Since the release of Apple’s Bluetooth-based tracking gadget AirTag, there have been several complaints of the device being used for stalking and other criminal acts all over the world. As a result of these instances, the firm began taking the required steps to prevent similar problems by providing users with important safety recommendations and introducing privacy protections to AirTags. However, a security researcher has made an AirTag clone that can get around almost all of theanti-stalking features that are supposed to protect people’s privacy.
AirTag Clone Bypasses Apple’s Anti- anti-stalking features
While Apple’s AirTag is a useful tool for tracking and locating misplaced objects such as wallets, keys, and luggage, it has also been used to monitor people without their knowledge. In response to these concerns, Apple has added additional privacy measures to its devices in order to prevent such behavior. In reality, a few of those capabilities were included in the company’s latest iOS 15.4 beta 4 update.
An anti-stalking function included in Apple’s iOS software can be bypassed by an expert in Berlin, Germany, who has devised and built an AirTag-clone. The clones do not have an AirTag serial number and are not linked to an Apple ID like the originals. If you’ve ever wondered how you could follow an iPhone user without their awareness for five days, security researcher Fabian Bräulein has the answer for you in a blog post.
Bräulein built the system on OpenHaystack, a specific framework for tracking Bluetooth devices using the Find My network (source code via GitHub). The AirTag clone was then built using an ESP32 microcontroller with Bluetooth connectivity, a battery bank, and a cable.
How does it work?
In the blog post, Bräulein outlined how each of Apple’s anti-stalking capabilities might theoretically be overcome in the blog post. For example, if an AirTag is separated from its owner for three days, it emits a beeping sound to alert anyone around it. Although Apple has reduced the delay from three days to eight to twenty-four hours, the AirTag clone avoids it because it lacks a working speaker. Various such clones have been discovered on eBay, according to the report.
Other functionalities, such as tracking alerts and notifications to a prospective stalking victim, were disabled by employing more than 2,000 pre-loaded public keys, with the AirTag clone broadcasting one every 30 seconds. The victims could not use the Precision Finding feature of the Find My app to find the device because it did not have a UWB chip.
Using the AirTag clone and a special macOS program that was built for the experiment, Bräulein was able to effectively track and locate an iPhone user and an iPhone-bearing roommate for five days without them receiving any tracking alerts on their devices. AirTag’s clone was found out after tests. The Apple Android Tracker Detect app could not find the fake.
Bräulein clarifies that the goal of this initiative is not to encourage AirTag-based stalking. Instead, the lengthy blog post and AirTag clone are meant to demonstrate that, even with Apple’s privacy safeguards in place, users with the correct knowledge may find simple ways to get around them and create customized AirTags to continue stalking. When Apple adds anti-stalking features to AirTags in the future, it should think about these problems.
Meanwhile, if you’re concerned about being monitored with an AirTag, you can find additional information in the official AirTags Safety Guide. If you ever uncover an unknown AirTag in your wallet, car, or handbag, be sure to read our advice on how to disable an AirTag that has been discovered moving with you. Remember to let us know what you think about this amazing discovery in the comments section below!
