A young researcher has conned Job’s Mob’s Find My network into treating a Linux box like approved hardware.
For those not in the know, Apple’s Find My system, the Fruity Cargo Cult, is supposed to help users locate AirTags, iPads and other supported kit. It can track those who have chosen to share their location.
In usual Job’s Mob fashion, the full Find My experience is fenced inside its own hardware, such as an iPhone or Mac. Its iCloud Find Devices page exists, but it does not offer the same people-tracking feature.
A 22-year-old researcher using the name Zerotistic found a way to enrol a Linux box into the iNetwork. The trick made Job’s Mob send people-location data normally reserved for its own devices. Zerotistic made it so it only retrieves locations from people who have already shared their whereabouts with the account owner.
To get there, Zerotistic first tied the Linux machine to a Jobs Mob account using its GrandSlam authentication protocol. The researcher then built a custom certificate signing request to obtain an Apple Identity Services device certificate. After plenty of farting about, Zerotistic found that the request required PKCS#10 format, a 2048-bit RSA key, and SHA-1 signing. The researcher’s best guess is that the creaky authenticateDS endpoint still expects older standards.
Job’s Mob signed the request, giving the Linux device the certificate needed to register its public key to the account. Zerotistic then had to convince Find My that the machine could receive location data.
The Find My registration required six subservices, supported encryption types and public keys for Job’s Mob’s device-to-device messaging format. It needed to be signed with IDS and APNs certificates before the Linux box could talk to private APNs servers.
A SubscribeAndFetch request then pushed an encrypted location key from a friend’s device to the Linux machine. Zerotistic wrote a script to unwrap the message, extract the key, and decrypt the coordinates, timestamps, and accuracy data, taking less than a week to get the whole thing working.
Apple is saying nothing.
