Researchers at George Mason University have discovered a critical exploit in Apple’s Find My network that allows hackers to track any Bluetooth device without the owner’s knowledge. The exploit raises serious privacy and security concerns for millions of Apple users.
How the Exploit Works
Apple’s Find My network uses Bluetooth signals from devices like AirTag to track their location via nearby Apple devices. The system encrypts the Bluetooth address with a cryptographic key to protect privacy.
However, researchers found a way to crack this encryption using hundreds of GPUs to generate possible keys quickly.
This exploit, named “nRootTag,” enables hackers to:
- Convert any Bluetooth device into a hidden tracker.
- Track devices with up to 90% accuracy.
- Pinpoint locations with an accuracy of 10 feet.
- Trace movements of devices like phones, laptops, and game consoles.
Real-Life Tests
The researchers demonstrated the exploit by tracking:
- A bicycle moving through a city.
- A computer’s location with high precision.
- A person’s flight path via their game console.
Apple’s Response
Apple was notified about the vulnerability in July 2024 but has not yet fixed the issue. The company acknowledged the researchers’ contribution but hasn’t provided a timeline for a permanent solution.
How to Stay Safe
Until Apple patches the exploit, users are advised to:
- Limit Bluetooth access for apps.
- Regularly update their devices.
- Avoid pairing Bluetooth devices with untrusted apps.
This exploit highlights the potential risks of always-on Bluetooth tracking systems, even from trusted brands like Apple.
