Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

AirTag Successfully Hacked to Show Custom URL in Lost Mode

Why shouldn't I scan an AirTag? That's a tough one, but I'll take a shot. Say I'm working at Apple. Somebody puts an AirTag on my desk, something nobody else can scan. Maybe I take a shot at it and maybe I scan it. And I'm real happy with myself, cause I did my job well. But maybe that URL was the location of some rebel malware...

... on GeoCities or the Facebook. Once they have that location, they flood the browser where the malware was hiding and fifteen hundred cookies I never accepted, never had no problem with, get downloaded. Now the store managers are sayin', "Oh, send in the Genius Bar to secure the browser" cause they don't give a s**t. It won't be their phone over there, gettin' corrupted. Just like it wasn't them when their AirTag got scanned, cause they were pullin' a tour over at Best Buy. It'll be some kid from UPS takin' 30 pin connectors in the ***.

And he comes back to find that the store he used to work at got exported to the country he just got back from. And the guy who put the 30 pin connector in his a** got his old job, cause he'll work for fifteen cents a day and no Applecare. Meanwhile, he realizes the only reason he was over there in the first place was so we could install an iOS update that would sell us Apple watch bands at a good price. And, of course, the case manufacturers used the skirmish over there to scare up domestic case prices. A cute little ancillary benefit for them, but it ain't helping my buddy at two-hundred-fifty a keyboard case.

And they're takin' their sweet time bringin' the cases back, of course, and maybe even took the liberty of hiring an alcoholic skipper who likes to drink martinis and play slalom with the walls of the Suez canal, and it ain't too long 'til he hits one, spills the cases and kills all the sea life in the canal. So now my buddy's out of work and he can't afford to upgrade from his iPhone 5, so he's got to walk to the job interviews, which sucks cause the 30 pin connector in his a** is givin' him chronic disconnects. And meanwhile he's starvin', cause every time he tries to use his keyboard case to order Uber Eats, the only bluetooth connection he gets is to his HiFi.

So what did I think? I'm holdin' out for somethin' better.

I figure F it, while I'm at it why not just setup my buddy with a Chromebook, take his iPhone, give it to someone from Google, hike up AppStore prices, download some cookies, switch to Cortana, install Facebook Messenger and join the Geek Squad? I could be put in charge of Epic.
 
  • Haha
Reactions: Graphikos and zackkitzmiller
centauratlas said:
The scenario is: modify your airtag to have a URL to a compromised site (phishing or a drive by site like the ones patched in the last update). Anyone who then scans it can be compromise. Drop it at a company's corporate headquarters by the security office or by the CEO's (BoD's, executives, maintenance, food, coffee provider etc) car (or any other office) and then eventually someone will scan it. They then enter the office, join wifi etc with a compromised device which can scan for unprotected devices, monitor network traffic etc. Likewise, their credentials will be then compromised making further intrusions easier.

It is like any machine, with physical access most things can be compromised. This just increases the attack vectors for people who pick them up.
Click to expand...
Sure, but the same exploit would work with anything. One could do it with a Tile, or just a regular Airtag that was next to your homemade beacon. To me, the big question is the wisdom of broadcasting a website, and especially opening a website that's being broadcast.
 
  • Like
Reactions: KeithBN
tomekwsrod said:
So if you lose your AirTag and then find it after one day for example, you cannot trust it anymore? Or if you find someones AirTag should you be also wary of placing it near your own phone? This gets interesting.
Click to expand...
I never understand this constant nonsense about losing Airtags. There should be very little chance of this happening. Aren't most people buying them to put on their keyring? Aren't most people going to put them in their purse or wallet? Aren't others going to clip them to the inside of their luggage? Aren't the rest going to hook them to their pet's collar? If any of the above gets lost I would think people are more concerned about their keys, wallet, purse, luggage or pets getting lost over a $29 Airtag. Please stop these ridiculous posts about losing Airtags! It's not like people are buying them put lay on the table at work, a cafe or on a park bench. 🙄
 
  • Like
Reactions: LinusR, Kilibee, KeithBN and 1 other person
szw-mapple fan said:
This won't apply to the vast vast majority of users. It's a security exercise that's just to prove it's possible. People who needs to be worried about this type of exploits won't be using any trackers of this type anyways.
Click to expand...
Unless you're a high profile target. Then you just need to get the high profile target's kid to scan the airtag, infect his phone with a 0-day drive by, and suddenly you have network access to this high profile targets' home network.

Or perhaps you scan one, and then your network gets infected. Now you're part of a botnet responsible for DDoS or spam or whatever.

The point is that this isn't okay.
 
  • Disagree
  • Like
Reactions: tomekwsrod and KeithBN
mpkayeuk said:
Anyone who then scans it can be compromised? How, exactly? Phishing generally requires a user to respond to a request that is verifiable as dubious. I don't see how this is any different to any other phishing attempt, except a million times harder for the bad actor to actually implement.
Click to expand...
It will add you to a list at a minimum.
Corsig said:
So there is no way for Apple to fix this?
Click to expand...
They would need to require, all code running on an AirTag to be cryptographically signed. That would require changes to the hardware, not just the software.
 
As I see it anything can be made malicious, given enough technology, time, or money. As I can imagine that one can hack a tile, or other tracking device. The problem is not that if you can or cannot do it, but if by doing it you turn anyone into a bad actor for the purpose of mischief.
 
So someone hacked something. I'm wondering what exactly.

So I attached my AirTag to my keys, lost them, put AirTag in lost mode. Nice guy with iPhone gets close to the AirTag, gets my keys, goes on Apple's website and probably finds out how to return my keys to me. Nasty guy with iPhone gets close to the AirTag, gets my keys, takes a hammer to smash up the AirTag, and throws my keys in the rubbish. Hacker with iPhone gets close to the AirTag and does exactly what? Takes my AirTag home, hacks it so it doesn't go to the Apple site, puts my AirTag and keys back where they came from, and the nice guy gets redirected to some website that can't do any harm to the nice guy's phone?

Or is the risk that the hacker buys four AirTags for $99.99, and four old rubbish guys, hacks the AirTags, drops AirTags + keys in the wild and waits... for what exactly? $99.99 for four shots of someone following a malicious link? Wow, if that is made public hackers will spend billions on AirTags to hack!
 
thejadedmonkey said:
Unless you're a high profile target. Then you just need to get the high profile target's kid to scan the airtag, infect his phone with a 0-day drive by, and suddenly you have network access to this high profile targets' home network.
Click to expand...
What 0-day drive by? And how would you access my home network? And why on earth would you use an AirTag in between? New risk: If you attach an AirTag to a hammer and lose both, a burglar could find both and use the hammer to break into some house!
 
  • Like
Reactions: LinusR
I just hope Apple release the AirTagAirPro soon—a device that attaches to AirTags so you can track and find them if/when you lose them.

/s
 
krewger said:
So…. It’s been hacked to be a customizable nfc tag. Looks like a lot of trouble to go through. I could also just put new nfc tags inside the AirTag’s case and accomplish the same thing. Security on your personal device is already in place - the link is displayed on the phone asking if you want to open it first before visiting the URL. https://electronics.howstuffworks.com/nfc-tag.htm
Click to expand...
As with most *proof of concept* exercises, they of themselves aren't what is interesting.
What follows, after being inspired by the *proof of concept* is usually where the real fun begins 😎
 
krewger said:
So…. It’s been hacked to be a customizable nfc tag. Looks like a lot of trouble to go through. I could also just put new nfc tags inside the AirTag’s case and accomplish the same thing. Security on your personal device is already in place - the link is displayed on the phone asking if you want to open it first before visiting the URL. https://electronics.howstuffworks.com/nfc-tag.htm
Click to expand...
I had the same reaction...maybe there are some practical applications...but NFC tags are so much cheaper. I wonder if you hid an NFC tag in an air tag if it would still work.
 
gnasher729 said:
What 0-day drive by?
Click to expand...
Theoretically someone could hack an AirTag to show up to others phones as "lost", but instead of pointing to the Apple URL that assists in locating the owner of the tag, the URL would be changed to a custom one.
If that custom URL happened to contain a zero day vulnerability, then in theory your phone itself just got compromised/hacked by scanning a modified AirTag.

So it's possible a bad AirTag could compromise your phone. Lots of things are theoretically or actually possible. However, it's highly improbable anyone would go through all that work on an attack on the general population. Mainly because it would be silly to burn a zero day iOS exploit that would no doubt be quickly patched as soon as it gets used and discovered in this way. But if you were a high value target for someone? Sure - I could see sophisticated actors using something like this as an additional vector to target someone.
 
  • Like
Reactions: thejadedmonkey
swm said:
just wanted to point out, that essentially you can just roll your own honeypot hw - it just needs to fit into something that _looks_ like an AirTag. no need for hacks.
and you can use less complicated ways to get your alternative URL to where it belongs.

either way, it's just like a 'malicious' QR code. maybe the only difference is that the built-in reader in camera app asks you for a confirmation before visiting the decoded URL.
Click to expand...
Actually this confirmation exists for the airtag as well, functionally this is a perfect comparison.
 
  • Like
Reactions: Kilibee and swm
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back