Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Find You: Building a stealth AirTag clone

positive.security

Post reply on HN
Print view View original

81–90 of 105 posts

Re: Find You: Building a stealth AirTag clone

#81

Post by hossbeast »

PragmaticPulp wrote: post #80
mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

> If it's the latter, it might mean that the entire AirTag product line is dead in the water. The average consumer, or even 99.9% of consumers, don't care at all. They want to find their things. AirTags help them find their things. They don't care how it works. End of story. It's not a popular opinion on HN where everyone wants to understand every technical detail of how every product works, but in the real world it…

Surely consumers also care about not being stalked / their real-time location given to third parties?

Re: Find You: Building a stealth AirTag clone

#82

Post by dwaite »

bombcar wrote: post #74
mox1 wrote: post #26

Earlier quoted context omitted.

The problem is easy to solve, just store copies of all public keys of each air tag you send out. Air Tag messages with unknown public keys just get dropped on their server side checks.

Aren’t there ways to cryptographically prove that a public key is “signed” or blessed by apple without knowing anything else about it?

Yes, you could do attestation schemes for hardware - such as a single manufacturing-time private key for large batches (say 1M+ AirTags) or something like Direct Anonymous Attestation.

Apple likely would go toward batch keys - in addition to being simpler crypto, it doesn't give them the capability to use other mechanisms to potentially correlate location reports.

That said, AirTags work solely within BLE advertisements, which are payload size limited to 31 bytes. Apple is currently using 30 of those bytes.

Re: Find You: Building a stealth AirTag clone

#83

Post by bigiain »

542458 wrote: post #59
stefan_ wrote: post #46

Earlier quoted context omitted.

The mental model I had is that AirTags are manufactured with a private/public key pair burned into them that allows Apple to validate the thing you are linking to your account on initial setup is really a legit AirTag. It appears none of that was ever true and you can register just anything as an AirTag that speaks the right BLE with no secrets required for a world full of iPhones to start tracking them. So yeah, exp…

I feel that if the stalker is buying dedicated stalking gear online there are “better” options - you can get actual compact GPS trackers that report over cellular for $10-20.

Not with anything like the battery life or small sizes as an AirTag.

Those sort of devices are a reasonable choice for mounting in your own vehicle, where you can provide relatively unlimited power (and many of them have the ability to implement engine kill). But you aren’t going to slip one of those into someone’s pocket unobtrusively as you bump into them going past. Or attach it to their car in a car park.

Re: Find You: Building a stealth AirTag clone

#84

Post by bombcar »

dwaite wrote: post #82
bombcar wrote: post #74

Earlier quoted context omitted.

Aren’t there ways to cryptographically prove that a public key is “signed” or blessed by apple without knowing anything else about it?

Yes, you could do attestation schemes for hardware - such as a single manufacturing-time private key for large batches (say 1M+ AirTags) or something like Direct Anonymous Attestation. Apple likely would go toward batch keys - in addition to being simpler crypto, it doesn't give them the capability to use other mechanisms to potentially correlate location reports. That said, AirTags work solely within BLE advertiseme…

Perfect! The last bit can be used to indicate a valid key. ;)

Re: Find You: Building a stealth AirTag clone

#85

Post by Joeri »

jedberg wrote: post #57

AirTag is a difficult problem to solve -- the usefulness of the product for "good" uses is directly related to how easy the "bad" uses are. Eventually it will be limited to the point where you can only track items that your phone can detect, and that won't be super helpful. Sure you can use it to find your lost keys in your own house and maybe have it warn you when you've been separated from your AirTag, but that's a…

Isn’t that last scenario basically what the competitors do?

The problem is not the airtag, it’s the find my network. Anything that can be tracked through the find my network can be used for malicious purposes. It is apple’s USP but also its achilles heel.

Re: Find You: Building a stealth AirTag clone

#86

Post by wtallis »

hossbeast wrote: post #81
PragmaticPulp wrote: post #80

Earlier quoted context omitted.

> If it's the latter, it might mean that the entire AirTag product line is dead in the water. The average consumer, or even 99.9% of consumers, don't care at all. They want to find their things. AirTags help them find their things. They don't care how it works. End of story. It's not a popular opinion on HN where everyone wants to understand every technical detail of how every product works, but in the real world it…

Surely consumers also care about not being stalked / their real-time location given to third parties?

Obviously not, given what their smartphone apps and browsers are doing. The real question is whether the though of being stalked by an individual rather than by corporations will make any difference.

Re: Find You: Building a stealth AirTag clone

#87

Post by gabeio »

Joeri wrote: post #85
jedberg wrote: post #57

AirTag is a difficult problem to solve -- the usefulness of the product for "good" uses is directly related to how easy the "bad" uses are. Eventually it will be limited to the point where you can only track items that your phone can detect, and that won't be super helpful. Sure you can use it to find your lost keys in your own house and maybe have it warn you when you've been separated from your AirTag, but that's a…

Isn’t that last scenario basically what the competitors do? The problem is not the airtag, it’s the find my network. Anything that can be tracked through the find my network can be used for malicious purposes. It is apple’s USP but also its achilles heel.

> The problem is not the airtag, it’s the find my network.

Tile, for example, actually works the exact same way. If you fully loose your tile connected to your keys you can put it into a "lost" mode [1] which will then notify you and gps locate it just like an airtag if someone with the tile app is near your tile. But you are correct, the big difference here will be how many devices have tile installed vs iphones.

[1] https://www.thetileapp.com/en-us/how-it-works (search: 'Tile Network')

Re: Find You: Building a stealth AirTag clone

#88

Post by SV_BubbleTime »

iudqnolq wrote: post #66
mmastrac wrote: post #16

Does this mean that Apple is failing to validate the capability of things that purport to be AirTags? Or that the BLE protocol is just not powerful enough to have Apple signatures on each broadcast public key? If it's the latter, it might mean that the entire AirTag product line is dead in the water.

You get 37 bytes, and an optional extra 37 bytes with a more complex negotiation.

My memory is a little fuzzy, but iirc after required tags in the advertising packet you had ~28 bytes that could be tagged 0xFF - mfg data. Then there is also BLE5 which adds advertising extensions to get to 240-250bytes. And the scan response packet which was under 30 all the time. But I could be wrong about all of that, been a little while since I was that deep in BLE.

Point for me is that Apple absolutely could do supply chain verification but… for some reason don’t?

Re: Find You: Building a stealth AirTag clone

#89

Post by randyrand »

hossbeast wrote: post #81
PragmaticPulp wrote: post #80

Earlier quoted context omitted.

> If it's the latter, it might mean that the entire AirTag product line is dead in the water. The average consumer, or even 99.9% of consumers, don't care at all. They want to find their things. AirTags help them find their things. They don't care how it works. End of story. It's not a popular opinion on HN where everyone wants to understand every technical detail of how every product works, but in the real world it…

Surely consumers also care about not being stalked / their real-time location given to third parties?

Most consumers are not concerned someone wants to stalk them. Few people have experience being stalked.

Re: Find You: Building a stealth AirTag clone

#90

Post by adhesive_wombat »

a-dub wrote: post #36

silly question here: modern smartphones rotate their mac addresses frequently for privacy, but aren't the bluetooth addresses on phones and headphones and all the rest static and easily detected?

Yes, many devices use rotating keys for this exact reason (search keyword: Resolvable Random Private address).
Post reply on HN