Bug in Apple s Find My Feature Could ve Exposed Users Location Histories
Cybersecurity researchers on Thursday disclosed two distinct design and implementation flaws in Apple s crowdsourced Bluetooth location tracking system that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, thereby by deanonymizing users.
The findings are a consequence of an exhaustive review undertaken by the Open Wireless Link (OWL) project, a team of researchers from the Secure Mobile Networking Lab at the Technical University of Darmstadt, Germany, who have historically taken apart Apple s wireless ecosystem with the goal of identifying security and privacy issues.
Researchers reverse-engineer Find My, detail potential privacy & security issues
appleinsider.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from appleinsider.com Daily Mail and Mail on Sunday newspapers.
Security Researchers Develop Framework for Tracking Bluetooth Devices Using Find My
macrumors.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from macrumors.com Daily Mail and Mail on Sunday newspapers.
OpenHaystack?
OpenHaystack is an application that allows you to create your own accessories that are tracked by Apple s Find My network. All you need is a Mac and a BBC micro:bit or any other Bluetooth-capable device.
By using the app, you can track your accessories anywhere on earth without cellular coverage. Nearby iPhones will discover your accessories and upload their location to Apple s servers when they have a network connection.
History
Find My network (or
offline finding). We at the Secure Mobile Networking Lab of TU Darmstadt started analyzing offline finding after its initial announcement in June 2019. We identified how Apple devices can be found by iPhones devices, even when they are offline through this work. The whole system is a clever combination of Bluetooth advertisements, public-key cryptography, and a central database of encrypted location reports. We disclosed a specification of the closed parts of offline finding and conducted a comprehensive security and p