Researcher tricks Apple’s Find My into sharing location data with Linux

A 22-year-old security researcher, known as "Zerotistic," has discovered a method to register a Linux device into Apple's Find My network and access live location data from it. Find My is Apple's app designed to help users locate items, people, and even themselves using a network of Apple devices. However, this method allows access to location data from non-Apple devices that have previously shared their locations with the Apple account owner.

The researcher first linked the Linux machine to their Apple account using Apple's GrandSlam authentication protocol and an Apple Identity Services device certificate. They then crafted a custom certificate signing request (CSR) following specific requirements such as using PKCS#10 format, a 2048-bit RSA key, and SHA-1 signing. Apple signed the CSR, granting the Linux device the necessary identity certificate to register its public key to the researcher's Apple account.

After registration, the Linux machine had to prove its capability to receive Find My location data by subscribing to six subservices, defining supported encryption types, and providing public keys. Once registered, the researcher used a SubscribeAndFetch request to obtain encrypted location keys from a friend's Apple device, which were then decrypted and decoded using a Linux script.

The researcher managed to develop the method in under a week, but Apple did not yet respond to inquiries regarding the discovered vulnerability.