INFRA Signal 439
Researcher enrolls Linux device in Apple’s Find My network to receive shared location data
↗
A security researcher demonstrated how to register a Linux machine with Apple’s Find My network to access location data shared with an Apple account
This work exposes a gap in Apple’s device-authentication assumptions. Engineers building location-sharing systems should audit how their protocols handle non-standard clients. The technique does not break encryption but bypasses Apple’s hardware restrictions, which may prompt tighter enrollment checks.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The researcher used Apple’s GrandSlam protocol and legacy CSR requirements to link a Linux device to an Apple account
Find My registration required subscribing to six subservices and providing encryption keys via a persistent TLS connection to Apple’s APNs
A custom Linux script decrypted location data after unwrapping Apple’s messaging envelope and shared location keys
THE READ
What the cluster adds up to.
A security researcher successfully enrolled a Linux device into Apple’s Find My network, allowing it to receive location data shared with an Apple account. The process relied on Apple’s existing authentication protocols but exploited legacy requirements, such as SHA-1-signed CSRs and XML encoding, to obtain an Identity Services (IDS) certificate. This certificate linked the Linux machine to the researcher’s Apple account, bypassing the usual hardware restrictions that limit Find My to Apple devices.
The next hurdle was convincing Apple’s system that the Linux device could handle Find My’s location data. This required subscribing to six subservices, defining supported encryption types, and providing public keys for Apple’s device-to-device messaging format. The device also needed a persistent binary TLS connection to Apple’s private APNs servers. While this registered the Linux machine, it did not automatically fetch shared location data, unlike a new Apple device, until a SubscribeAndFetch request was issued.
The final step involved decrypting the location data received from Apple’s SearchParty service. Since the Linux device lacked Apple’s native Find My app, the researcher wrote a script to unwrap Apple’s messaging envelope, extract the shared location key, and decrypt the coordinates, timestamps, and accuracy information. This demonstrated that Apple’s location-sharing protocol could be extended to non-Apple hardware without breaking encryption, though it required manual intervention to parse the data.
The technique does not allow arbitrary access to any Apple user’s location. It only retrieves data from people who had already chosen to share their location with the researcher’s Apple account. However, it reveals that Apple’s device-authentication checks for Find My are not strictly tied to hardware, relying instead on protocol compliance. Engineers designing similar systems should note that legacy endpoints and loose enrollment criteria can create unexpected attack surfaces, even when encryption remains intact.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER