Full Report
Clever protocol wrangling gets iBiz-only people tracking working on a non-iGadget
Analysis Summary
# Tool/Technique: Find My People (Linux Enrollment)
## Overview
This technique involves "protocol wrangling" to enroll a non-Apple (Linux) device into Apple’s proprietary Find My network. By mimicking the registration and authentication protocols of Apple hardware, a researcher was able to trick Apple’s servers into delivering real-time, encrypted location data of contacts (who have already consented to sharing their location) to a Linux machine.
## Technical Details
- **Type**: Technique / Protocol Manipulation
- **Platform**: Linux (targeting Apple’s Find My ecosystem/Cloud services)
- **Capabilities**: Device enrollment, identity impersonation, retrieval and decryption of shared location data.
- **First Seen**: August 20, 2026 (Published date)
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1528 - Steal Application Access Token]: Utilizing the GrandSlam authentication protocol to obtain identity delegates.
- **[TA0007 - Discovery]**
- [T1041 - Exfiltration Over C2 Channel]: While used for legitimate tracking, the method bypasses platform restrictions to pull sensitive location data.
- **[TA0005 - Defense Evasion]**
- [T1036 - Masquerading]: The Linux device masquerades as a trusted Apple device by providing valid IDS certificates and subscribing to specific subservices.
## Functionality
### Core Capabilities
- **GrandSlam Authentication**: Leverages Apple’s standard authentication protocol to obtain an identity delegate.
- **Identity Services (IDS) Enrollment**: Generates a custom PKCS#10 Certificate Signing Request (CSR) using 2048-bit RSA keys and SHA-1 signatures to obtain a device certificate.
- **APNs Integration**: Establishes a persistent binary TLS connection to Apple’s private Push Notification service (APNs) servers.
- **Service Subscription**: Mimics an Apple device by subscribing to six mandatory subservices and defining supported encryption types.
### Advanced Features
- **Legacy Endpoint Exploitation**: Utilizes the `authenticateDS` endpoint, which accepts older SHA-1 and XML-encoded configurations.
- **Location Decryption**: Employs a custom script to unwrap Apple’s messaging envelope, extract shared location keys, and decrypt coordinates, timestamps, and accuracy data from the SearchParty service.
- **Automated Fetching**: Uses `SubscribeAndFetch` requests to force peer devices to push encrypted location updates to the unauthorized Linux client.
## Indicators of Compromise
- **File Names**: Custom Linux scripts for unwrapping Apple messaging envelopes.
- **Network Indicators**:
- Connections to `authenticateDS` profile-enrollment endpoints.
- Persistent binary TLS connections to Apple APNs servers from non-Apple OS User Agents.
- **Behavioral Indicators**:
- Unexpected Certificate Signing Requests (CSR) using SHA-1 and 2048-bit RSA coming from non-Mac hardware.
- Subscription to Apple-specific subservices (SearchParty, IDS) by unauthorized device IDs.
## Associated Threat Actors
- **Zerotistic** (Security Researcher)
## Detection Methods
- **Signature-based detection**: Monitor for the specific XML structure and legacy SHA-1 signatures used in the `authenticateDS` enrollment process.
- **Behavioral detection**: Identify non-Apple operating systems attempting to establish persistent TLS connections to private APNs endpoints.
- **Anomalous Enrollment**: Flag Apple accounts that register "new" devices that do not provide standard hardware identifiers or serial numbers associated with legitimate Apple production runs.
## Mitigation Strategies
- **Prevention measures**: Apple could deprecate the legacy `authenticateDS` endpoint or enforce modern signature requirements (SHA-256+) and stricter hardware attestation.
- **Hardening recommendations**: Implement stricter device integrity checks (e.g., DeviceCheck or App Attest) before allowing a device to subscribe to the SearchParty service.
## Related Tools/Techniques
- **OpenHaystack**: A framework for tracking personal Bluetooth tags via the Find My network.
- **Bypassing Ecosystem Walls**: Techniques used to run iMessage or other "iBiz-only" services on Android or Windows.