: post #17
noja wrote: post #3

Other trackers don't tell you they are tracking you though, what about those.

You can purchase pre-made GPS+cellular trackers, but it seems like it would be much easier to tie a detected tracker of this type back to a specific person. A tracker with cellular capability will have a SIM and some kind of subpoena-able service record, while one of the pirate AirTags described in the post is basically just an antenna and a battery.

>A tracker with cellular capability will have a SIM and some kind of subpoena-able service record

Prepaid sim. US (and many other countries) does not have mandatory registration for SIM cards. See: https://www.gsma.com/publicpolicy/wp-content/uploads/2013/11...

Re: Find You: Building a stealth AirTag clone

#53

Post by gorbypark »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

I’ve just moved to Spain, from Canada, and was wondering the same. A quick google search shows iPhone has less than 12% market share here. I did a little test in Valencia about a week ago by just walking around with my AirTag on my keys in “lost mode” and they got picked up very frequently. I was pretty happy with the results, I don’t think approximately only one in ten people on the streets having an iPhone would have much effect on the usefulness.

Re: Find You: Building a stealth AirTag clone

#54

Post by [deleted] »

moffkalast wrote: post #39
eyeeyesawayyy wrote: post #23

Earlier quoted context omitted.

Airtags are unique in that they use every iphone in the world as part of the network which tracks them and reports their locations. So, unlike GPS trackers or competing Bluetooth trackers, AirTags can do two things: * Last for a very long time on a small battery, no recharging required. * Reliably report location anywhere in the world that an ordinary person is likely to be.

I've always been sceptical of this working well enough to be usable. Does the average iphone owner leave their bluetooth, gps, and mobile network on 24/7? Sounds like an awful waste of power. What about in the rest of the world outside the US, Canada and Australia where Android is the market leader and iphones are rather rare? What happens inside buildings when the phone doesn't have a fix? Does it store the tag's ke…

[deleted]

Re: Find You: Building a stealth AirTag clone

#55

Post by Friday_ »

rahimnathwani wrote: post #20
Friday_ wrote: post #6

Why not build your own tracker that doesn't rely on Apple. You only have to have GPS, LoRaWAN, MCU, battery, and antenna, That's about it.

Because: - using a cellular modem requires a high capacity battery - if you hide a tracker well, it probably won't have a good GPS reception Apple's BLE-based network solves both of these problems.

Those are not problems that needed to be solved.

Problem is: 1. Precise location of tracked object, now

This is actually one problem and Apple didn't solve it very well, airtag doesn't work in real-time. You only get updates when there are people near object that uses iphone.

Re: Find You: Building a stealth AirTag clone

#56

Post by quenix »

Friday_ wrote: post #55
rahimnathwani wrote: post #20

Earlier quoted context omitted.

Because: - using a cellular modem requires a high capacity battery - if you hide a tracker well, it probably won't have a good GPS reception Apple's BLE-based network solves both of these problems.

Those are not problems that needed to be solved. Problem is: 1. Precise location of tracked object, now This is actually one problem and Apple didn't solve it very well, airtag doesn't work in real-time. You only get updates when there are people near object that uses iphone.

> You only get updates when there are people near object that uses iphone.

Ok? In practice, this is most of the time. In most reasonable use cases (i.e. excluding the Sahara desert or some remote mountain).

Re: Find You: Building a stealth AirTag clone

#57

Post by jedberg »

AirTag is a difficult problem to solve -- the usefulness of the product for "good" uses is directly related to how easy the "bad" uses are. Eventually it will be limited to the point where you can only track items that your phone can detect, and that won't be super helpful.

Sure you can use it to find your lost keys in your own house and maybe have it warn you when you've been separated from your AirTag, but that's about it.

Re: Find You: Building a stealth AirTag clone

#58

Post by adhesive_wombat »

air7 wrote: post #49

It seems to me that this attack leaves a very easy to detect signature of several tags that were seen only once by the same device. To counter being detected, an attacker would need to fake other readings of the same single-use "tags" by other devices. This is somewhat similar to the detecting fake spam accounts in social networks. It's a cat-and-mouse game, but it seems that in this case the cat has the upper hand u…

Not that hard, but no longer trivially done by just buying the inevitable stealth AirTag clones.

Step one: Set up one of these with a known sequence of keys: either preloaded or a derivation function (to allow it to run continuously). Plant it on your victim.

Step two: set up another one with the same key sequence, but delay it (or advance it), so that the same keys are presented, but on a delay. Plant this one in a public place with lots of iPhones, ideally moving around like on a bus or train.

Now, the keys won't be unique any more. With a bit more thought, you can probably figure a way to make it even less obvious (the decoy tags rotate faster and reuse old keys on a cycle, perhaps, so they keep pinging up and obscuring the single real one).

A lot more effort than a buy and forget device, for sure.

Figuring out a strategy to counter such an attack would be a fascinating game of real life tower defense, if not for the fact that if you fail, people get harmed.

Still seems mad to me that the tags aren't also rocking some kind of secure enclave so that they can, say, cryptographically sign off as genuine. Crypto chips are (perhaps literally if you own the silicon anyway) ten a penny. Even without the security implications, seems like leaving money on the table to me, which is unlike Apple.

Re: Find You: Building a stealth AirTag clone

#59

Post by 542458 »

stefan_ wrote: post #46
mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

The mental model I had is that AirTags are manufactured with a private/public key pair burned into them that allows Apple to validate the thing you are linking to your account on initial setup is really a legit AirTag. It appears none of that was ever true and you can register just anything as an AirTag that speaks the right BLE with no secrets required for a world full of iPhones to start tracking them. So yeah, exp…

I feel that if the stalker is buying dedicated stalking gear online there are “better” options - you can get actual compact GPS trackers that report over cellular for $10-20.

Re: Find You: Building a stealth AirTag clone

#60

Post by semioticthrowa »

gruez wrote: post #51
mox1 wrote: post #26

Earlier quoted context omitted.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

> The problem is easy to solve, just store copies of all public keys of each air tag you send out. that kills the privacy aspect of it, because it also means apple knows about the exact whereabouts of each tag. airtags are specifically designed/marketed so apple can't do that.

Software (and I guess hardware too) is about tradeoffs. The tradeoff here is that in not being able to validate if a device is a valid Airtag is that Apple has created a massive, completely uncontrollable surveillance network. The fact that anyone can interrogate the network to track devices that aren't even guaranteed to be running the official firmware or have the official hardware is insane. Not having Apple be able to know the location of the tags is pretty much irrelevant in the face of this downside.
Post reply on HN