A German security researcher claims he was able to break into the microcontroller of Apple's AirTag, allowing him to modify its NFC URL
The Apple AirTag has been released almost ten days ago. Since then, we have seen a user rebuilding an AirTag as a thinner card that fits into wallets …
9to5MacJosé Adorno
Context & Ripple Effects
AirTag arrived with a notably compact physical design, as an early teardown of its speaker-driven body showed. The reported microcontroller access adds a separate question: whether the tag’s NFC behavior can be trusted after physical tampering.
Later coverage tied AirTag’s Lost Mode flow to a phishing vulnerability, while researchers proposed privacy-preserving anti-stalking protections after Apple changed identifier rotation. Together, those developments make the NFC URL modification an early signal that tracker safety depends on both hardware integrity and the services users reach through a tag.
First-order effects
Anyone scanning a tampered AirTag can be sent to an NFC destination selected by the person who altered the tag, rather than the destination Apple intended.
Apple must treat the AirTag’s NFC path and microcontroller protections as part of the product’s security boundary, not merely a physical-device concern.
Second-order effects
The later Lost Mode phishing disclosure shows how a modified or misleading NFC handoff can turn a tracker-recovery interaction into a social-engineering risk for AirTag finders.
Apple’s anti-stalking updates and the proposed privacy-preserving AirTag security protocol face a broader design constraint: protections must cover physical modification as well as wireless tracking behavior.
Third-order effects
Item trackers are becoming a security category in which location privacy, device tamper resistance, and user-facing recovery links must be designed together.
If researchers continue finding flaws across those layers, tracker vendors will face pressure to make post-tampering behavior more visible or less able to redirect users.
The trend: Bluetooth trackers are evolving from simple location accessories into connected safety systems whose risks span hardware, identity, and recovery workflows.
Yesss!!! After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag! 🥳🥳🥳 /cc @colinoflynn @LennertWo https://twitter.com/...
AirTags firmware popped, just an arm cortex m4 with an accelerometer and speaker. Looks like via Uart with a bump & dump. nice job! https://twitter.com/...
@colinoflynn @cybergibbons @EchoRior @ghidraninja The more interesting attack vectors come when air tags start being attached to people. With a cloned tag you can fabricate locations, say to put people in restricted areas when they weren't etc.
Thanks to @colinoflynn for the test point mapping (and nerdsniping me with the AirTags in the first place), and also for listening to my rambling/cursing/etc :)
@cybergibbons @EchoRior @ghidraninja Even if you need physical access, you might have interesting use cases like you can compromise an easily accessible device (AirTag attached to a bicycle say), which the users iPhone trusts and perhaps there is some pivot point there due to tru…
Hack requires physical access. There is no immediate danger to AirTag owners, but the researcher's findings from here will help everyone understand how the device works and hopefully make it more secure in the future https://twitter.com/...
Good job from @ghidraninja and @colinoflynn that confirms the impact of #nrf52 exploit presented last year. Nordic refused cooperation one year ago, that's life... https://twitter.com/... https://twitter.com/...
Just to add some context to this - @ghidraninja has managed to gain SWD access to the nRF52832 system-on-chip on the AirTags. This has internal flash that stores the firmware of the device. @colinoflynn had already pulled the external SPI flash chip contents. https://twitter.com/…