Researcher details an exploit for Apple's Find My network that allows packets of arbitrary data to be transmitted by simulating a Find My broadcast
The Find My network is used by Apple to report locations of items and devices via the data connection of any nearby iPhone, Mac, or other Apple device.
Context & Ripple Effects
Apple positioned Find My as a privacy-preserving crowdsourced location system, publishing the cryptographic design intended to prevent Apple from tracking devices. Its subsequent accessory program and draft specification extended that network beyond Apple’s own hardware.
The reported technique shifts attention from location privacy to protocol abuse: a broadcast mechanism used by nearby Apple devices can be impersonated to carry data. It belongs alongside the recent AirDrop contact-discovery disclosure, another case in which proximity features created an unintended data-exposure surface.
First-order effects
- Apple’s Find My protocol has a newly demonstrated abuse path, requiring the company to assess how participating iPhone and Mac devices recognize and relay valid broadcasts.
- Security researchers and defenders gain a concrete test case for detecting simulated Find My broadcasts used to transmit non-location data.
Second-order effects
- Third-party device makers in Apple’s Find My accessory program must treat compliance with the network specification as a security boundary, not only an interoperability requirement.
- The disclosure increases scrutiny of Apple’s nearby-device services as a group, following the AirDrop finding that sharing prompts could reveal contact identifiers to nearby devices.
Third-order effects
- Privacy-preserving crowdsourced networks are becoming a broader protocol-security problem: encryption that limits tracking does not by itself prevent misuse of the broadcast channel.
- If similar findings accumulate across Find My and AirDrop, Apple’s proximity services will need stronger validation and abuse controls at the network edge rather than relying chiefly on privacy-oriented cryptography.
The trend: Apple’s expanding mesh of privacy-focused proximity services is exposing the need to secure not just user data, but the broadcast protocols that carry it.