Researcher tricks Apple’s Find My into sharing location data with Linux
A 22-year-old security researcher known as "Zerotistic" has found a way to enrol a Linux machine into Apple's Find My network, allowing it to receive live people-tracking location data that Apple normally restricts to its own devices. This matters because Find My's people-sharing feature, unlike its device-tracking counterpart, has always been walled off from non-Apple hardware, and the technique shows that Apple's device-trust checks can be circumvented with careful protocol reverse-engineering rather than any flaw allowing arbitrary users to be tracked without consent.
The method involved obtaining an identity delegate through Apple's GrandSlam authentication, then crafting a custom certificate signing request in the PKCS#10 format with a 2048-bit RSA key signed using SHA-1, packaged as compressed XML and submitted to Apple's legacy authenticateDS enrolment endpoint. Once Apple issued the identity certificate, the researcher had to register for six subservices, declare supported encryption and messaging keys, and sign the request with both the identity and push-notification certificates, ultimately establishing a persistent binary TLS connection to Apple's private push servers capable of receiving location data already shared by consenting contacts.
- Researcher got a Linux device accepted onto Apple's Find My network.
- It only accesses locations people already chose to share, not arbitrary tracking.
- Required reverse-engineering Apple's certificate and push-notification enrolment process.
New here? Start with this
Apple’s Find My is a service for locating Apple devices and sharing a person’s location with chosen contacts. The people-sharing feature has been limited to Apple hardware, while the separate device-tracking feature helps users find lost devices.
The service checks the identity and credentials of devices that connect to it. Security researchers study how these systems work by examining their communications and testing whether those checks can be bypassed.
The distinction matters because people’s location data is sensitive. Access to a contact’s location depends on that person having chosen to share it; connecting a different kind of device does not, by itself, grant access to people who have not shared their location.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
This discovery exposes a meaningful flaw in Apple's Find My security model. Users share location data with the deliberate expectation that only Apple-authenticated devices can access it; by reverse-engineering Apple's protocols and spoofing device authentication, the researcher demonstrated that this trust boundary is circumventable. Whilst the researcher acted responsibly, the same technique could allow bad actors to intercept location data shared in confidence, breaking the user's intended privacy model and violating the security guarantees they rely upon when choosing whom to share their location with.
The case against
This finding, whilst technically clever, does not represent a serious security vulnerability. The researcher required legitimate Apple credentials and could only access location data that people had already deliberately chosen to share with someone. The attack requires sophisticated protocol knowledge and cannot passively intercept data or harm unwilling targets. Apple can readily patch the legacy authentication endpoint to prevent this specific vector. This exemplifies responsible security research: discovering protocol limitations before malicious actors do, allowing Apple to maintain strong privacy guarantees through targeted fixes rather than architectural overhauls.