Since Apple unveiled tracking tools  AirTags And the Find My network last month, security researchers were exploring how it works and whether there are any security risks or vulnerabilities that might threaten users, and the good news so far is that they haven't found anything important, but it seems that researchers have expanded the search to target the Find My network. And it looks like they found a loophole.


AirTag tracking tool

Security researchers were unable to find holes in Apple's tracking tool but there were some interesting anecdotes, for example, one researcher discovered last week. How to reprogram the AirTagBut his efforts have yet to bear fruit because all he has done is change the URL that is sent via NFC.

Also, some organizations and experts pointed out some shortcomings in the AirTag tracking tool, for example, that iPhones are the only ones who receive an alert “AirTag was found with you.” As for Android devices, their owners need three days, which is the exact date to activate the audible ring to indicate the presence of a tool Track someone else's things about you, and moreover, sometimes the tracking tool gets hidden carefully and this makes it difficult for an iPhone to find the location of the tracking tool.

And with those problems that I hope Apple will correct them soon, taking into account that the preventive measures provided by the Airtag tracking tool and careful search to find your lost things, you will not find any of it in other competing tracking tools and usually the first product in the series, there will always be improvements to come.


Find My Network

researcher-exploits-a-vulnerability-in-find-my

After failing to find vulnerabilities in the AirTag tracking tool, a security researcher targeted Apple's Find My network, discovering that it is possible to send messages and other small bits of data from an offline device to it using any nearby device - without the owner's knowledge or consent.

According to Positive Security, the trick mainly works by simulating an AirTag or other component compatible with Find My network to broadcast information via Bluetooth Low Energy (through which IoT devices operate) captured by any iPhone or iPad. Or even a Mac nearby.

The hack includes simulating the broadcast method that takes place between Find My and the tracking tool from Apple, where the AirTag tool broadcasts its location via an encrypted message, and from here the hacker transmits packets of arbitrary data (intended as random data) over the network.

The security researcher behind this discovery, Fabian Bronline, suggests that there are practical uses for this vulnerability, such as using any nearby iPhone device that acts as an intermediary to send small packets of data to another device, and the Find My network design will provide a very safe way to do this.

Fabian added that there is nothing that Apple can do to prevent it due to the encrypted design of the Find My network and the privacy of all the data that passes through it.


Should you be worried

There is no reason to believe now that this poses a risk to users of Apple devices, even if this technology becomes widespread, your iPhone will be used at the very least as a transit device (intermediary) to send small messages over the mobile network of your device.

Most importantly, there is nothing in this technology that provides any way to access your Find My devices, in fact, it is the extremely strong security and privacy of the Find My network that makes this technology possible in the first place.

It is also important to note that Fabian technology can only send small amounts of data, why? Because the purpose of the Find My network is to send AirTags and other items only, which are very small pieces of data, and although the message can be split into multiple packets, it seems that the amount of round-trip traffic makes it impractical to send anything other than SMS and small amounts. Other data that do not pose any threat.

With the spread of technology, many experts will work to penetrate these devices and companies will work to improve security, in the end it is a game of cat and mouse

Source:

positive. security

Related articles