Researcher tricks Apple’s Find My into sharing location data with Linux

A researcher discovered a method to enroll a Linux device into Apple's Find My network and access live location information from it. Find My is Apple's application used for locating devices, including AirTags, iPads, and other compatible devices or individuals. Families can monitor each other's whereabouts for safety, while friends can verify if others are together without them.

However, Apple's Find My service is primarily designed for Apple hardware, such as iPhones and Macs. Apple also provides Find Devices through their iCloud website, but it lacks the people-tracking feature found in Find My.

The 22-year-old researcher, known as "Zerotistic," managed to enroll a Linux-based machine into the iNetwork, fooling Apple into sending people-location data typically reserved for Apple devices. Importantly, this technique does not enable unauthorized retrieval of any Apple user's location; it only allows registering a non-Apple device to the Find My network and obtaining location data from people who have opted to share their locations with the Apple account owner.

The process requires Apple to trust the machine's affiliation with the network and its ability to receive the data, transmitted via Apple's Push Notification service (APNs).

To accomplish this, Zerotistic first connected the Linux machine to their Apple account using Apple's standard GrandSlam authentication protocol. They then obtained an identity delegate by acquiring an Apple Identity Services (IDS) device certificate, which links the intended device to an Apple Account. Utilizing this delegate, they crafted a custom certificate signing request (CSR) with specific formatting requirements, including the use of PKCS#10 format, a 2048-bit RSA key signed using SHA-1.

This CSR was compressed into an XML file and sent to Apple's authenticateDS profile-enrollment endpoint, where Apple signed the CSR and provided the Linux device with the necessary IDS certificate to register its public key to the researcher's Apple account.

After registration, further steps were needed to convince Apple that the Linux device was capable of running Find My. The Linux device had to subscribe to six different subservices, define supported encryption types, and provide public keys for Apple's device-to-device messaging format. Additionally, it needed to be signed using an IDS certificate and an APNs certificate obtained during initial network setup.

With these elements in place, the researcher successfully enrolled the Linux machine in an Apple account and demonstrated to Find My that it could receive location data through a persistent binary TLS connection to Apple's private APNs servers.

However, merely registering the Linux device did not automatically grant access to location data shared by people who had previously given their locations to Zerotistic. To retrieve this data, Zerotistic issued a SubscribeAndFetch request, which prompted the researcher's friend's Find My device to push an encrypted location key to the newly registered Linux device.

Finally, to decrypt the location data fetched by the Linux device from Apple's SearchParty service, Zerotistic developed a Linux script. This script unpacked Apple's messaging envelope, extracted the shared location key, and decrypted the Find My location data, which includes coordinates, timestamps, and accuracy information. Within a week of modifying the script, the researcher was able to effectively retrieve and decode subsequent location reports for existing location shares.