Security expert hijacks Apple's Find My network to share data with a Linux device
Introduction
A security researcher has demonstrated a striking proofâofâconcept: hijacking Appleâs FindâŻMy network to stream live location data to a Linux machine, without ever touching a Mac, iPhone, or any other Apple hardware. By fabricating a counterfeit device that mimics the communication patterns of genuine Apple products, the expert was able to infiltrate the crowdsourced network and pull location information directly into a Linux box. The experiment underscores both the ingenuity of modern vulnerability research and the lingering gaps in a system that many users trust to protect their lost devices. This article walks through what happened, the technical specifics, the broader context of FindâŻMy, why the discovery matters, and what the future may hold for Apple and its users.What Happened
The researcher, who chose to remain anonymous, built a softwareâonly âghostâ device on a standard Linux workstation. By reverseâengineering the Bluetooth Low Energy (BLE) advertising packets and the cryptographic handshake that Apple devices use to announce themselves to the FindâŻMy network, the expert crafted a series of packets that convinced nearby Apple devices to treat the Linux box as a legitimate participant. Once the spoofed device was accepted, the network began relaying encrypted location beacons back to the researcherâs machine, effectively turning the Linux box into a hidden node that could harvest live coordinates.
Crucially, the attack required no physical Apple device at any point. The researcher generated the required publicâkey identifiers, signed the payloads with a selfâgenerated key pair, and leveraged the âofflineâ portion of the FindâŻMy protocol that allows devices to act as passive relays. By broadcasting the forged BLE frames, the Linux system was able to receive the same encrypted payloads that a real iPhone or AirTag would, then decrypt them using the keys it had generated. The result was a continuous stream of location data that could be logged, visualized, or forwarded to other servicesâall from a nonâApple platform.
This successful hijack demonstrates that the FindâŻMy networkâs reliance on anonymous, crowdâsourced relays can be subverted when an attacker can accurately emulate the lowâlevel protocol. While Appleâs endâtoâend encryption protects the content of the location reports, the mere ability to inject a rogue node and harvest those reports raises serious privacy concerns.
Key Details
The experiment hinged on a combination of openâsource tooling and custom scripts written in Python and C. The researcher first captured legitimate FindâŻMy BLE advertisements using a USBâtype Bluetooth dongle and Wireshark, then dissected the packet structure to identify the fields used for device identification, cryptographic signatures, and payload encryption. By reproducing these fields and signing them with a freshly generated ellipticâcurve key pair (using the same curve Apple employs, Curve25519), the fake device passed the networkâs authenticity checks.
FindâŻMy relies on a hybrid of Bluetooth, WiâFi, and cellular signals to triangulate device positions. In this proofâofâconcept, the Linux box acted solely as a Bluetooth beacon, broadcasting the forged advertisements. Nearby Apple devices that were part of the FindâŻMy mesh automatically picked up the signal, encrypted their own location data with the public key presented by the fake device, and sent the ciphertext to Appleâs cloud servers. The researcherâs Linux node then intercepted the ciphertext, decrypted it with the corresponding private key, and extracted the latitude, longitude, and timestamp.
During testing, the researcher was able to collect location updates from multiple real devices within a 30âmeter radius, each update arriving roughly every 10â15 seconds. The data included not only the coordinates but also ancillary metadata such as device type (iPhone, iPad, AirTag) and a rotating identifier that changes every few minutes to preserve anonymity. Although the identifiers are designed to prevent longâterm tracking, the ability to capture them in real time opens the door to correlation attacks if an adversary can amass enough snapshots.
Background
Appleâs FindâŻMy network, launched in 2019, is a global, crowdsourced locationâtracking system that leverages the billions of Apple devices already in the field. When a user marks a device as lost, that device emits encrypted BLE beacons that are picked up by any nearby Apple product. Those products act as anonymous relays, forwarding the encrypted payload to Appleâs servers, where the owner can view the deviceâs location on a map. The system is praised for its privacyâbyâdesign approach: all payloads are endâtoâend encrypted, Apple never sees the raw location data, and rotating identifiers are used to thwart device profiling.
Despite these safeguards, the FindâŻMy architecture was always predicated on the assumption that only authentic Apple hardware would participate in the mesh. The protocolâs open natureânecessary for interoperability across millions of devicesâmeans that any device capable of broadcasting correctly formatted BLE packets can, in theory, join the network. Prior research has highlighted the possibility of ârelay attacksâ using AirTags, but this is the first publicly documented case of a fully softwareâonly node injecting itself into the network and extracting live location data.
Why It Matters
The ability to spoof a FindâŻMy node on a nonâApple platform raises immediate privacy concerns. If a malicious actor can deploy a fleet of inexpensive Linux or RaspberryâŻPi devices in public spaces, they could silently harvest location beacons from unsuspecting users, building a map of device movements without consent. While Appleâs encryption prevents the attacker from learning the identity of the device owner, the sheer volume of location data could still be used for surveillance, stalking, or commercial profiling.
Beyond privacy, the discovery highlights a broader challenge for securityâbyâdesign systems that rely on open protocols. Endâtoâend encryption protects data in transit, but it does not stop an adversary from becoming a legitimate participant in the communication flow. This underscores the need for additional authentication layersâsuch as device attestation or hardwareâbound keysâthat can verify that a node is truly an Appleâmanufactured product before it is allowed to relay or receive data.
What Happens Next
Apple is expected to respond quickly. In past incidents, the company has issued firmware updates to patch protocol weaknesses, and it maintains a robust bugâbounty program that rewards researchers for responsibly disclosing vulnerabilities. The researcher has reportedly contacted Apple through this channel, providing detailed technical documentation and proofâofâconcept code. If Apple validates the findings, a security update could be rolled out to iOS, macOS, and watchOS that adds stricter verification of device signatures or introduces a nonceâbased challenge to thwart replay attacks.
For the security community, this work serves as a reminder that even wellâdesigned privacy systems can be subverted by clever protocol manipulation. It is likely to spur further academic and industry research into hardening crowdsourced networks, not only for FindâŻMy but also for other emerging IoT location services. Users, meanwhile, should stay informed about the latest updates and consider enabling additional safeguardsâsuch as twoâfactor authentication for FindâŻMy and regular device firmware upgradesâto minimize exposure.
Conclusion
The successful hijacking of Appleâs FindâŻMy network by a Linuxâbased spoof demonstrates that the systemâs openness, while essential for its massive coverage, also creates an attack surface that can be exploited without any Apple hardware. By reverseâengineering the BLE handshake and crafting authenticâlooking packets, the researcher turned a standard Linux box into a covert relay capable of pulling live location data from nearby Apple devices. This proofâofâconcept highlights the delicate balance between privacy, usability, and security in largeâscale, crowdâsourced services. As Apple works to patch the vulnerability and strengthen device authentication, the incident will likely influence the design of future locationâtracking ecosystems, reminding both developers and users that robust encryption must be paired with strong participant verification to truly safeguard privacy.đ See Also
đ Sources & Attribution
- â TechRadar TVs