News for hackers. Stuff that matters.

A comment on The clever cryptography behind Apple’s “Find My” feature.

Re:The clever cryptography behind Apple’s “Find My” feature by lixtra on Saturday June 08, 2019 @04:39PM (#20135013)
It feels like that can be exploited in some ways. As a first thought it reduces the privacy of the reporting 3rd party phone. I.e. I can leave a fully charged phone in my wife’s car and track her for weeks while she will have the burden to recharge her phone for network/gps power.

A regular gps tracker would need much more energy.

Edit: another scenario, leave it in an isolated hut. If I get a signal, someone is close to the hut.

Edit 2: if I piggy back the protocol and can manipulate the key schedule (chose key A or B) then I can leak one bit of information through the third party phone. The third party phone may be allowed to communicate while my sender isn’t.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by joosters on Saturday June 08, 2019 @10:29PM (#20136656)
Another scenario, leave it in an isolated hut. If I get a signal, someone is close to the hut.

You could do that already with a device, just by making an app that listens for Bluetooth or WiFi traffic. You’d also be able to grab MAC addresses of the nearby phones. Your ‘exploit’ isn’t revealing any more than you can already discover today.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by guiambros on Saturday June 08, 2019 @11:05PM (#20136833)
Except in the case of Find My you don't need any connectivity in the hut whatsoever.

If you build your own BT or WiFi sniffer, you won't be able to piggyback on someone else's internet connectivity.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by BoorishBears on Saturday June 08, 2019 @11:30PM (#20136924)
If there’s internet connectivity, and you’re sophisticated enough to be planning Find My iPhone based booby traps, firing off a text message from a contained detector shouldn’t be a challenge
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by baxtr on Sunday June 09, 2019 @03:42AM (#20137804)
Anecdotally: a friend of mine left his iPad in his wife’s car. When looking for through Find My iPhone, he realized that she’s at her ex-boyfriend’s place. He is married happily to another wife now...
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by amelius on Saturday June 08, 2019 @08:29PM (#20136149)
> I can leave a fully charged phone in my wife’s car and track her for weeks

You could do the same thing with a regular phone with an app that uses GPS. Just attach a powerbank if you're concerned about the power.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by rando444 on Saturday June 08, 2019 @07:51PM (#20135987)
Places like shopping malls use just your devices hardware ids to track your movements.

To me just the fact that these things are on when you ask for them to be off is problematic.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by slig on Saturday June 08, 2019 @08:21PM (#20136122)
iOS does shuffle the MAC address in order to prevent this, doesn't it?
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by oflannabhra on Saturday June 08, 2019 @10:48PM (#20136742)
Yes, on top of this, applications don’t have access to a devices MAC address through CoreBluetooth, so they can’t fingerprint a device.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by baybal2 on Sunday June 09, 2019 @02:04AM (#20137441)
You can shuffle your mac but not your gsm/3g ids broadcasted in the open as per spec.

I first saw this tech, I think, 9 years ago when I first encountered a "bluetooth spam" device

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by djchen on Saturday June 08, 2019 @08:32PM (#20136159)
Yes, except if you connect to their WiFi.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by lurking_around on Saturday June 08, 2019 @11:49PM (#20136987)
You can already do this with a Tile. Leave a Tile in your wife's car and every phone with the Tile app in her vicinity will report her location to you.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by iforgotpassword on Sunday June 09, 2019 @01:49AM (#20137381)
> ... every phone with the Tile app ...

So effectively none. I've never even heard of Tile before this. Leveraging the whole Apple ecosystem for this sounds a lot more promising and will probably kill any competitor that depends on installing an app, even if that supports multiple platforms.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by tjoff on Sunday June 09, 2019 @02:12AM (#20137474)
And more importantly: opt-in.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by Atheros on Saturday June 08, 2019 @05:14PM (#20135221)
Time to make AmIAlone.com
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by Geee on Saturday June 08, 2019 @06:27PM (#20135614)
This mechanism is very low power, and it allows making tiny devices that can be used for tracking suspects. Maybe this is actually why they made it (someone asked if they could make it).

Edit: Maybe Apple will introduce tiny key fobs that can be tracked so you can find your keys or other things.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by servercobra on Saturday June 08, 2019 @06:56PM (#20135757)
There is already a reference to an Apple Tag in iOS 13.

https://www.techradar.com/news/apple-tag-spotted-in-ios-13-a...

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by bonestamp2 on Sunday June 09, 2019 @11:20AM (#20139761)
I was wondering why they changed the name, I mean "Find My iPhone" could already find macbooks and ipads but now it sounds like they're going much broader than Apple devices.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by Geee on Sunday June 09, 2019 @01:40AM (#20137352)
Thanks, that's it for sure.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by dwaite on Saturday June 08, 2019 @07:05PM (#20135792)
> Edit: Maybe Apple will introduce tiny key fobs that can be tracked so you can find your keys or other things.

This is strongly rumored.It may also fall into the bucket of technology they license out, such as Homekit.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by lixtra on Saturday June 08, 2019 @07:52PM (#20135995)
If device A and B (both identified by their IP) both see device C (identified by hash of key) I can infer that A and B are close to each other.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by MBCook on Saturday June 08, 2019 @08:48PM (#20136219)
That only works if the devices report WHO saw the missing device. If they both report up that the device is in the area ask but don’t say who is making the report then you can’t figure that out.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by lixtra on Sunday June 09, 2019 @02:20AM (#20137511)
Apple sees the reporting device’s ip-address. Obviously Apple is in an excellent position to spy you anyway, but the claim that even Apple doesn’t know where the turned off device is doesn’t hold for the reporting devices: Apple can infer which reporting devices are in proximity. And they possibly even know who the reporting IP is because of iCloud.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by bonestamp2 on Sunday June 09, 2019 @11:24AM (#20139780)
I guess that's true, but mobile device IP addresses cover a pretty wide area so it's not terribly precise.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by lixtra on Sunday June 09, 2019 @11:39AM (#20139883)
But reporting device A and B were in Bluetooth distance to lost device C. Therefore A and B were close together (like a few meters). It’s a huge improvement over A and B were in the same mobile cell.

You can then use the IPs to identify who are A and B.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by lixtra on Sunday June 09, 2019 @04:26AM (#20137950)
If you have a subpoena to sniff data to Apple from device X then you can use that to some extent track the location of X by spreading your Tags T_1,...,T_n in interesting places. If X reports T_i you know the location of X, this could be more precise than the usual cell phone tracking because X reports its position with GPS precision.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by threeseed on Saturday June 08, 2019 @05:53PM (#20135414)
Just attach a GPS tracker to the battery with a DC converter.

Far easier and more reliable than using a phone.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by floe on Saturday June 08, 2019 @06:09PM (#20135507)
That doesn't have plausible deniability if detected, though.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by tedunangst on Saturday June 08, 2019 @10:32PM (#20136671)
How long can one plausibly leave a phone in someone's car, asking for location updates the entire time, while claiming not to remember leaving it there?
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by floe on Monday June 10, 2019 @01:28AM (#20144133)
"I lost it under the seat"? And the point is it's not actively asking for location updates, which would drain battery. You just leave it with cellular off and it sends the standard Find My pulse over Bluetooth.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by tantalor on Saturday June 08, 2019 @08:12PM (#20136084)
Sure it does if there's nothing to connect you to it.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by m463 on Saturday June 08, 2019 @09:56PM (#20136523)
Just the fact that the device is being extra promiscuous on multiple frequencies is annoying enough.

I wonder if you can turn off "Find My" just like "find my iphone" and it will prevent these sorts of things.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by antijava on Saturday June 08, 2019 @10:31PM (#20136669)
If you turn off Find My iPhone it will also disable the new Bluetooth beaconing feature.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by zer0gravity on Sunday June 09, 2019 @03:34AM (#20137769)
How about the fact that Apple created an unregulated, opaque mesh network from its own devices?

No guarantees are provided that this network, under Apples's exclusive control, won't relay other type of information.

[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by abtinf on Sunday June 09, 2019 @04:58AM (#20138064)
NSA seems to be pretty happy with regulated networks.
[ Parent | on HN ]
Re:The clever cryptography behind Apple’s “Find My” feature by zer0gravity on Sunday June 09, 2019 @11:52AM (#20139948)
It's probably even happier with unregulated ones...
[ Parent | on HN ]