Researcher tricks Apple’s Find My into sharing location data with Linux

A young security researcher figured out a way to enroll a Linux device into Apple’s Find My network and read live location data from it.

Find My is Apple’s app for, you guessed it, finding things – whether AirTags, iPads, or other supported devices and items.

It also works for people.

Families can track each other's whereabouts for safety reasons, and friends can tell when others are hanging out without them.

In typical Apple fashion, though, the full Find My experience is limited to Apple hardware, like an iPhone or Mac. iBiz also offers Find Devices via the iCloud website, although it lacks Find My’s people-tracking feature for viewing locations others have shared with you.

However, the 22-year-old researcher, who goes by “Zerotistic,” devised a way to enroll a Linux-based machine into the iNetwork, tricking Apple into sending the people-location data it exclusively reserves for Apple devices.

It’s important to note, at this point, that this is not an exploit that allows anyone to arbitrarily retrieve any Apple user's location.

It refers to registering a non-Apple device to the Find My network and retrieving the location data of people who had already chosen to share their locations with the Apple account owner.

Retrieving people-location data requires Apple to trust that the machine you’re using belongs to its network and is capable of receiving the data, which is sent over Apple’s Push Notification service (APNs).

The first step was tying the Linux machine to the researcher’s Apple account.

Zerotistic obtained an identity delegate by going through Apple’s standard GrandSlam authentication protocol.

In pursuit of an Apple Identity Services (IDS) device certificate, which links the intended device to an Apple Account, they then used that delegate to build a custom certificate signing request (CSR).

Lots of trial and error later, Zerotistic discovered that the CSR had to use the PKCS#10 format and a 2048-bit RSA key signed using SHA-1, linking the Linux machine to their Apple account.

They bundled this up into a compressed XML file and sent it to Apple’s authenticateDS profile-enrollment endpoint.