Security Researchers Develop Framework for Tracking Bluetooth Devices Using Find My

Ahead of the debut of AirTags and support for locating third-party Bluetooth items through Find My in iOS 14.5, a team of security researchers from the Secure Mobile Networking Lab at the Technical University of Darmstadt in Germany has reverse engineered the ‌Find My‌ protocol and developed an app that's designed to let anyone create an "AirTag" based on a Bluetooth-capable device.

openhaystack mac app
Called OpenHaystack, the app and the source code are available on GitHub for those who are interested in taking a look. The app allows users to create their own Bluetooth tags based on the ‌Find My‌ network by installing an "‌AirTag‌" firmware image on a Bluetooth dongle.

The app displays the most recent location of a created Bluetooth tag reported by any iPhone using Apple's ‌Find My‌ network that was implemented in iOS 13, plus it shows the location of the tag on a map.

According to the security researchers, the created tags send out Bluetooth beacons, which are picked up by nearby iPhones that interpret the sending device as lost. The current geolocation is end-to-end encrypted and then uploaded to Apple, with the OpenHaystack app then downloading the encrypted report from Apple and decrypting it locally on the Mac.

In the process of developing this tool, the Secure Mobile Networking Lab researchers also identified a macOS Catalina ‌Find My‌ vulnerability that was reported to Apple and addressed in a 10.15.7 update released back in November. The vulnerability allowed a malicious app to access iCloud decryption keys to download and decrypt location reports submitted by the ‌Find My‌ network.

Apple's iOS 14.5 update includes support for tracking third-party Bluetooth devices in the ‌Find My‌ app using a new "Items" tab, which takes advantage of the same ‌Find My‌ protocol used for the Mac app.

At the current time, in-app tracking is limited to Beats headphones and upcoming Belkin wireless earbuds, but in the future, many third-party Bluetooth devices may include ‌Find My‌ integration, making it easier to keep track of them. This system will also be used by Apple's own rumored AirTags, which have yet to be released.

Popular Stories

Generic iOS 18

Apple Releases iOS 18.0.1 With Touch Screen Bug Fix and More

Thursday October 3, 2024 2:22 pm PDT by
Apple today released iOS 18.0.1 and iPadOS 18.0.1, the first updates to the iOS 18 and iPadOS 18 operating systems that debuted earlier in September. iOS 18.0.1 and iPadOS 18.0.1 come two weeks after the launch of iOS 18. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. According to Apple's release notes, the...
ipad mini 2021 youtube

New Report Reveals When to Expect the iPad Mini 7

Tuesday October 1, 2024 2:09 pm PDT by
Apple is working on a new iPad mini that will "potentially" be released "by the end of 2024," according to a report today from Bloomberg's Mark Gurman. Last month, Gurman reported that Apple had "new iPads in the works," including an upgraded version of the iPad mini. At the time, he said the device was "on deck for Apple's October event" alongside the first M4 Macs. The wording in his...
macOS Sequoia Night Feature

Apple Releases macOS Sequoia 15.0.1 With Bug Fixes

Thursday October 3, 2024 2:27 pm PDT by
Apple today released macOS Sequoia 15.0.1, the first update for the macOS Sequoia operating system. The 15.0.1 update comes a week after Apple first released macOS Sequoia 15. Mac users can download the ‌macOS Sequoia‌ update by using the Software Update section of System Settings. According to Apple's release notes, macOS Sequoia 15.0.1 fixes a bug that could cause the Messages app...
15 New Things Your iPhone Can Do in iOS 18

15 New Things Your iPhone Can Do in iOS 18.1

Friday September 27, 2024 6:14 am PDT by
Apple is set to release iOS 18.1 in October, bringing the first set of Apple Intelligence features to iPhone 15 Pro and iPhone 16 models. This update marks a significant step forward in Apple's AI integration, offering a new Siri contextually-aware experience and a range of additional capabilities powered by on-device machine learning and large language models. There are a couple of handy new...
maxresdefault

Two Weeks With the iPhone 16 Pro Max

Friday October 4, 2024 12:04 pm PDT by
Now that it's been two weeks since the iPhone 16 models were released, we've been able to spend enough time with the new devices to share a more in-depth review on their performance, battery life, feature set, and more. Subscribe to the MacRumors YouTube channel for more videos. We've been testing the iPhone 16 Pro and Pro Max, but the gap between the Pro models and the standard iPhone 16...
macOS Sequoia Feature

Here Are All the New Features Coming to macOS Sequoia This Month

Thursday October 3, 2024 6:27 am PDT by
‌Apple in October will release macOS Sequoia‌ 15.1, bringing to Macs the first Apple Intelligence features such as Writing Tools, new Siri features, Smart Replies, and more. In addition, macOS 15.1 adds a handful of welcome tweaks and improvements to existing Mac capabilities. Here's what we can expect from the first major update to macOS Sequoia later this month. Note that Apple...
apple silicon mac lineup wwdc 2022 feature purple

MacBook Pro, iMac, and Redesigned Mac Mini With M4 Chips on Track to Launch 'This Year'

Tuesday October 1, 2024 1:57 pm PDT by
Apple plans to release new MacBook Pro, iMac, and Mac mini models with the M4 series of chips "this year," according to Bloomberg's Mark Gurman. Gurman initially said these Macs would likely be announced during a virtual event this October, but he has been more vague about the timing lately, with wording such as "in the coming weeks" and now merely "this year." In any case, it is clear that...
tedlasso

'Ted Lasso' to Return to Apple TV+ as Season Four Allegedly 'Confirmed'

Thursday October 3, 2024 9:21 am PDT by
Ted Lasso will be returning for a fourth season, according to Sigmund Judge, a writer at MacStories and co-host of the Magic Rays of Light podcast. In a social media post today, Judge said he has confirmed that pre-production of the smash-hit Apple TV+ comedy series will begin in January in London, England. Apple has yet to confirm the fourth season, and there is no set release date yet....

Top Rated Comments

Apple_Robert Avatar
47 months ago

This is good stuff guys! Apple is on top of it
Apple is on top of it? What does that mean?
Score: 7 Votes (Like | Disagree)
coolfactor Avatar
47 months ago
This strikes me as concerning.
Score: 6 Votes (Like | Disagree)
Corsig Avatar
47 months ago
Yeah that won’t last long
Score: 5 Votes (Like | Disagree)
Apple_Robert Avatar
47 months ago

The privacy.. security...
The article is about a couple of researchers creating an app that reverse engineers Find My. This isn't awesome stuff. This is concerning.

Edited to correct my misunderstanding.
Score: 5 Votes (Like | Disagree)
cmaier Avatar
47 months ago

Awesome! Let’s hope Apple don’t try to patch this.
Why not? Security holes are bad. Anyone who wants to integrate into the Find My network can do so the official way.
Score: 5 Votes (Like | Disagree)
Apple_Robert Avatar
47 months ago

Awesome! Let’s hope Apple don’t try to patch this.
I hope Apple does patch the vulnerability and render this app useless.
Score: 4 Votes (Like | Disagree)