Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

Post reply on HN
Print view View original

81–90 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#81

Post by floatingatoll »

pbhjpbhj wrote: post #75
mediaman wrote: post #58

Earlier quoted context omitted.

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

This is probably wrong: I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access. As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing…

Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#82

Post by laurent92 »

spoonjim wrote: post #53
thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

I recall a mechanism like this used to deliver email in rural India. There were basically email “kiosks” which would let you receive and send mail for a fee and would store these messages locally until a truck with the company’s transponder stopped at the village, at which point it would send the data to the truck which would upload the data to the Internet when it reached the city. Obviously obviated by mobile data.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#83

Post by hyperdimension »

spoonjim wrote: post #53
thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

I recall a mechanism like this used to deliver email in rural India. There were basically email “kiosks” which would let you receive and send mail for a fee and would store these messages locally until a truck with the company’s transponder stopped at the village, at which point it would send the data to the truck which would upload the data to the Internet when it reached the city. Obviously obviated by mobile data.

Sneaker UUnet?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#84

Post by aidos »

laurent92 wrote: post #82
spoonjim wrote: post #53

Earlier quoted context omitted.

I recall a mechanism like this used to deliver email in rural India. There were basically email “kiosks” which would let you receive and send mail for a fee and would store these messages locally until a truck with the company’s transponder stopped at the village, at which point it would send the data to the truck which would upload the data to the Internet when it reached the city. Obviously obviated by mobile data.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

Can you explain what you mean about gmail?

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#85

Post by xyzzy_plugh »

aidos wrote: post #84
laurent92 wrote: post #82

Earlier quoted context omitted.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

Can you explain what you mean about gmail?

Classically SMTP let you "relay" mail that neither originated or is destined for the specific server. Gmail, and most modern SMTP servers, only permit mail from or to a Gmail address/their primary domain.

Edit: added clarification that all SMTP servers do not only permit Gmail addresses...

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#86

Post by mhandley »

barbegal wrote: post #76
mhandley wrote: post #32

As there's a limit of 16 AirTags per Apple ID, and each AirTag's keys rotate every 15 minutes, presumably Apple can detect if anyone is abusing the system by sending more than 16 different "messages" per 15 minutes. They can't detect this when the fake airtags are sending, but can detect it from stored message timestamps when you query. If they start to see this being abused a lot, they can then block Apple IDs. To a…

This is covered in the blog post. There doesn't currently appear to be any rate limiting. And the rate limit would be tricky to implement because there are times when you need to catch up on the location of a device over a longer period of time. But yes Apple could limit to say 16 * 4 * 24 * 7 = 10752 requests per week.

No, the comment in the blog post is not what I'm suggesting. All Apple needs is to do is record the timestamps that iPhones received the AirTag beacon. When an Apple ID queries for keys, if Apple finds more matching key reports received in any 15 minute period than is plausible, then either the Apple ID is associated with more than the 16 permitted AirTags, or some of them are using more than one key per 15 minutes. So Apple can definitely detect this unless you either use multiple Apple IDs, or you limit to around 16 bits per 15 minutes.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#87

Post by chris37879 »

laurent92 wrote: post #82
spoonjim wrote: post #53

Earlier quoted context omitted.

I recall a mechanism like this used to deliver email in rural India. There were basically email “kiosks” which would let you receive and send mail for a fee and would store these messages locally until a truck with the company’s transponder stopped at the village, at which point it would send the data to the truck which would upload the data to the Internet when it reached the city. Obviously obviated by mobile data.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

I had a professor that made us answer questions about the bandwidth, latency, and reliability of a stationwagon loaded with hard drives. I never imagined I'd see a practical example of that principal at work.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#88

Post by Animats »

The sending rate on the microcontroller is currently ~3 bytes/second. The latency is usually between 1 and 60 minutes.

That's not much, but it has value for industrial machine-to-machine communications. (That's IoT without the hype.) Like commercial air conditioning units. They can send in minimal data ("compressor 1 running, compressor 2 stopped, system OK") to a maintenance service without needing a cellular account or connection to the Internet.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#89

Post by 2OEH8eoCRo0 »

mvanaltvorst wrote: post #30

Does this fall within Apple's policy of fair use? Would be great if there were an officially supported (paid) API for this, the technology and potential use cases are great. I'm afraid hooking something like this up to my Apple ID will get me banned somehow.

Why would you be afraid? According to HN Apple is not a monopoly and plenty of viable alternatives exist. /s

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#90

Post by PurpleFoxy »

Animats wrote: post #88

The sending rate on the microcontroller is currently ~3 bytes/second. The latency is usually between 1 and 60 minutes. That's not much, but it has value for industrial machine-to-machine communications. (That's IoT without the hype.) Like commercial air conditioning units. They can send in minimal data ("compressor 1 running, compressor 2 stopped, system OK") to a maintenance service without needing a cellular accoun…

For critical data like that, it would make more sense to just have a modem on board. 5G should make this more possible with increased device limits.
Post reply on HN