Technology

58061 readers

31 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

[email protected]

215

Apple 'Find My' network can be abused to steal keylogged passwords (www.bleepingcomputer.com)

submitted 10 months ago by [email protected] to c/[email protected]

10 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 4 points 10 months ago* (last edited 10 months ago) (1 children)

The potential to abuse Find My to transmit arbitrary data besides just device location was first discovered by Positive Security researchers Fabian Bräunlein and his team over two years ago, but apparently, Apple addressed this problem.

Not with Apple's network anymore apparently. But if you read the original PoC from 2021 they said Amazon's Echo devices have the same potential.

Ultimately, even the researchers have indicated the slow and unreliable nature of the attack (which now no longer works).

Small complication: public key validity. Having implemented both the sending and receiving side, I performed a first test by broadcasting and trying to receive a 32 bit value. After a few minutes, I could retrieve 23 out of the 32 bits, each one being unambiguous and with ~100 location reports, but no reports for the remaining 9 bits.

[–] [email protected] 2 points 10 months ago* (last edited 10 months ago)

I just watched a video by a German tech magazine the other day, with Fabian Bräunlein (the original researcher) demonstrating a keylogger using the Find My network. It's only 3 days old, so I don't think the main problem is fixed at all.