Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Abstract

Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.

OpenHaystack

“…2 and explain how we integrate the different steps in OpenHaystack below. Please refer to our paper [9] and Apple's accessory specification [3] for more details.…”

“…Anisette data consists of a machine ID that identifies the current device and a one-time password [1]. The search party token is used together with the Apple user ID to perform HTTP basic authentication (details in [9]).…”

“…Our current implementation of OpenHaystack [8] is a proof-ofconcept based on the findings of our paper [9]. It solves the purpose of locating devices, but it does not include all features that are part of Apple's official specification [3].…”

“…Since OpenHaystack uses a private API on macOS to download the encrypted location reports, future macOS updates might break compatibility with our Mail plugin. In that case, it should be possible to restore access to the required authentication tokens by disabling macOS's system integrity protection (SIP) [9].…”

“…OpenHaystack is the result of reverse-engineering and security analysis work of Apple's Find My network (or offline finding). In our paper [9], we identified how lost Apple devices can be found by iPhones, even when they are offline. The whole system is a clever combination of Bluetooth advertisements, public-key cryptography, and a central database of encrypted location reports.…”