The researcher managed to make Apple Find My work where the company does not officially provide for such an opportunity. A 22-year-old specialist under the pseudonym Zerotistic registered a computer with Linux in the Apple infrastructure as a compatible device, and then received and decrypted the current coordinates of a person who in advance allowed the owner of Apple Account to see his location. The whole experiment took less than a week, and the results of the researcher published on August 19.
Find My allows you to search for devices and things, including iPhone, iPad and AirTag, and share geopositions with friends and relatives. Full access to the partition with the location of people Apple provides through its own devices. The iCloud web version allows you to search for an account-linked technique, but does not give similar access to people’s geopositions.
Zerotistic decided to play the right part of Find My on Linux. The found method does not allow arbitrary monitoring of the owners of Apple devices. The Linux client receives the coordinates of only people who have already voluntarily shared a location with the owner of the corresponding account. The researcher did not find a way to add a new person, independently include the transfer of someone else's geoposition or bypass the permission of Find My.
The main problem was the verification of the device by Apple servers. To obtain location data, it is not enough to log in to Apple Account: servers must consider a computer a full member of Apple Identity Services, or IDS, an internal messaging system. Data between devices is transmitted through the Apple Push Notification service, abbreviated APNs.
Zerotistic first logged in through the GrandSlam protocol and obtained the data needed to work with IDS. The researcher then formed a request for the device certificate. After numerous unsuccessful attempts, it turned out that the Apple server accepts the request in PKCS#10 format with a 2048-bit RSA key and the signature SHA-1. The request had to be packed in XML and further compressed using gzip before sending to an outdated authenticateDS access point. After processing the request, Apple issued an IDS certificate and linked the Linux client to the account. Zerotistic detailed the registration procedure and the server’s unusual requirements for the certificate.
The certificate alone was not enough. To register with Find My Linux, the client needed to declare support for six internal services, transmit information about supported encryption mechanisms and register keys for secure messaging between devices. The request was also signed by IDS and APNs certificates. After successful registration, Apple servers began to perceive the Linux system as a device capable of receiving Find My messages.
The next problem arose with the already existing exchange of geoposition. Apple's new device after setting up usually receives the keys needed to view the location of the contacts, however, the homemade Linux client did not automatically receive the keys. Zerotistic discovered the internal request of SubscribeAndFetch with the team distributedKeys. After sending the request, the friend's device transferred the current key to the Linux client through APNs and IDS. It was not necessary to re-include the transmission of the geoposition or to re-issue permission.
After receiving the key, the researcher was able to contact the SearchParty service, through which Find My returns encrypted location reports. The Linux script unpacked Apple messages, checked the sender, extracted the key and locally decrypted the coordinates. As a result, the computer received geographical coordinates, the time of their determination and information about accuracy. Subsequent updates could be downloaded without retransferring the key via IDS.
Researchers have previously forced the closed network Find My to perform tasks that Apple did not officially provide. In 2021, specialist Fabian Brownlein revealed that infrastructure could be used for hidden data transmission through nearby Apple devices. For the experiment, the microcontroller ESP32 and OpenHaystack were used.
The OpenHaystack project itself allows you to create third-party Bluetooth beacons that use the Find My infrastructure to determine the location. SecurityLab has previously disassembled OpenHaystack’s capabilities and Find My architecture-related security concerns. Apple later officially opened the Locator network for third-party devices, but manufacturers should participate in the Find My Network accessory program.
In 2025, the researchers went even further and presented an attack by nRootTag, allowing you to turn a conventional Bluetooth device into a tracked object of the Find My network. The authors tested the method on nine Android smartphones, two Windows computers and 12 Linux distributions. nRootTag uses another mechanism and does not give Linux full access to the partition with people's geoposition.
The work of Zerotistic differs from previous experiments by access to Find My People. The researcher did not create another analogue of AirTag, but reproduced the chain of internal protocols Apple, registered Linux as a trusted client, received the key of the already permitted exchange of geoposition and decrypted the coordinates. The experiment shows that part of Find My limitations for third-party operating systems is due to the software architecture and client verification, rather than the inability to technically process data on Linux.
Find My allows you to search for devices and things, including iPhone, iPad and AirTag, and share geopositions with friends and relatives. Full access to the partition with the location of people Apple provides through its own devices. The iCloud web version allows you to search for an account-linked technique, but does not give similar access to people’s geopositions.
Zerotistic decided to play the right part of Find My on Linux. The found method does not allow arbitrary monitoring of the owners of Apple devices. The Linux client receives the coordinates of only people who have already voluntarily shared a location with the owner of the corresponding account. The researcher did not find a way to add a new person, independently include the transfer of someone else's geoposition or bypass the permission of Find My.
The main problem was the verification of the device by Apple servers. To obtain location data, it is not enough to log in to Apple Account: servers must consider a computer a full member of Apple Identity Services, or IDS, an internal messaging system. Data between devices is transmitted through the Apple Push Notification service, abbreviated APNs.
Zerotistic first logged in through the GrandSlam protocol and obtained the data needed to work with IDS. The researcher then formed a request for the device certificate. After numerous unsuccessful attempts, it turned out that the Apple server accepts the request in PKCS#10 format with a 2048-bit RSA key and the signature SHA-1. The request had to be packed in XML and further compressed using gzip before sending to an outdated authenticateDS access point. After processing the request, Apple issued an IDS certificate and linked the Linux client to the account. Zerotistic detailed the registration procedure and the server’s unusual requirements for the certificate.
The certificate alone was not enough. To register with Find My Linux, the client needed to declare support for six internal services, transmit information about supported encryption mechanisms and register keys for secure messaging between devices. The request was also signed by IDS and APNs certificates. After successful registration, Apple servers began to perceive the Linux system as a device capable of receiving Find My messages.
The next problem arose with the already existing exchange of geoposition. Apple's new device after setting up usually receives the keys needed to view the location of the contacts, however, the homemade Linux client did not automatically receive the keys. Zerotistic discovered the internal request of SubscribeAndFetch with the team distributedKeys. After sending the request, the friend's device transferred the current key to the Linux client through APNs and IDS. It was not necessary to re-include the transmission of the geoposition or to re-issue permission.
After receiving the key, the researcher was able to contact the SearchParty service, through which Find My returns encrypted location reports. The Linux script unpacked Apple messages, checked the sender, extracted the key and locally decrypted the coordinates. As a result, the computer received geographical coordinates, the time of their determination and information about accuracy. Subsequent updates could be downloaded without retransferring the key via IDS.
Researchers have previously forced the closed network Find My to perform tasks that Apple did not officially provide. In 2021, specialist Fabian Brownlein revealed that infrastructure could be used for hidden data transmission through nearby Apple devices. For the experiment, the microcontroller ESP32 and OpenHaystack were used.
The OpenHaystack project itself allows you to create third-party Bluetooth beacons that use the Find My infrastructure to determine the location. SecurityLab has previously disassembled OpenHaystack’s capabilities and Find My architecture-related security concerns. Apple later officially opened the Locator network for third-party devices, but manufacturers should participate in the Find My Network accessory program.
In 2025, the researchers went even further and presented an attack by nRootTag, allowing you to turn a conventional Bluetooth device into a tracked object of the Find My network. The authors tested the method on nine Android smartphones, two Windows computers and 12 Linux distributions. nRootTag uses another mechanism and does not give Linux full access to the partition with people's geoposition.
The work of Zerotistic differs from previous experiments by access to Find My People. The researcher did not create another analogue of AirTag, but reproduced the chain of internal protocols Apple, registered Linux as a trusted client, received the key of the already permitted exchange of geoposition and decrypted the coordinates. The experiment shows that part of Find My limitations for third-party operating systems is due to the software architecture and client verification, rather than the inability to technically process data on Linux.
