Apple's Find My Network Exploit Lets Hackers Silently Track Any Bluetooth Device 22
Researchers at George Mason University discovered a vulnerability in Apple's Find My network that allows hackers to silently track any Bluetooth device as if it were an AirTag, without the owner's knowledge. 9to5Mac reports: Although AirTag was designed to change its Bluetooth address based on a cryptographic key, the attackers developed a system that could quickly find keys for Bluetooth addresses. This was made possible by using "hundreds" of GPUs to find a key match. The exploit called "nRootTag" has a frightening success rate of 90% and doesn't require "sophisticated administrator privilege escalation."
In one of the experiments, the researchers were able to track the location of a computer with an accuracy of 10 feet, which allowed them to trace a bicycle moving through the city. In another experiment, they reconstructed a person's flight path by tracking their game console. "While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location. With the attack method we introduced, the attacker can achieve this," said one of the researchers. Apple has acknowledged the George Mason researchers for discovering a Bluetooth exploit in its Find My network but has yet to issue a fix. "For now, they advise users to never allow unnecessary access to the device's Bluetooth when requested by apps, and of course, always keep their device's software updated," reports 9to5Mac.
In one of the experiments, the researchers were able to track the location of a computer with an accuracy of 10 feet, which allowed them to trace a bicycle moving through the city. In another experiment, they reconstructed a person's flight path by tracking their game console. "While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location. With the attack method we introduced, the attacker can achieve this," said one of the researchers. Apple has acknowledged the George Mason researchers for discovering a Bluetooth exploit in its Find My network but has yet to issue a fix. "For now, they advise users to never allow unnecessary access to the device's Bluetooth when requested by apps, and of course, always keep their device's software updated," reports 9to5Mac.
Turn off your Bluetooth (Score:3)
Might suck for people actually using it for something like earbuds but turn off your Bluetooth on everything.
Re: (Score:2)
Might suck for people actually using it for something like earbuds but turn off your Bluetooth on everything.
I've always kept it off for battery life. That and bluetooth audio usually makes Dave Mustaine's voice sound as tinny as Gen. Bernard Montgomery's.
Re: (Score:2)
turn off your Bluetooth on everything
A bit difficult to do with your pacemaker.
Re: (Score:2)
Didn't know anyone was crazy enough to make those but:
https://www.medtronic.com/en-u... [medtronic.com]
"BlueSync technology within certain implantable cardiac devices enables secure, wireless communication via Bluetooth®* low energy without compromising longevity."
Huh.
I needed another reason (Score:1, Troll)
Re: (Score:2)
What is that supposed to mean?
Obviously you can search for your lost items your self.
That is the whole point of it!
Re: (Score:1)
You misunderstand what he is saying (BTW, "yourself" is 1 word).
The article states that *any* bluetooth item can be tracked using their network, by pretending to be an Airtag.
While Apple obviously only has functionality to track Airtags, not any bluetooth item.
Therefore, malcreants have more power & functionality than actual users.
Re: (Score:2)
"Any" meaning any *hacked* Bluetooth device. The issue is it has to register with Apple first to be tracked (Apple doesn't have a database of every Bluetooth device out there and their current location - it just has a database of "AirTag"
Re: (Score:2, Flamebait)
Be honest. You don’t need any “reasons” to hate & criticize Apple, jealousy is more than enough.
sounds useful! (Score:4, Informative)
Apple's Find My Network Exploit...
I would pay top dollar for that product. Of course it's an Apple product so I would be paying top dollar for that product. ;)
How surprising! (Score:2)
Nobody is hacking smart locks (Score:2)
"While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location. With the attack method we introduced, the attacker can achieve this," said one of the researchers.
It's amazing how many otherwise intelligent people immediately assume the "smart" aspect of a smart lock is the weakest link in the security. Most smart locks still have a physical keyway as a backup, and those can be easily defeated with a bump key [youtube.com].
Of course, the reason we can get away with having such abysmally bad security on homes is that burglarizing a residence is very high risk, low reward crime.
Exploitability? (Score:5, Informative)
The exploit called "nRootTag" has a frightening success rate of 90% and doesn't require "sophisticated administrator privilege escalation."
I suppose we won't know more until the researchers present their findings in August, but if not "admin privilege escalation" on the device you're trying to track, what does it require? Presumably the installation of some kind of malware that can access the Bluetooth stack and make it communicate with Apple devices as if it were an Airtag.
This seems bad, but I read it as far from the nightmare scenario of being able to sniff an identifier of a Bluetooth device and then track it on an ongoing basis through Find My.
Re: (Score:2)
Re: Exploitability? (Score:2)
Re: (Score:2)
I was trying to parse their wording to make that exact determination. They certainly didn't make it obvious. But this language:
While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location.
Leads me to believe that "hacking" the smart lock is a prerequisite for then exploiting the Find My network to determine its location.
Re: (Score:2)
I was trying to parse their wording to make that exact determination. They certainly didn't make it obvious. But this language:
While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location.
Leads me to believe that "hacking" the smart lock is a prerequisite for then exploiting the Find My network to determine its location.
I hear you, and maybe. Or even probably. But... if your smart lock is not hacked, it is not horrifying for the attacker to know its location. I don't know the one causes the other. It may be that the location of a non-hacked lock is... irrelevant. Dunno.
Maybe the strongest argument is in the advice to be cautious about programs asking to use Bluetooth. I'm guessing maybe those programs are doing so to register the phone with Apple. Maybe.
Re:Exploitability? (Score:4, Informative)
Re: (Score:2)
Thank you for an excellent summary.
A design so good some of the greybeards at NSA may have come up with it.
Unfortunately for cyberwarfare the next generation there seems literally insane. But at least we now know how all the target lists of normal people were developed.
The trouble is now we also know that with a zeroday arsenal the political opponents can be tracked in Airplane Mode away from cell service.
Yoiks.
Re: (Score:2)
wrong tag-line (Score:2)
"From the NSA-is-furious department"