OpenHaystack: Tracking Personal 'AirTags' via Apple's Find My Network

OpenHaystack: Tracking Personal 'AirTags' via Apple's Find My Network(github.com)

94 points by mstute 5 years ago | 16 comments

filleokus 5 years ago |

Awesome work! I can recommend people interested in the iOS/Apple ecosystem to check out the Secure Mobile Networking Lab of TU Darmstadt in general. They do a lot of cool stuff in the space, a good starting point might be https://owlink.org.

As a side note: I wonder what the story is on the whole AirTag hardware project. It's becoming so "delayed" that reverse engineered implementations are here before.

djrogers 5 years ago | |

This isn't a reverse engineering of airtags - this find me service has been available for Apple devices via the same bluetooth mechanism (iPhones and MacBooks) for a couple of years now.

mstute 5 years ago | | |

It has been available since iOS 13/macOS 10.15

tinus_hn 5 years ago |

How does Apple prevent me from using this to track random people based for instance on their Bluetooth headphones?

ArchOversight 5 years ago | |

If you are within BLE range you can "track" someone, but that is already the case with wifi/bluetooth in general.

Even known the public key, you can download the encrypted reports from Apple, but since you don't have the private key you can't decrypt the location messages.

AlotOfReading 5 years ago | | |

That's why devices that aren't intended to be beacons are supposed to enable address randomization. It still has some security issues and undirected advertising of unique public keys obviously defeats the point, but it's more difficult to track than classic devices were.

CubsFan1060 5 years ago | |

https://www.macrumors.com/2021/03/04/ios-14-5-item-safety-fe...

Is that what you're asking?

bberenberg 5 years ago | |

You would have to flash their headphones with custom firmware to do this. Take a look at https://github.com/seemoo-lab/openhaystack#how-does-apples-f...

tinus_hn 5 years ago | | |

All right, so it isn’t normal Bluetooth devices but requires a special feature in the device.

nathanielostrer 5 years ago |

Could you make this work with a tile?

coolspot 5 years ago | |

This requires BLE device to broadcast your public key in special packets.

I don’t think you can upload custom logic on Tile to make it broadcast arbitrary BLE packets.

londons_explore 5 years ago | | |

You could with a new firmware.

KMnO4 5 years ago | |

Not really, but perhaps someone could make one based on a cheap Nordic NRF51823 or NRF5832. Actually, a quick search shows that you can already buy exactly that (even with Apple compatibility built in).

mensetmanusman 5 years ago |

Start enabling ipv6 on your routers, these iot devices are going to break ipv4.

jon-wood 5 years ago | |

These devices don’t have a network connection, tracking is done via BLE which just broadcasts a beacon regularly and is then picked up by nearby Apple devices which do have a connection.

Solocomplex 5 years ago | |

It breaks a lot of cheap IOT devices without 6to4 translation