Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Find You: Building a stealth AirTag clone

positive.security

Post reply on HN
Print view View original

61–70 of 105 posts

Re: Find You: Building a stealth AirTag clone

#61

Post by rahimnathwani »

Friday_ wrote: post #55
rahimnathwani wrote: post #20

Earlier quoted context omitted.

Because: - using a cellular modem requires a high capacity battery - if you hide a tracker well, it probably won't have a good GPS reception Apple's BLE-based network solves both of these problems.

Those are not problems that needed to be solved. Problem is: 1. Precise location of tracked object, now This is actually one problem and Apple didn't solve it very well, airtag doesn't work in real-time. You only get updates when there are people near object that uses iphone.

> Those are not problems that needed to be solved.

An AirTag might help me find my keys if they fall out of my pocket in a restaurant restroom. A cellular-based tracker won't because (1) it will be out of battery, and (2) it won't have a GPS signal.

Re: Find You: Building a stealth AirTag clone

#62

Post by Friday_ »

rahimnathwani wrote: post #61
Friday_ wrote: post #55

Earlier quoted context omitted.

Those are not problems that needed to be solved. Problem is: 1. Precise location of tracked object, now This is actually one problem and Apple didn't solve it very well, airtag doesn't work in real-time. You only get updates when there are people near object that uses iphone.

> Those are not problems that needed to be solved. An AirTag might help me find my keys if they fall out of my pocket in a restaurant restroom. A cellular-based tracker won't because (1) it will be out of battery, and (2) it won't have a GPS signal.

I guess its a good key finder, maybe best key finder there is. But we are seeing people explore other posibilities. Can it track vehicles, people, or pets? Some people say that this key finder is revolution. I dont think so.

Re: Find You: Building a stealth AirTag clone

#63

Post by dj_mc_merlin »

Aren't AirTags implicitly linked to an Apple account? 99% of people have no clue how to hide their IP, you can get tracked back by the police so easily (and Apple + telcos + VPNs located in US+ jurisdiction _will_ help the police/FBI). It's almost a benefit to society: a way to enable people to commit crimes in the stupidest way possible.

Re: Find You: Building a stealth AirTag clone

#64

Post by iudqnolq »

dj_mc_merlin wrote: post #63

Aren't AirTags implicitly linked to an Apple account? 99% of people have no clue how to hide their IP, you can get tracked back by the police so easily (and Apple + telcos + VPNs located in US+ jurisdiction _will_ help the police/FBI). It's almost a benefit to society: a way to enable people to commit crimes in the stupidest way possible.

Yes and no. Quoting TFA:

> While OpenHaystack-based AirTag clones are not paired with an Apple ID, the retrieval of location reports requires authentication. Such an account however can be created anonymously using an email address without any identity/KYC-verification.

> The OpenHaystack team currently even considers running a server that proxies those location report requests, which in the future might take away the need to create an account oneself.

Imagine a clone. They use the apple network for free, while white-labeling it. They could create accounts with their own emails and IPs, and forward the data to users.

Re: Find You: Building a stealth AirTag clone

#65

Post by giaour »

gruez wrote: post #52
giaour wrote: post #17

Earlier quoted context omitted.

You can purchase pre-made GPS+cellular trackers, but it seems like it would be much easier to tie a detected tracker of this type back to a specific person. A tracker with cellular capability will have a SIM and some kind of subpoena-able service record, while one of the pirate AirTags described in the post is basically just an antenna and a battery.

>A tracker with cellular capability will have a SIM and some kind of subpoena-able service record Prepaid sim. US (and many other countries) does not have mandatory registration for SIM cards. See: https://www.gsma.com/publicpolicy/wp-content/uploads/2013/11...

You can buy a prepaid SIM, but it still needs to be activated with the service provider, and it will report the IMEI to the operator as part of maintaining a network connection. If the victim discovers the tracking device and reports it to the police, the police will be able to discover (from the service provider's records) where the SIM was activated and what payment method is used for service. If the SIM was prepaid, the network operator will have a pretty good idea of where it was sold (by tying the SIM number to a wholesale lot number), and that would give police a narrow pool of suspects (whoever bought a prepaid SIM from that seller while the wholesale lot was on their shelves) to work from. If anyone bought a prepaid SIM with cash, they may have been caught on security camera doing so. I guess if the perpetrator bought the SIM online with Monero, investigators might hit a dead end.

Compare that to the difficulty of tracking down where a commodity BLE antenna and battery pack were sold.

Re: Find You: Building a stealth AirTag clone

#66

Post by iudqnolq »

mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

You get 37 bytes, and an optional extra 37 bytes with a more complex negotiation.

Re: Find You: Building a stealth AirTag clone

#67

Post by stefan_ »

542458 wrote: post #59
stefan_ wrote: post #46

Earlier quoted context omitted.

The mental model I had is that AirTags are manufactured with a private/public key pair burned into them that allows Apple to validate the thing you are linking to your account on initial setup is really a legit AirTag. It appears none of that was ever true and you can register just anything as an AirTag that speaks the right BLE with no secrets required for a world full of iPhones to start tracking them. So yeah, exp…

I feel that if the stalker is buying dedicated stalking gear online there are “better” options - you can get actual compact GPS trackers that report over cellular for $10-20.

Stop comparing AirTag to GPS trackers, it's absurd. GPS is an incredibly faint signal that is entirely attenuated in any indoor spaces and most clever hiding places you could come up, all the while being very obviously inferior to the multitude of strategies smartphones use to determine their position.

Re: Find You: Building a stealth AirTag clone

#68

Post by culi »

542458 wrote: post #59
stefan_ wrote: post #46

Earlier quoted context omitted.

The mental model I had is that AirTags are manufactured with a private/public key pair burned into them that allows Apple to validate the thing you are linking to your account on initial setup is really a legit AirTag. It appears none of that was ever true and you can register just anything as an AirTag that speaks the right BLE with no secrets required for a world full of iPhones to start tracking them. So yeah, exp…

I feel that if the stalker is buying dedicated stalking gear online there are “better” options - you can get actual compact GPS trackers that report over cellular for $10-20.

Can you really? I live in a place with a lot of coyotes so we bring our cat inside every day an hour or 2 before sunset. We bought a Tile (AirTag competitor) for her, but it's really not lived up to what we were hoping and I'd love for the possibility of getting an actual GPS device

Even if it's just for a few days so we can get a sense of what her typical route are so we could know where to look for her other days

But we couldn't find any such GPS device that was anywhere near the pricepoint of an Airtag or Tile unless it came with a really pricey subscription

Re: Find You: Building a stealth AirTag clone

#69

Post by gruez »

giaour wrote: post #65
gruez wrote: post #52

Earlier quoted context omitted.

>A tracker with cellular capability will have a SIM and some kind of subpoena-able service record Prepaid sim. US (and many other countries) does not have mandatory registration for SIM cards. See: https://www.gsma.com/publicpolicy/wp-content/uploads/2013/11...

You can buy a prepaid SIM, but it still needs to be activated with the service provider, and it will report the IMEI to the operator as part of maintaining a network connection. If the victim discovers the tracking device and reports it to the police, the police will be able to discover (from the service provider's records) where the SIM was activated and what payment method is used for service. If the SIM was prepai…

>it will report the IMEI to the operator as part of maintaining a network connection

>Compare that to the difficulty of tracking down where a commodity BLE antenna and battery pack were sold.

The ESP (or whatever BLE chipset was used) probably will have a mac address burned in, which is essentially an IMEI. You'll have a hard time getting anything from that, because the aliexpress supply chain that supplied the GSM GPS tracker keeps records and/or responds to US subpoena as well as the aliexpress supply chain that supplied the airtag clone.

>If the SIM was prepaid, the network operator will have a pretty good idea of where it was sold (by tying the SIM number to a wholesale lot number), and that would give police a narrow pool of suspects (whoever bought a prepaid SIM from that seller while the wholesale lot was on their shelves) to work from.

It was sold from a mobile phone kiosk at a mall

>what payment method is used for service

voucher purchased at the same store, both paid with cash

>If anyone bought a prepaid SIM with cash, they may have been caught on security camera doing so.

the purchase/activation of the sim occurred a month or two ago, outside of the retention range of the surveillance footage. even if the footage exists, all you'd see is a masked (thanks covid!) 5'8" white possibly hispanic male, wearing a hoodie and jeans.

Re: Find You: Building a stealth AirTag clone

#70

Post by giaour »

gruez wrote: post #69
giaour wrote: post #65

Earlier quoted context omitted.

You can buy a prepaid SIM, but it still needs to be activated with the service provider, and it will report the IMEI to the operator as part of maintaining a network connection. If the victim discovers the tracking device and reports it to the police, the police will be able to discover (from the service provider's records) where the SIM was activated and what payment method is used for service. If the SIM was prepai…

>it will report the IMEI to the operator as part of maintaining a network connection >Compare that to the difficulty of tracking down where a commodity BLE antenna and battery pack were sold. The ESP (or whatever BLE chipset was used) probably will have a mac address burned in, which is essentially an IMEI. You'll have a hard time getting anything from that, because the aliexpress supply chain that supplied the GSM G…

> It was sold from a mobile phone kiosk at a mall

>> what payment method is used for service

> voucher purchased at the same store, both paid with cash

>> If anyone bought a prepaid SIM with cash, they may have been caught on security camera doing so.

> the purchase/activation of the sim occurred a month or two ago, outside of the retention range of the surveillance footage. even if the footage exists, all you'd see is a masked (thanks covid!) 5'8" white possibly hispanic male, wearing a hoodie and jeans.

That's so much op sec that you wouldn't have to do to exploit the Find My protocol! And let's hope the mall didn't change their retention interval and that the same 5'8" white male didn't do something stupid like buy something with a credit card on the same trip or park in the mall parking lot.

Post reply on HN