Researcher tricks Apple’s Find My into sharing location data with Linux

A young security researcher figured out a way to enroll a Linux device into Apple’s Find My network and read live location data from it. Find My is Apple’s app for, you guessed it, finding things – whether AirTags, iPads, or other supported devices and items. It also works for people. Families can track each other's whereabouts …

[Steve Hersey]

Not so much "Find My busting" as "adversarial interoperability"

Not a bug, not an exploit. With luck, Apple won't have the attention span to brick this interoperability hack.

[Detective Emil]

Re: Not so much "Find My busting" as "adversarial interoperability"

Apple had a considerably longer attention span than most industry players. Unfortunately, in this instance. However, this is precisely the sort of operability thst the EU is increasingly demanding. Mote power to its elbow.

[cyberdemon]

Re: Not so much "Find My busting" as "adversarial interoperability"

I agree, and I'm surprised crapple haven't been hauled into an Antitrust case over this yet.

I may try this. My dad (who is blind, and worries about falling over if he goes for a walk, but wants to retain some independence) frequently asks if I can track his phone - I can, but only if he (or I) send a Whatsapp live location to my phone, which lasts up to 8 hours at a time. My phone is Android, so I can't use the Find My network.

But granting -authorised- parties access to one's location is something many people want - especially the elderly/infirm, and Apple should not be allowed to restrict that to other Apple users.

[Yet Another Anonymous coward]

Re: Not so much "Find My busting" as "adversarial interoperability"

>I agree, and I'm surprised crapple haven't been hauled into an Antitrust case over this yet.

Apple have always been able to claim that compared to Windows and Android they are a plucky little underdog rather than a monopoly

[Screepy]

Re: Not so much "Find My busting" as "adversarial interoperability"

@cyberdemon

Assuming you're using a 'normal' Android (IE. Not de-googled) you can share location via Google maps with anyone in your contacts, and they can share their location back.

And it lasts until you turn it off.

I have been keeping track of my elderly parents for years using this method.

Both parties need an android phone and then..

Google Maps -> Click on your profile -> Location Sharing -> New Share

[cyberdemon]

Re: Not so much "Find My busting" as "adversarial interoperability"

> Assuming you're using a 'normal' Android (IE. Not de-googled)

It's de-googled, of course. It runs /e/ OS

> Both parties need an android phone and then..

Then Google is pulling the same shitty stunt as Apple. My dad has an iPhone, I have Android. They need to be able to talk to eachother.

[Anonymous Coward]

Re: Not so much "Find My busting" as "adversarial interoperability"

With all due respect, why?

Both phones talk open standards, but this tech is proprietary. Apple has invested in it, and Google equally did their own thing. Why should they be forced to share?

[Anonymous Coward]

Re: Not so much "Find My busting" as "adversarial interoperability"

> this tech is proprietary

Having a GPS is proprietary? Having a list of people to share with is proprietary? Sending a message across a network is proprietary?

The proprietary part is the guff all sides have added to ensure that no horrid little open standards get their noses into their services.

Oh, yes, and making sure that all these messages go via their centralised servers instead if anything insane, like devices sending the data directly to the agreed recipients (after all, if it isn't centralised then it can't be monetised).

PS

Yes, ok, there is also the proprietary bit about making sure all devices, even those whose owners aren't using the services in any way, continually listen out for short-range Bluetooth contacts from AirTags or similar, which raises other questions about misuse of those phones resources by the manufacturers once they are sold and are someone else's property.

[Anonymous Coward]

Now that the details of the process are understood, I'm sure it could be modified to work with any other type of device, not just Linux.

[Anonymous Coward]

Why does FindMy not work?

My wife and I both have iPhones (lucky us). We've set up reciprocal FindMy details but whilst her phone can find mine, mine can't find hers :(

Anybody got any idea where to look to identify whatever is set wrong?

[Jimjam3]

Re: Why does FindMy not work?

At a guess her settings are a little more conservative than yours. Check her preferences.

[elDog]

Re: Why does FindMy not work?

She doesn't really want you to find her?

I don't know this but it seemed to be the quickest answer that floated out of my brainsac.

[Evil Auditor]

Re: Why does FindMy not work?

Same thought here.

Wifey once asked whether the two of us shall share our location data. To which I answered that I do not mind to share my location with her but I very much mind to share it with anything and anyone else besides the three apps that need it to function properly.

[trevorde]

What Apple did next

Sue Zerotistic into oblivion

[itscomplicated]

Another way

You can also set up a macOS VM, run Find My on it and screen scrape the locations.

[anonymous boring coward]

You can also buy a cheap second hand Apple device for way less than a week's wages.

[Anonymous Coward]

Good thinking, that man.

Get a cheap Apple device (or a cheap Android device) and some clear Gorilla tape, then securely tape it to the back of your daily driver expensive Android device (or expensive Apple device). Or one of each and bond them onto your sensible Linux laptop.

That way you know that you can share location with everyone. Eventually.

[anonymous boring coward]

The cheap apple device is used to get location data, not to send location data. Just like the hack was used to decode location data.

[IGotOut]

Wooosshhhh

"You can use a MacVM" or "You can buy a second hand iPhone"

FFS

You can buy a jumper, but people like to knit. You can buy a loaf of bread, but people still like to bake. You can buy a car, but people still like to build them.

Are peoples lives now so rotten, that they would rather be spoon fed everything whilst dribbling into their takeaway meal rather actually challenging themselves?

And we wonder why AI "art" and "music" is so popular with many people.

So here's a beer to the researcher for taking on the challenge and pursuing it until the end.