Live data from Hacker News

Find You: Building a stealth AirTag clone

positive.security

71–80 of 105 posts

Re: Find You: Building a stealth AirTag clone

#71
post #51

Earlier quoted context omitted.

> The problem is easy to solve, just store copies of all public keys of each air tag you send out. that kills the privacy aspect of it, because it also means apple knows about the exact whereabouts of each tag. airtags are specifically designed/marketed so apple can't do that.

Software (and I guess hardware too) is about tradeoffs. The tradeoff here is that in not being able to validate if a device is a valid Airtag is that Apple has created a massive, completely uncontrollable surveillance network. The fact that anyone can interrogate the network to track devices that aren't even guaranteed to be running the official firmware or have the official hardware is insane. Not having Apple be ab…

It is by design not a surveillance network. That is the whole point.

No one, including apple, other than a device owner can determine where their device is, or where it has been.

Re: Find You: Building a stealth AirTag clone

#72
post #68
post #59

Earlier quoted context omitted.

I feel that if the stalker is buying dedicated stalking gear online there are “better” options - you can get actual compact GPS trackers that report over cellular for $10-20.

Can you really? I live in a place with a lot of coyotes so we bring our cat inside every day an hour or 2 before sunset. We bought a Tile (AirTag competitor) for her, but it's really not lived up to what we were hoping and I'd love for the possibility of getting an actual GPS device Even if it's just for a few days so we can get a sense of what her typical route are so we could know where to look for her other days B…

For your use case wouldn’t something that has a GPS receiver and just records position every minute or so be fine? You can download the map offline later, no need for continuous cell signal.

Re: Find You: Building a stealth AirTag clone

#73
post #51
post #26

Earlier quoted context omitted.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

> The problem is easy to solve, just store copies of all public keys of each air tag you send out. that kills the privacy aspect of it, because it also means apple knows about the exact whereabouts of each tag. airtags are specifically designed/marketed so apple can't do that.

If Apple doesn’t know, how does the user know? I thought Apple was just anonymizing but still centralizing the data. Genuine question.

Re: Find You: Building a stealth AirTag clone

#74
post #26
post #24

Earlier quoted context omitted.

It is a difficult technical problem for Apple to solve all of the corner-cases. The article shows the screenshot of seemingly 100 unique FindMy devices around this guy's personal residence... there may be some characterization work that can help solve that so an iPhone user would get the alert message. But Apple will continue to promote it and dismiss or downplay these security concerns.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

Aren’t there ways to cryptographically prove that a public key is “signed” or blessed by apple without knowing anything else about it?

Re: Find You: Building a stealth AirTag clone

#75
post #70
post #69

Earlier quoted context omitted.

>it will report the IMEI to the operator as part of maintaining a network connection >Compare that to the difficulty of tracking down where a commodity BLE antenna and battery pack were sold. The ESP (or whatever BLE chipset was used) probably will have a mac address burned in, which is essentially an IMEI. You'll have a hard time getting anything from that, because the aliexpress supply chain that supplied the GSM G…

> It was sold from a mobile phone kiosk at a mall >> what payment method is used for service > voucher purchased at the same store, both paid with cash >> If anyone bought a prepaid SIM with cash, they may have been caught on security camera doing so. > the purchase/activation of the sim occurred a month or two ago, outside of the retention range of the surveillance footage. even if the footage exists, all you'd see…

1. it's not really "so much". Wearing nondescript clothing, paying with cash, and maybe parking across the street are measures that people who don't know what "opsec" means can figure out. I think "burner phones" are well known enough that we can presume the typical criminal knows about it.

2. the same mechanism that makes it easy to build stalking devices for, also makes it convenient to use as a lost key finder. I'm not going to attach a GPS tracker and buy a sim card for my keys/bag, but I will buy a $30 airtag.

Re: Find You: Building a stealth AirTag clone

#76
post #51

Earlier quoted context omitted.

> The problem is easy to solve, just store copies of all public keys of each air tag you send out. that kills the privacy aspect of it, because it also means apple knows about the exact whereabouts of each tag. airtags are specifically designed/marketed so apple can't do that.

If Apple doesn’t know, how does the user know? I thought Apple was just anonymizing but still centralizing the data. Genuine question.

It basically operates like dead drops. Airtags broadcast their location using a public key that constantly rotates. Apple maintains a mapping of public key to location. Anyone can look up the location of a public key, but the search space is so big that it's not worth bruteforcing. Even if you did, all you'd end up is a heatmap[1] of airtags, not very helpful. However, if you know the corresponding secret, you can predict what the public key will be and know the exact whereabouts of a particular device.

https://xkcd.com/1138/

Re: Find You: Building a stealth AirTag clone

#77

Aren't AirTags implicitly linked to an Apple account? 99% of people have no clue how to hide their IP, you can get tracked back by the police so easily (and Apple + telcos + VPNs located in US+ jurisdiction _will_ help the police/FBI). It's almost a benefit to society: a way to enable people to commit crimes in the stupidest way possible.

Yes and no. Quoting TFA: > While OpenHaystack-based AirTag clones are not paired with an Apple ID, the retrieval of location reports requires authentication. Such an account however can be created anonymously using an email address without any identity/KYC-verification. > The OpenHaystack team currently even considers running a server that proxies those location report requests, which in the future might take away th…

My point is, most people are completely unaware of the fact that you can still get found with an anonymous account. Apple keeps the logs and will comply with a subpoena. So, unlike a GPS tracker, you can prove in court really easily and even automate finding offenders..

Wait, I'm not liking this so much anymore.

Re: Find You: Building a stealth AirTag clone

#78
post #3

Other trackers don't tell you they are tracking you though, what about those.

Other trackers don't have a backdoor into a global network of a billion iOS devices in order to relay the device's location to a cellular network, and thus, the original owner. They were safer because they were small; things such as this do not always scale linearly, which is a fact Apple's leadership doesn't seem to respect.

Re: Find You: Building a stealth AirTag clone

#79
post #74
post #26

Earlier quoted context omitted.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

Aren’t there ways to cryptographically prove that a public key is “signed” or blessed by apple without knowing anything else about it?

As I understand the situation, no.

Since the AirTag emits the message, that message would either contain: - a static signature, which could then be copied and mimic'd by imposters (replay attack) - store the private key on the AirTag device, which could then sign the a continuously changing nonce like the current datetime. But this means the private key could then be extracted from one device, and used to sign messages on an imposter device. So unless every device had a separate private key, this method would immediately be compromised as well.

So why doesn't Apple have a unique private key for each device? Well it appears it actually does, and has them constantly changing their private keys. But there appears to be some kind purposely implemented anonymity features that is designed to prevent Apple's servers from associating a ping with ever having to decode the contents, and thus of associating your account/device with the emitted location.

If you build in validation to write to the network ping database that goes "here's a ping with a signature ABC and let's lookup if it's valid, oh it is, that must be from AirTag Bob bought last month with private key XYZ, let's declare this ping valid" then Apple is only a logfile-write-of-this-information away from being able to perfectly stalk everyone who has purchased a device. So instead, the tradeoff they made is they don't keep track / purposely blind themselves to their device-in-circulation keys to truthfully say they actually can't track you. That leaves open the ability of imposter devices to transmit information through the network by creating their own known keys which look indistinguishable from authentic device pings.

Re: Find You: Building a stealth AirTag clone

#80

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

> If it's the latter, it might mean that the entire AirTag product line is dead in the water.

The average consumer, or even 99.9% of consumers, don't care at all.

They want to find their things. AirTags help them find their things. They don't care how it works. End of story.

It's not a popular opinion on HN where everyone wants to understand every technical detail of how every product works, but in the real world it doesn't matter. Consumers buy products to solve problems. That's all.

Post reply on HN