A security researcher has successfully enrolled a Linux device into Apple's Find My network, enabling it to receive live location data from individuals who had previously shared their location with the associated Apple account. This development allows a non-Apple device to access a feature typically restricted to Apple hardware.
The researcher, known as "Zerotistic," is 22 years old and spent less than a week developing the technique. It is important to note that this method does not allow arbitrary retrieval of any Apple user's location; rather, it facilitates the reception of location data from users who have already consented to share their whereabouts with the owner of the Apple account linked to the Linux device.
The process involved several intricate steps to convince Apple's systems that the Linux machine was a legitimate device capable of receiving location data via Apple's Push Notification service (APNs). First, Zerotistic obtained an identity delegate through Apple's standard GrandSlam authentication protocol. This delegate was then used to craft a custom certificate signing request (CSR) in the PKCS#10 format, utilizing a 2048-bit RSA key signed with SHA-1. This CSR was then sent to Apple's `authenticateDS` profile-enrollment endpoint, which the researcher speculates is a legacy endpoint due to its requirement for older cryptographic standards and XML encoding.
Upon Apple signing the CSR, the Linux device received an Apple Identity Services (IDS) device certificate, linking it to the researcher's Apple account. However, further steps were necessary to enable Find My functionality. The researcher discovered that a Find My registration request required the device to subscribe to six specific subservices, declare its supported encryption types, and provide public keys for Apple's device-to-device messaging format. This request also needed to be signed using both the IDS certificate and an APNs certificate obtained during the initial network setup.
Once these conditions were met, the Linux machine was enrolled and capable of receiving location data via a persistent binary TLS connection to Apple's private APNs servers. Unlike a new Apple device, this registration did not automatically retrieve existing shared location data. To address this, Zerotistic issued a `SubscribeAndFetch` request, which prompted the friend's device to push an encrypted location key to the newly registered Linux device.
The final challenge was decrypting and interpreting the location data received from Apple's SearchParty service. This required a custom Linux script to unwrap Apple's messaging envelope, extract the shared location key, and decrypt the Find My location data, which includes coordinates, timestamps, and accuracy information. Once developed, the script could continuously fetch and decode subsequent location reports for the established location share.
Apple has not yet responded to inquiries regarding this research or any potential plans to address the implications of a non-Apple device accessing this functionality.
