Who Tracks the Trackers?: Circumventing Apple's Anti-Tracking Alerts in the Find My Network

Abstract

Apple's Find My protocol allows lost devices, such as AirTags, to relay their location to their owners via a network of over a billion active Apple devices. This convenient feature for device owners may also be a tool for malicious actors to cheaply and effectively track unknowing targets. Apple has introduced a featured known as "item safety alerts'' to prevent AirTags from being used this way. We demonstrate that it is possible to create a custom device, with similar features to an AirTag in terms of cost, size, and battery life, which can participate in and be tracked by Apple's Find My network while not triggering any item safety alerts. This implies that Apple's protection mechanism is insufficient. We suggest natural mitigations for two of our malicious tracker techniques but note that the third would require substantially altering the Find My protocol to defend against.