Apple’s Find My network normally shares locations only among Apple devices, but a security researcher has shown that a Linux machine can join as a trusted member and pull live people-location data.
The 22-year-old researcher, who goes by Zerotistic, spent less than a week building the technique. It is not an exploit that exposes any Apple user’s location on demand. It only works for people who have already chosen to share their whereabouts with the Apple account the Linux device is tied to.
The method starts with Apple’s GrandSlam authentication flow, which produces an identity delegate. The researcher then built a custom certificate signing request to obtain an Apple Identity Services device certificate that binds the Linux machine to the Apple account.
The signing request had to follow an older format: PKCS#10 with a 2048-bit RSA key signed using SHA-1, packed into a compressed XML file and sent to Apple’s authenticateDS profile-enrollment endpoint. Apple signed it, and the Linux device was registered.
Convincing Find My that the machine could actually receive location data took more work. Registration required subscribing to six subservices, declaring supported encryption types, and providing public keys for Apple’s device-to-device messaging, all signed with the IDS certificate and an APNs certificate from the initial network setup.
A persistent binary TLS connection to Apple’s private APNs servers carried a SubscribeAndFetch request that pushed an encrypted location key from a friend’s device. A Linux script then unwrapped the messaging envelope and decrypted the location report, which contained coordinates, timestamps, and accuracy data.
The Register asked Apple whether it was aware of the research and planned to address it; the company did not immediately respond.
