Security researcher enrolls Linux device in Apple’s Find My network

As reported by The Register, a security researcher successfully enrolled a Linux device into Apple's Find My network, enabling the retrieval of live location data.

The researcher, known as Zerotistic, devised a method to trick Apple's systems into sending location data, typically reserved for Apple devices, to a Linux machine. This was achieved by obtaining an identity delegate and using it to create a custom certificate signing request (CSR) in PKCS#10 format with a 2048-bit RSA key signed using SHA-1. This CSR was sent to Apple's authenticateDS profile-enrollment endpoint, which, surprisingly, accepted older standards. After Apple signed the CSR, the Linux device received an IDS certificate.

Further steps involved convincing Find My that the device was capable of receiving location data by subscribing to specific subservices and defining encryption types. A SubscribeAndFetch request then prompted a friend's device to push an encrypted location key. Zerotistic developed a Linux script to unwrap this message, extract the key, and decrypt the location data, including coordinates and timestamps. This process took less than a week. Apple did not respond to inquiries from The Register about this discovery.

Source: The Register