Researcher Tricks Apple's Find My Network into Sharing Location Data with Linux
A security researcher successfully enrolled a Linux device into Apple's Find My network, enabling it to receive location data shared by other users by exploiting older authentication standards.
A 22-year-old security researcher, known online as "Zerotistic," has devised a method to enroll a Linux-based machine into Apple's Find My network, allowing it to receive location data that users have chosen to share.
While Apple's Find My service is designed to locate devices and items like AirTags, it also facilitates location sharing among family and friends. However, the full functionality, particularly the ability to view locations shared by others, has historically been exclusive to Apple hardware. This new technique circumvents that limitation, enabling a non-Apple device to act as a recipient of this sensitive location information.
The process does not grant arbitrary access to any user's location. Instead, it focuses on registering a Linux device to an Apple account and then retrieving location data from contacts who have already opted to share their whereabouts with that specific account owner. Crucially, this requires Apple's Find My infrastructure to trust the enrolled device as a legitimate participant capable of receiving data via Apple's Push Notification Service (APNs).
Zerotistic achieved initial enrollment by obtaining an identity delegate through Apple's standard GrandSlam authentication protocol. This delegate was then used to construct a custom certificate signing request (CSR). Through extensive trial and error, the researcher discovered that the CSR needed to adhere to older standards, specifically using the PKCS#10 format with a 2048-bit RSA key signed using SHA-1. This custom certificate was submitted to Apple's authenticateDS profile-enrollment endpoint, which, surprisingly, accepted the older format, likely due to the legacy nature of the endpoint.
Upon successful signing of the CSR by Apple, the Linux device received an Identity Services (IDS) certificate, effectively linking its public key to the researcher's Apple account. However, simply registering the device was insufficient. The Linux machine needed to convince the Find My service that it was capable of handling location data. This involved subscribing to six specific subservices, declaring supported encryption types, and providing public keys compatible with Apple's device-to-device messaging format, all signed with the IDS and an APNs certificate.
With the Linux device successfully registered and recognized as capable of receiving location data, the next step was to actually fetch the shared information. A "SubscribeAndFetch" request was issued, prompting a friend's device to push an encrypted location key to the newly enrolled Linux machine via Apple's SearchParty service.
The final hurdle involved decrypting the location data. Since the researcher was not using a graphical interface but rather receiving raw encrypted data, a custom Linux script was developed. This script was designed to unwrap Apple's messaging envelope, extract the shared location key, and decrypt the location payload, which includes coordinates, timestamps, and accuracy details. This script could then continuously fetch and decode subsequent location updates.
Zerotistic reported that the entire technique took less than a week to develop. When approached for comment, Apple did not immediately respond regarding its awareness of this research or any plans to address the issue.