Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

Post reply on HN
Print view View original

71–80 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#71

Post by tyingq »

meepmorp wrote: post #68
tyingq wrote: post #65

Earlier quoted context omitted.

It would have to be automatic for it to be used to kill off "fake AirTags" . Unless Apple is willing to take the hit of all the complaining.

Why couldn't they update the firmware automatically? They already do that with AirPods, iirc.

It's a much cheaper device than Airpods, harder to manage battery life, and there's not yet evidence that they can update them automatically. As far as I can tell, competitor products (Tile, for example) don't update firmware automatically...it's a user-initiated thing.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#73

Post by X-Istence »

londons_explore wrote: post #67
mediaman wrote: post #58

Earlier quoted context omitted.

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

The power hungry bit is probably powering in the GPS to attach a location. On Android at least, getting a GPS fix takes many seconds, during which the CPU cannot sleep. For that reason, a default Android phone won't power up the GPS for hours on end sometimes. Yet this find-my feature might require a GPS position every few minutes whenever a new tag is seen. That's a lot of extra power.

Most users have Find My turned on for their devices so that if they are lost or stolen they can find them.

Find My on your phone already has to get an approximate location, and it does so fairly frequently (since you can track somewhat realtime).

So having an Air Tag piggy back on the same mechanism won't cost a whole lot in terms of having to power on the geolocation capabilities.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#74

Post by myself248 »

londons_explore wrote: post #67
mediaman wrote: post #58

Earlier quoted context omitted.

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

The power hungry bit is probably powering in the GPS to attach a location. On Android at least, getting a GPS fix takes many seconds, during which the CPU cannot sleep. For that reason, a default Android phone won't power up the GPS for hours on end sometimes. Yet this find-my feature might require a GPS position every few minutes whenever a new tag is seen. That's a lot of extra power.

If they were to officially support this use-case of arbitrary data transmission, you could also default to non-GPS-located transactions, which would save that power except in cases where the user has specified that they do need locations.

Also, coarse location (cellular and wifi) uses basically no power, and might be good enough for an awful lot of applications.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#75

Post by pbhjpbhj »

mediaman wrote: post #58
londons_explore wrote: post #26

Earlier quoted context omitted.

Every message uploaded to the "Find My" network very slightly degrades the user experience for all Apple users - since it is using up CPU cycles, battery and bandwidth of random strangers iPhones. I wonder what the capacity of the network is before the impact on battery life becomes significant...

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

This is probably wrong:

I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access.

As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing before you reject a fake tag. If they rate limit the decryption - which you'd have to - then you can overwhelm a device on the network by sending out fake packets.

It strikes me you can generate random BLE data that looks like airtag data cheaper than you can verify packets and so in theory one iPhone could overwhelm a minimum of one other; and presumably could overwhelm all others in range (with lower or equal processing power).

They do mention their (the OP's) public keys being rejected.

So, if my analysis is right you can either use all processing on all devices in range, or overwhelm all devices in range of they're rate-limited. The second case is preferable.

I'm interested in why I'm wrong. Can the imaginary fake tags in my analysis be rejected using less power than it takes to make them?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#76

Post by barbegal »

mhandley wrote: post #32

As there's a limit of 16 AirTags per Apple ID, and each AirTag's keys rotate every 15 minutes, presumably Apple can detect if anyone is abusing the system by sending more than 16 different "messages" per 15 minutes. They can't detect this when the fake airtags are sending, but can detect it from stored message timestamps when you query. If they start to see this being abused a lot, they can then block Apple IDs. To a…

This is covered in the blog post. There doesn't currently appear to be any rate limiting. And the rate limit would be tricky to implement because there are times when you need to catch up on the location of a device over a longer period of time. But yes Apple could limit to say 16 * 4 * 24 * 7 = 10752 requests per week.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#77

Post by jtbayly »

paxys wrote: post #57
vanshg wrote: post #45

Apple should embrace this fully and create their own decentralized network

It is only decentralized if the entire world is covered in Apple devices every few meters. At the moment they are simply extensions to a nearby router or cell tower.

I don't think that universal coverage is a requirement for something to be decentralized. Am I missing something?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#78

Post by floatingatoll »

tyingq wrote: post #65
sgerenser wrote: post #63

Earlier quoted context omitted.

I’d be surprise if Apple fielded AirTags without any way to update their firmware. I doubt it would be automatic though, you’d have to push an update to them from an iDevice.

It would have to be automatic for it to be used to kill off "fake AirTags" . Unless Apple is willing to take the hit of all the complaining.

When doesn’t Apple “take the hit” of complaints?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#79

Post by kingofclams »

protoman3000 wrote: post #8

So if now somebody uses this to upload illegal material somewhere from my IP I am fucked?

Honestly, I could see someone doing this over the FindMy network. It doesn’t even have to be illegal, just an interesting proof of concept.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#80

Post by etskinner »

amelius wrote: post #43

Would it be possible to relay communication between iPhone and the AirTag, making the iPhone think the tag is in a different location than it actually is?

The communication is one-way, and the only thing transmitted from the lost device is the bluetooth public key, so no. The device that detected the AirTag encrypts the location with the public key and transmits it to Apple, not the AirTag itself.
Post reply on HN