Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Emulating AirTags to upload arbitrary data via Apple's FindMy network

positive.security

Post reply on HN
Print view View original

91–100 of 132 posts

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#91

Post by londons_explore »

pbhjpbhj wrote: post #75
mediaman wrote: post #58

Earlier quoted context omitted.

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

This is probably wrong: I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access. As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing…

DoS within Wifi transmission range is an unavoidable part of any wireless protocol.

The attack you propose is no more powerful, so probably not worth protecting against.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#92

Post by ThatPlayer »

vanshg wrote: post #45

Apple should embrace this fully and create their own decentralized network

I think you'd still have issues mapping a mesh, especially with how often phones are moving. I remember looking at meshtastic for a mesh wireless network and they're still working on a solution for a large number of nodes covering a large area:

https://meshtastic.org/docs/software/other/mesh-alg

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#93

Post by tppiotrowski »

spoonjim wrote: post #53
thatcherc wrote: post #23

I was wondering if something like could be done to upload sensor data without a data connection and it looks like that's exactly what the authors here had in mind!: > Potential use cases > While I was mostly just curious about whether it would be possible, I wouldimagine the most common use case to be uploading sensor readings or any data from IoT devices without a broadband modem, SIM card, data plan or Wifi connect…

I recall a mechanism like this used to deliver email in rural India. There were basically email “kiosks” which would let you receive and send mail for a fee and would store these messages locally until a truck with the company’s transponder stopped at the village, at which point it would send the data to the truck which would upload the data to the Internet when it reached the city. Obviously obviated by mobile data.

In 2006, I did a summer internship at NASA implementing the Bundle protocol [1]. It assumes intermittent connectivity and/or large delays between transfers. For example, you have intermittent line-of-sight between Mars and a tracking station on earth or line-of-sight between a rover and an orbiter on the far side of Mars that will at some point in the future relay the data onto Earth. I can't find it in the RFC, but using it to provide internet to rural villages was definitely discussed.

[1] https://datatracker.ietf.org/doc/html/rfc5050

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#94

Post by hervature »

chris37879 wrote: post #87
laurent92 wrote: post #82

Earlier quoted context omitted.

The process of delivering the internet by trucks is quite laughable, yet SMTP is the perfect protocol for that: Mail can hop from server to server until it finds the right one, as opposed to now where SMTP hosts like Gmail only accepts mail sent from or to a Gmail account.

I had a professor that made us answer questions about the bandwidth, latency, and reliability of a stationwagon loaded with hard drives. I never imagined I'd see a practical example of that principal at work.

Physical transportation of storage has always been a thing. Of course, over time, internet speeds increasing means it only makes since for larger amounts of storage. https://aws.amazon.com/snowmobile/

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#95

Post by dkarras »

2OEH8eoCRo0 wrote: post #89
mvanaltvorst wrote: post #30

Does this fall within Apple's policy of fair use? Would be great if there were an officially supported (paid) API for this, the technology and potential use cases are great. I'm afraid hooking something like this up to my Apple ID will get me banned somehow.

Why would you be afraid? According to HN Apple is not a monopoly and plenty of viable alternatives exist. /s

...fearing losing access to your Apple ID has nothing to do with whether Apple is a monopoly or not (and of course, they are not).

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#96

Post by hervature »

jtbayly wrote: post #77
paxys wrote: post #57

Earlier quoted context omitted.

It is only decentralized if the entire world is covered in Apple devices every few meters. At the moment they are simply extensions to a nearby router or cell tower.

I don't think that universal coverage is a requirement for something to be decentralized. Am I missing something?

Yes, I think they meant to say useful.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#97

Post by labawi »

xyzzy_plugh wrote: post #85
aidos wrote: post #84

Earlier quoted context omitted.

Can you explain what you mean about gmail?

Classically SMTP let you "relay" mail that neither originated or is destined for the specific server. Gmail, and most modern SMTP servers, only permit mail from or to a Gmail address/their primary domain. Edit: added clarification that all SMTP servers do not only permit Gmail addresses...

Is this sarcasm? As the gmail part is completely false.

Relaying used to be a thing, before spammers and unwillingness to deal with it at the source (boot infected devices, originating AS / IX, .. ) resulted in a choice between a game of whack-a-mole or only accepting gmail¹.

These days, relaying has to be setup on the specific relay server, the originating address needs to permit it (DNS SPF/DKIM/DMARC/whatever), and the relay server will still have a reputational problem with deliverability to unrelated servers, which is problematic even for direct mail, unless you are gmail¹.

¹ usually gmail + varying number of big players

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#98

Post by tinus_hn »

sgerenser wrote: post #63
tyingq wrote: post #60

Earlier quoted context omitted.

Any more info on "can be" ? For existing AirTags, they would have to already have that functionality (polling for updates). I can't find anything that says they do.

I’d be surprise if Apple fielded AirTags without any way to update their firmware. I doubt it would be automatic though, you’d have to push an update to them from an iDevice.

AirTags start beeping if they are removed from the associated device for more than a few days, so there is plenty of opportunity to update them.

Re: Emulating AirTags to upload arbitrary data via Apple's FindMy network

#100

Post by pbhjpbhj »

floatingatoll wrote: post #81
pbhjpbhj wrote: post #75

Earlier quoted context omitted.

This is probably wrong: I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access. As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing…

Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!

I'm not in USA, but I've always read FCC as an administrative arm of government, do they do active monitoring and enforcement? Like of you fire up a rogue transmitter the FCC send officers to apprehend you?
Post reply on HN