Who Can Find My Devices

Aus Vokipedia
Version vom 5. Dezember 2025, 11:07 Uhr von JohannaRatcliffe (Diskussion | Beiträge)

(Unterschied) ← Nächstältere Version | Aktuelle Version (Unterschied) | Nächstjüngere Version → (Unterschied)
Wechseln zu: Navigation, Suche


Overnight, Apple has turned its a whole lot-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network known as offline finding (OF). OF leverages online finder devices to detect the presence of missing offline gadgets using Bluetooth and report an approximate location again to the proprietor by way of the Internet. While OF shouldn't be the primary system of its sort, it is the primary to decide to strong privateness goals. Particularly, OF goals to ensure finder anonymity, untrackability of proprietor gadgets, and confidentiality of location reports. This paper presents the first complete security and privacy evaluation of OF. To this finish, we recover the specs of the closed-supply OF protocols by the use of reverse engineering. We experimentally present that unauthorized access to the situation stories allows for iTagPro product accurate gadget monitoring and retrieving a user’s high areas with an error within the order of 10 meters in city areas. While we find that OF’s design achieves its privateness goals, we uncover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized entry to the location historical past of the previous seven days, which may deanonymize users.



Apple has partially addressed the problems following our accountable disclosure. Finally, we make our analysis artifacts publicly accessible. In 2019, Apple introduced offline discovering (OF), a proprietary crowd-sourced location tracking system for offline gadgets. The fundamental thought behind OF is that so-called finder gadgets can detect the presence of other lost offline gadgets using Bluetooth Low Energy (BLE) and use their Internet connection to report an approximate location again to the owner. This paper challenges Apple’s safety and privateness claims and examines the system design and implementation for vulnerabilities. To this end, we first analyze the concerned OF system components on macOS and iOS utilizing reverse engineering and present the proprietary protocols concerned throughout dropping, searching, and discovering units. In brief, units of 1 proprietor agree on a set of so-known as rolling public-private key pairs. Devices without an Internet connection, i.e., with out cellular or Wi-Fi connectivity, emit BLE ads that encode one of many rolling public keys.



Finder units overhearing the ads encrypt their current location below the rolling public key and send the situation report to a central Apple-run server. When looking for a lost gadget, another owner machine queries the central server for location stories with a set of known rolling public keys of the lost device. The owner can decrypt the reports using the corresponding private key and retrieve the location. Based on our analysis, we assess the security and privateness of the OF system. We discover that the general design achieves Apple’s particular goals. However, we discovered two distinct design and implementation vulnerabilities that appear to be exterior of Apple’s menace mannequin however can have extreme consequences for the customers. First, the OF design permits Apple to correlate completely different owners’ places if their locations are reported by the same finder, iTagPro product effectively permitting Apple to assemble a social graph. We demonstrate that the latter vulnerability is exploitable and confirm that the accuracy of the retrieved stories-in fact-permits the attacker to find and identify their victim with high accuracy.

Meine Werkzeuge
Namensräume

Varianten
Aktionen
Navigation
Werkzeuge