Apple’s Find My Network Could Be Exploited to Broadcast Text Messages

Apple’s Find My community could possibly be exploited to broadcast arbitrary messages to close by Apple gadgets, a safety researcher has discovered. The community is formally meant to assist folks discover their misplaced gadgets. It is claimed to have “industry leading security” in addition to end-to-end encryption. However, analysis exhibits that the Find My community can allow a strategy to ship any textual content messages — and never location particulars — to close by gadgets together with iPhone, iPad, and Mac.

Security researcher Fabian Bräunlein has found a loophole that enables exploitation of the Find My network protocol to ship regular textual content messages to close by gadgets. The researcher was capable of transmit textual content messages by replicating the way in which an AirTag communicates over the crowdsourced community and sends its GPS coordinates as an encrypted message.

Bräunlein took reference from a latest study carried out by Germany’s Technical University (TU) of Darmstadt that was aimed to assist builders construct equipment for the Find My community. After understanding the protocol powering the community, the researcher developed a customized gadget with a microcontroller operating a proprietary firmware to transmit the message. He additionally constructed a customized Mac app to decode and show the message from the gadget.

The proof-of-concept created by Bräunlein basically replaces the situation information that the Find My community usually broadcasts with textual content strings.

It is unclear at this second whether or not the mannequin developed by the researcher could possibly be used to flow into malicious content material over the Find My community. However, the in depth analysis carried out by Bräunlein exhibits that the protocol utilized by Apple could possibly be moulded to broadcast not location information however content material comparable to textual content messages.

Earlier this week, a German safety researcher reported that the Apple AirTag could possibly be hacked to exchange the default Find My hyperlink with a customized hyperlink for NFC readers. This manipulation was comparable in nature to what has now been discovered on the Find My community.