Show HN: Forensic evidence of iOS mesh networking bypassing Airplane Mode

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by lucasar on Thursday January 01, 2026 @08:12AM (#46453829)

Maybe the culprit is the technology and nasty tricks backing the "Find my device" feature? iOS devices will share their location (and potentially other data) with other nearby devices using a mesh network with certain frequency, even in Airplane mode. Also if the iPhone/iPad is powered off using the "power off" feature, the device will still be findable.

This capability is one of the strong selling points for consumers. The modern, average thief will often toss away these devices and settle with the rest of the loot because of this.

Sounds like OP wasn't aware of this.

[ Parent | on HN ]

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by TakeFlight007 on Thursday January 01, 2026 @08:35AM (#46453984)

I'm aware of "Find My Device" that's a documented feature. Find My beacons go OUT (your device tells others where it is). This is 84MB coming IN. Different thing.

[ Parent | on HN ]

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by lucasar on Thursday January 01, 2026 @09:40AM (#46454480)

Well, such traffic goes OUT somewhere and that somewhere is other iDevices so that's traffic coming IN for them, no? I don't have evidence supporting either possibility other than the fact that there's indeed an obscure mesh network involved for "Find My" to operate. I hope this is the starting point to figuring out what their infrastructure does.

[ Parent | on HN ]

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by ACSL8TER on Thursday January 01, 2026 @10:42AM (#46454919)

The repo shows traffic is bound to utun2 (IDSNexusAgent). That’s not a location beacon protocol… that’s an encrypted IP tunnel

[ Parent | on HN ]

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by lucasar on Thursday January 01, 2026 @01:16PM (#46456493)

Yes, that is used to exchange information between iDevices. The "Find my" mechanism is proprietary and closed source, so you cannot categorically discard the possibility of iOS using such tunnel to send/receive/forward such information. Yes it could be something else. But if we want to be rigorous, we cannot discard possibilities we aren't 100% sure about.

[ Parent | on HN ]

Re:Show HN: Forensic evidence of iOS mesh networking bypassi... by TakeFlight007 on Thursday January 01, 2026 @03:24PM (#46457671)

You are right... and being rigorous is the only path to trust. We can shift the issue from "what is it" to "why isn't it documented and why does status report inactive.

84.5 MB through utun2/IDS during stated isolation—benign or not—contradicts "wireless features turned off" and users have no verification path.

The "closed source" problem you identified is the core issue. So to be rigorous, plausible deniability ends where the telemetry contradicts the UI.

[ Parent | on HN ]