A 22-year-old security researcher known as "Zerotistic" has found a way to enrol a Linux machine into Apple's Find My network, allowing it to receive live people-tracking location data that Apple normally restricts to its own devices. This matters because Find My's people-sharing feature, unlike its device-tracking counterpart, has always been walled off from non-Apple hardware, and the technique shows that Apple's device-trust checks can be circumvented with careful protocol reverse-engineering rather than any flaw allowing arbitrary users to be tracked without consent.

The method involved obtaining an identity delegate through Apple's GrandSlam authentication, then crafting a custom certificate signing request in the PKCS#10 format with a 2048-bit RSA key signed using SHA-1, packaged as compressed XML and submitted to Apple's legacy authenticateDS enrolment endpoint. Once Apple issued the identity certificate, the researcher had to register for six subservices, declare supported encryption and messaging keys, and sign the request with both the identity and push-notification certificates, ultimately establishing a persistent binary TLS connection to Apple's private push servers capable of receiving location data already shared by consenting contacts.