On Monday at the WWDC conference, Apple . Unlike the standard , which relies on cellular infrastructure and GPS of the lost device, the “Find Me” feature can locate even devices without without a SIM card and GPS. For example, laptops, or even , attached to any item (Apple hinted at this only in broad terms).
The idea is to turn the entire existing network of iPhones into a massive crowdsourced system for tracking nearby objects. Each active iPhone will constantly track the BLE beacon messages coming from other devices. When it finds one of these signals, it marks the package with its GPS coordinates and sends it to Apple’s servers. This is great for forgetful people like me, who constantly lose things: if I leave my backpack on a tourist bus in China, sooner or later someone will stumble upon its signal — and I will instantly know where to find it.
(It’s worth noting that the idea wasn’t invented by Apple. In fact, companies like have been doing this for quite a while. And yes, they should be worried about their business).
If the above description didn’t impress you, let me raise a question you should ask: how will this system protect against mass privacy violations?
Let's list potential issues:
- If a device constantly emits a BLE signal that uniquely identifies it, everyone has (yet another) way to track you. Marketers are already using WiFi and Bluetooth MAC addresses for this, and the Find My feature creates yet another tracking channel.
- It also exposes those who participate in the process. Now these individuals will send their current location to Apple (they may already be doing this). But now they’ll have to share this information also with strangers who are “losing” their devices. This could end badly.
- Fraudsters can also launch active attacks that spoof your device's location. While this seems unlikely, people always manage to surprise.
The good news is that Apple claims the system really provides reliable privacy thanks to the skillful application of cryptography. But, as usual, they declined to disclose implementation details. Andy Greenberg in Wired shared a partial from Apple's perspective, which allows us to understand a lot. Unfortunately, this account still leaves huge gaps. It's those gaps I intend to fill by offering the most likely description of what Apple is actually doing.
A big caveat: much of this may turn out to be completely wrong. I will certainly update the article when Apple reveals more.
Some key issues
To outline the scenario, we need to introduce a few devices. For inspiration, let's take the 1950s television series "Lassie".
The first device we'll call Timmy, who is "lost". He has a BLE transmitter but no GPS or internet connection. Fortunately, he has already paired with a second device named Timmy Ruth , who wants to find him. Our main character isLassie : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below:(Since
they must be paired in advance, it's likely they both belong to the same person. Did I mention that you'll need to buy Timmy and , who wants to find him. Our main character is Apple devices for the system to work? This suits Apple just fine). two We're looking at a security system, so the first question is:
who is the bad guy ? A potential attacker can be anyone? В этой ситуации ответ неприятный: . That's why the issue is so interesting.Keeping Timmy's anonymity
The most important aspect of the system is that it must not allow outsiders to track
, especially when he is not lost. This rules out some fairly obvious solutions, like when the device Timmyjust screams, Timmy "Hello, my name is Timmy, please call my mom Ruth and let her know I'm lost" . This also rules out practically any unchanged static identifier, even opaque and seemingly random.This also excludes virtually any unchanged static identifier, even if it is opaque and appears random.
The latest requirement is based on the unfortunate experiences of services that abuse static identifiers (for example, ) to track device movements. Apple by randomizing identifiers like MAC addresses. If Apple adds a static tracking identifier for 'Find My', all issues will only worsen.
This requirement means that any messages transmitted Timmy, must be opaque. Moreover, the content of these messages should relatively often change to new values that cannot be linked to the old ones. One obvious way for a paired device to recognize such messages is to have Timmy and , who wants to find him. Our main character is agree on a long list of random '' for Timmy, and let Timmy pick a different one each time.
This really helps. Each time : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: sees some (unknown) device transmitting an identifier, it will not know if it belongs to Timmy: but it can send it to Apple’s servers along with its own GPS location. In case Timmy gets lost, , who wants to find him. Our main character is can ask Apple to find all possible pseudonyms. TimmyIn this situation, no one outside of Apple will know this list, and even Apple will only learn it after someone gets lost, so this approach prevents most tracking options.
A somewhat more effective way to implement this idea is to use a cryptographic function (such as MAC or a hash function) to generate a list of pseudonyms from a single short 'seed', a copy of which is stored by Timmy and , who wants to find him. Our main character is. This is good because it reduces the amount of data stored. But to find Timmy, , who wants to find him. Our main character is still needs to send all pseudonyms—or the seed—to Apple, which will have to search every pseudonym in its database.
Hiding the location of Lassie
The described approach with pseudonyms should effectively hide identity Timmy from : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: even from Apple (up until the point when , who wants to find him. Our main character is tries to search for it). However, there is a significant downside: it does not hide the GPS coordinates. : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below:.
This is problematic for at least several reasons. Each time, : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: If any device with a BLE signal is detected, it must send its current location to Apple servers (along with the alias it sees). This means that : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: it constantly informs Apple of its whereabouts. Moreover, even if Apple promises not to retain identity : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below:, the result of all these messages is a massive centralized database that shows all GPS locations where any Apple device has been detected. Note that the array of such data itself discloses a lot of information. Yes, device identifiers may be aliases — but that doesn't make the information useless. For example, if
some Apple device transmits the same coordinates in the evenings, it reveals a probable residential address of the person. The obvious way to prevent the disclosure of this data by Apple is to encrypt it, so that only those who really need to
know the device's location can see the information. If we need it receives a message from : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: , then the only person who actually needs to know the location of Timmyis : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below:. To keep this information confidential, , who wants to find him. Our main character isit must encrypt its coordinates with a public key. : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: Of course, the question arises: how , who wants to find him. Our main character is.
will it obtain the key? : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: — by shouting the public key , who wants to find him. Our main character is? Очевидное решение для Timmy in every broadcast. But this would create a static identifier, which again would allow tracking. , who wants to find him. Our main character is To solve this problem, it's necessary for Timmy.
to have many unlinked public keys. , who wants to find him. Our main character is it was It could issue different keys with each transmission. One option is to let, so that Timmy generate many different shared pairs of keys (or generate many such pairs from a common seed). But this is cumbersome, and , who wants to find him. Our main character is and Timmy it would have to store many secret keys. And the identifiers mentioned in the previous section could be obtained by hashing each public key. , who wants to find him. Our main character is A slightly better approach (which Apple may or may not use) suggests
randomization of the keys. This is a feature of certain cryptosystems, such as ElGamal: it , so that it is not linked to the original. The best part of this feature is that , so it will not be linked to the original in any way. The best part of this feature is that , who wants to find him. Our main character is can use one secret key regardless of which randomized version of its public key was used for encryption..
All of this leads to the final idea of the protocol. In each transmission, Timmy it sends a new pseudonym and a randomized copy of the public key. , who wants to find him. Our main character isWhen : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: it receives the transmission, it encrypts its GPS coordinates with the public key and sends the encrypted message to Apple. , who wants to find him. Our main character is can send pseudonyms Timmy to Apple servers, and if Apple finds a match, it will be able to access and decrypt the GPS coordinates.
Does this solve all the issues?
The unfortunate thing is that there is no perfect solution for many strange edge cases. For example, what if Timmy has malicious intentions and wants to force : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below: to reveal its location to Apple? What if Old Man Smithers tries to kidnap : this is an iPhone belonging to a random (and unaware) stranger who (let's suppose) has at least occasional internet access and reliable GPS. And Lassie is a very good girl. The networked devices interact through Apple iCloud servers, as illustrated below:?
At some point, the answer to this question boils down to the fact that we've done everything we can: any remaining issues should be taken outside the threat model. Sometimes even Lassie knows when to stop.
Source: habr.com
