Apple Find My Hack: Location Tracking on Linux
An enterprising researcher successfully compelled Apple Find My to operate within an environment completely unsupported by the corporation. A 22-year-old security specialist, operating under the pseudonym Zerotistic, cleverly registered a Linux machine within Apple’s infrastructure as a fully compatible device. Subsequently, the researcher acquired and decrypted real-time coordinates of an individual who had previously authorized the Apple Account owner to view their location. The entire experiment concluded in under a week, and the researcher published the astonishing results on August 19.
Bypassing Apple’s Walled Garden
The Find My service enables users to locate devices and personal items, including iPhones, iPads, and AirTags. Furthermore, it allows individuals to seamlessly share their location with friends and family members. Traditionally, Apple restricts comprehensive access to this location-sharing feature exclusively to its proprietary hardware ecosystem. While the web-based iteration of iCloud permits the tracking of hardware linked to a specific account, it steadfastly refuses to grant analogous access to the live geographic positions of other people.
Zerotistic resolved to painstakingly recreate the necessary components of Find My directly on a Linux system. Crucially, the discovered methodology does not permit the arbitrary surveillance of unsuspecting Apple device owners. The custom Linux client solely receives the coordinates of individuals who have already voluntarily shared their location with the owner of the corresponding Apple Account. The researcher discovered no viable method to maliciously add new contacts, unilaterally activate location sharing for unauthorized individuals, or circumvent established Find My permission structures.
Conquering Server Authentication
The primary obstacle involved satisfying the rigorous device verification protocols enforced by Apple’s servers. Merely authenticating an Apple Account proved insufficient to extract location data. The servers strictly demanded that the requesting computer function as a fully validated participant within Apple’s internal messaging infrastructure, known as Apple Identity Services (IDS). Data transmissions between authenticated devices rely heavily upon the Apple Push Notification service (APNs).
The Intricate Registration Protocol
Initially, Zerotistic authenticated utilizing the GrandSlam protocol, successfully acquiring the preliminary data necessary to interface with IDS. Subsequently, the diligent researcher generated a formal device certificate request. Following numerous frustrating failures, they determined that the Apple server exclusively accepted requests formatted as PKCS#10, requiring a 2048-bit RSA key and a specific SHA-1 signature. Furthermore, they had to meticulously encapsulate the request within XML and compress it using gzip before transmitting it to a deprecated access point designated authenticateDS.
Upon successfully processing this highly specific request, Apple dispensed an official IDS certificate, inextricably linking the rogue Linux client to the user’s account. Zerotistic exhaustively documented this convoluted registration procedure and the highly unusual certificate demands imposed by the server.
Establishing Trust and Intercepting Keys
However, a solitary certificate proved inadequate. To officially register within the Find My ecosystem, the Linux client had to declare explicit support for six distinct internal services. Additionally, it needed to transmit detailed specifications regarding supported encryption mechanisms and register cryptographic keys to facilitate secure, inter-device messaging. The researcher also dutifully signed this request utilizing both the IDS and APNs certificates. Following successful registration, Apple’s servers inexplicably began treating the Linux system as a legitimate device capable of receiving Find My communications.
The subsequent challenge arose concerning pre-existing location-sharing agreements. Following configuration, a newly activated Apple device typically receives the cryptographic keys necessary to view the locations of approved contacts automatically. Predictably, the homemade Linux client failed to receive these essential keys spontaneously. Undeterred, Zerotistic uncovered an internal SubscribeAndFetch request harboring a distributeKeys command. Upon transmitting this specific request, the friend’s device obediently transferred the valid cryptographic key to the Linux client via APNs and IDS. Fortunately, this process did not require the friend to reactivate location sharing or issue fresh permissions manually.
Decrypting the Coordinates
Armed with the essential key, the researcher finally accessed the SearchParty service, the conduit through which Find My returns encrypted location reports. A custom Linux script meticulously unpacked the Apple messages, rigorously verified the sender’s identity, extracted the key, and decrypted the coordinates entirely locally. Consequently, the computer successfully acquired precise geographic coordinates, the exact timestamp of their determination, and vital accuracy metrics. The system could easily download subsequent location updates without necessitating the repeated transmission of the key via IDS.
A History of Unorthodox Applications
Historically, ambitious researchers have frequently manipulated the closed Find My network to execute tasks entirely unforeseen by Apple. In 2021, specialist Fabian Bräunlein brilliantly demonstrated that individuals could exploit the infrastructure for covert data exfiltration via nearby Apple devices. This fascinating experiment utilized an ESP32 microcontroller and the OpenHaystack framework.
The OpenHaystack project empowers developers to engineer third-party Bluetooth beacons that cleverly utilize the Find My infrastructure for precise location tracking. SecurityLab previously analyzed the impressive capabilities of OpenHaystack and the inherent security vulnerabilities associated with the Find My architecture. Later, Apple officially opened the “Find My” network to third-party manufacturers, but stipulated that these manufacturers must actively participate in the official Find My Network accessory program.
In 2025, researchers pushed the boundaries further, unveiling the nRootTag attack. This sophisticated technique allows an attacker to transform a standard Bluetooth device into a tracked object within the Find My network. The authors successfully verified this method across nine Android smartphones, two Windows computers, and twelve distinct Linux distributions. Crucially, however, nRootTag utilizes a fundamentally different mechanism and does not grant Linux systems comprehensive access to the highly sensitive people location section.
Significance of the Breach
Zerotistic’s meticulous work distinguishes itself markedly from prior experiments precisely because it successfully secured access to the Find My People functionality. The researcher did not simply fabricate another AirTag clone. Instead, they painstakingly reproduced the intricate chain of internal Apple protocols, successfully registered a Linux machine as a trusted client, illicitly acquired the key for an already-approved location exchange, and flawlessly decrypted the coordinates.
Ultimately, this compelling experiment proves that many of the limitations Find My imposes upon third-party operating systems stem primarily from its rigid software architecture and stringent client verification protocols. It definitively demonstrates that processing this highly sensitive data on a Linux system is not technically impossible.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
