Tracking on non-Macs

[raymondjxu]

Problem
The problem: it's limiting to not be able to track things on non-Mac computers.

Solution
Reverse-engineer either the local Find My API or the Find My web app and allow for tracking on non-Macs

Alternatives

• Host a macOS server to track stuff. If not self hosted it allows whoever hosts it to access private information. I believe this was discussed earlier
• Upload the keys to Apple somehow and use the web Find My App to do this. May require temporarily disabling SIP, or possibly it's possible to use the Mail-app entitlement route to upload it.

Additional context
I understand that this is an long term goal and that either way it's easier said then done. It may be worthwhile to try seeing how auth is done for the Find My web app and then MITM'ing the connection to see how it requests the location.

[schmittner]

The web API (icloud.com) won't show your offline devices as far as I know. Because that would mean that Apple had access to the private advertisement keys to decrypt the location – which they claim they don't.

[raymondjxu]

The web API (icloud.com) won't show your offline devices as far as I know. Because that would mean that Apple had access to the private advertisement keys to decrypt the location – which they claim they don't.

@schmittner Well, I guess we have to reverse engineer the local Find My app then. My guess is that it uses HTTP(S) like location services but it wouldn't be too farfetched for it to use a proprietary protocol.

[hhf42]

I assume you are aware of https://github.com/picklepete/pyicloud ? This is a python framework to access Apple device location. The issue is that it does not yet support "objects" like AirTags. For this to be implemented, the iCloud API endpoint would need to be known, which does not seem to be the case.

I assumed I could find the API endpoint by using a man-in-the-middle-proxy (mitmproxy) with my iPhone, but of course Apple is using certificate pinning and the Find My app simply refused to work through the proxy. Other apps and websites worked.

So we'll probably have to wait until someone with a jailbroken iPhone and https://frida.re finds the time to dig this up.

[raymondjxu]

Was not aware of that Python framework, thanks.

So we'll probably have to wait until someone with a jailbroken iPhone and https://frida.re finds the time to dig this up.

@hhf42 Is there any particular reason we have to use a jailbroken iPhone and not a Mac?

[hhf42]

Oh, right. Of course you could also do this with a Mac and it might even be easier. Maybe as easy as running strings against the Find My app?

Apple has not yet implemented Find My for objects in the iCloud.com website, once that is available, that may also be an option.

[raymondjxu]

Oh, right. Of course you could also do this with a Mac and it might even be easier. Maybe as easy as running strings against the Find My app?

Sorry, my RE knowledge is pretty lackluster, so I have no idea how to do that. Could you explain further?

Apple has not yet implemented Find My for objects in the iCloud.com website, once that is available, that may also be an option.

Apparently this is impossible for reasons explained above.

[Sn0wfreezeDev]

Hi,
thank your for the recommendations.
@hhf42 we actually tried using exactly this framework to access the location reports. So we can guarantee that at the moment it won't be easily possible.

@AwesomestCode you don't need to reverse find my. We already did that and all work you can find here is largely based on the reverse engineering we did. All the necessary http requests are implemented in OpenHaystack.

It has already been discussed if we can port this to windows. And the answer here is maybe. Windows has an iCloud app that can be downloaded and that is able to produce similar access tokens as the Mac.
You can refer to our paper to see what access tokens are necessary to download location reports: https://arxiv.org/abs/2103.02282

We need:

1. Apple Anisette Data

2. A search party token, which is stored in the Keychain.

3. Is highly obfuscated code by Apple and we have not been able to reverse engineer it. But generally it produces tokens that are used to access iCloud services that are protected by 2FA. Those tokens are generated on Windows as well and AltStore already accesses them. https://github.com/rileytestut/AltStore

4. I don't know if this is actually available on Windows

[Sn0wfreezeDev]

So the actually best option to port this to the web or any other system is to have one macOS server running in the background that downloads location reports and forwards them. This is basically not a big security issue (for now), because all the reports are protected by end-to-end encryption.

And I have already implemented a very simple Mac server that actually does just this. I just don't want to host it somewhere publicly.

It's available on my private fork:
https://github.com/Sn0wfreezeDev/openhaystack

[raymondjxu]

Windows has an iCloud app that can be downloaded and that is able to produce similar access tokens as the Mac.

Was hoping for Linux support, not Windows. This way, it'll be easy to self-host finding/forwarding servers. While I have a Mac, I don't want to use it as a server that's on 24/7. I do sort of hope that it's possible to install OpenHaystack's finder app on all devices eventually.

Another, albeit silly-sounding option: could we possibly run the Windows iCloud app in a sandbox just for token generation? This sounds inefficient and silly, but it could be a viable path forward.

[hhf42]

@Sn0wfreezeDev

we actually tried using exactly this framework to access the location reports. So we can guarantee that at the moment it won't be easily possible.

Thanks for the answer, can you elaborate further? The pyicloud framework works for devices, so should it not work for objects once the API endpoint is known? Or do you know it already and there are other issues?

[schmittner]

@hhf42 the "old" Find My (to find iPhones, Macs) and the "new" Find My (for finding offline devices via Bluetooth incl AirTags) use two completely different protocols. The Find My app integrates them both.

The "old" one works via iCloud. The "new" one does not work via iCloud by design, so this will not come as a future update (read our paper to understand why this is the case, essentially this provides stronger privacy for the user).

[hhf42]

Oh, I am reading the linked paper and I get it:

the owner device fetches location reports from Apple’s servers by sending a list of the most recent public advertisement keys of the lost device.

So the python framework would have to have access to those keys, they will not be in iCloud. So this would not work on a Linux or Windows device. Maybe on a Mac if the python framework could have access to keychain, but maybe only if jailbroken or with frida instrumentation.

This is disappointing :- ) I was very much looking forward to nice tracking beyond automated screenshots of Find My app.

[raymondjxu]

@schmittner @Sn0wfreezeDev
Just thought of something: if the keys are never uploaded to iCloud, how do other devices track them? For example, if I add an AirTag on my iPhone, I can still track it on my Mac... this seems to imply that the keys are uploaded to a server somewhere.

[Sn0wfreezeDev]

The keys that are needed for fetching location data are uploaded to iCloud (Drive).