Researcher tricks Apple’s Find My into sharing location data with Linux
- ID
- 16153
- Status
- summarized
- Published
- 21 Aug 2026, 12:10 AM
- Fetched
- 21 Aug 2026, 1:51 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/20/researcher-tricks-apples-find-my-into-sharing-location-data-with-linux/5290496
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 3.5
- Created
- 21 Aug 2026, 1:55 AM
- Tags
- Audience
- developers
What happened
A 22-year-old researcher going by 'Zerotistic' enrolled a Linux machine into Apple's Find My network by reverse-engineering Apple's GrandSlam authentication and Identity Services (IDS) device certificate enrollment process. The key discovery was that Apple's legacy authenticateDS endpoint requires a PKCS#10 CSR with a 2048-bit RSA key signed using SHA-1, bundled in compressed XML. This allowed the Linux device to receive people-location data via Apple Push Notification service (APNs) that Apple normally reserves for its own hardware.
Why it matters
This is a clever protocol reverse-engineering write-up, not an exploit that tracks arbitrary users—it only retrieves location data already shared with the researcher's own Apple account. For builders, the practical takeaway is that Apple's device enrollment still relies on legacy endpoints with weak SHA-1 signatures, which is notable if you work with Apple ecosystem integrations or are assessing the security posture of Apple's identity services. Most developers and founders won't need to change anything based on this.
Discussion angle
The surprising detail here is Apple's continued reliance on SHA-1 signing for a legacy enrollment endpoint—worth discussing whether legacy protocol constraints in major platforms create quiet security debt that builders should watch for when integrating with vendor APIs.