Researcher tricks Apple’s Find My into sharing location data with Linux

Jump to main content

Search

REG AD

Security

Researcher tricks Apple’s Find My into sharing location data with Linux

Clever protocol wrangling gets iBiz-only people tracking working on a non-iGadget

Connor Jones

Connor<br>Jones

Cybersecurity reporter

Published<br>thu 20 Aug 2026 // 17:10 UTC

A young security researcher figured out a way to enroll a Linux device into Apple’s Find My network and read live location data from it.<br>Find My is Apple’s app for, you guessed it, finding things – whether AirTags, iPads, or other supported devices and items. It also works for people. Families can track each other's whereabouts for safety reasons, and friends can tell when others are hanging out without them.<br>In typical Apple fashion, though, the full Find My experience is limited to Apple hardware, like an iPhone or Mac. iBiz also offers Find Devices via the iCloud website, although it lacks Find My’s people-tracking feature for viewing locations others have shared with you.

REG AD

However, the 22-year-old researcher, who goes by “Zerotistic,” devised a way to enroll a Linux-based machine into the iNetwork, tricking Apple into sending the people-location data it exclusively reserves for Apple devices.

REG AD

It’s important to note, at this point, that this is not an exploit that allows anyone to arbitrarily retrieve any Apple user's location. It refers to registering a non-Apple device to the Find My network and retrieving the location data of people who had already chosen to share their locations with the Apple account owner.<br>Retrieving people-location data requires Apple to trust that the machine you’re using belongs to its network and is capable of receiving the data, which is sent over Apple’s Push Notification service (APNs).<br>The first step was tying the Linux machine to the researcher’s Apple account. Zerotistic obtained an identity delegate by going through Apple’s standard GrandSlam authentication protocol. In pursuit of an Apple Identity Services (IDS) device certificate, which links the intended device to an Apple Account, they then used that delegate to build a custom certificate signing request (CSR).<br>Lots of trial and error later, Zerotistic discovered that the CSR had to use the PKCS#10 format and a 2048-bit RSA key signed using SHA-1, linking the Linux machine to their Apple account. They bundled this up into a compressed XML file and sent it to Apple’s authenticateDS profile-enrollment endpoint.<br>The SHA-1 signature requirement and XML encoding were surprises. The researcher’s “best guess” is that the CSR had to conform to older standards because authenticateDS is a legacy endpoint.<br>Apple signed the CSR, handing the Linux device the IDS certificate needed to register its public key to the researcher’s Apple account.<br>The Linux device was registered at this point, but further work was needed to convince Apple that it was capable of running Find My.

MORE CONTEXT

Rather than add a backdoor, Apple decides to kill iCloud encryption for UK peeps

Apple's Find My network can be abused to leak secrets to the outside world via passing devices

Apple tweaks AirTags to be less useful for stalkers, thieves

North Korean spies turn Google's Find Hub into remote-wipe weapon

Zerotistic found that a Find My registration request required the device to subscribe to six different subservices, define the types of encryption it supported, and provide the public keys to support Apple’s device-to-device messaging format. It also had to be signed using an IDS certificate and an APNs certificate obtained during initial network setup.

REG AD

At this point, the researcher had enrolled the Linux machine in an Apple account and convinced Find My that it was capable of receiving location data via a persistent binary TLS connection to Apple’s private APNs servers.<br>However, this registration did not automatically retrieve the location data of people who had previously shared their locations with Zerotistic, as a box-fresh Apple device would after setup.<br>Issuing a SubscribeAndFetch request fixed this, prompting the device of the researcher’s friend to push an encrypted location key to the newly registered Linux device.<br>The final challenge was reading the location data the Linux device fetched from Apple’s SearchParty service. Zerotistic was not simply using the GUI Find My app on Linux; they were receiving the encrypted data and had to figure out how to unpack the location message.<br>This required a Linux script to unwrap Apple’s messaging envelope, extract the shared location key, and decrypt the Find My location data, which is comprised of coordinates, timestamps, and accuracy information.<br>Once developed, the script could fetch and decode subsequent location reports for the existing location share.<br>It took the researcher less than a week of tinkering to develop the Find My-busting technique, they said.<br>The Register asked Apple if it was aware of the...