Vulnerabilities identified in offline finding (OF) — Apple’s proprietary crowd-sourced location tracking system — could be abused for user identification, researchers said in a report released this month.
Introduced in 2019, the system relies on the Bluetooth Low Energy (BLE) technology for the detection of ‘lost’ devices, and on the Internet connection of so-called ‘finder’ devices to report on their location back to the owner.
With “hundreds of millions” of devices part of Apple’s OF network, this represents the largest crowd-sourced location tracking system in the world, one that is expected to grow even further, as support for non-Apple devices is added to it.
Apple claims anonymity of finders, says that device owners can’t be tracked, and that location reports are confidential, but a group of academic researchers with the Technical University of Darmstadt, Germany, identified vulnerabilities that could potentially lead to user identification.
Overall, they say, the system delivers on its promise for security and privacy, but two design and implementation flaws could allow for location correlation attacks, as well as for unauthorized access to the past seven days’ location history, thus essentially resulting in user deanonymization.
“We find that the overall design achieves Apple’s specific goals. However, we discovered two distinct design and implementation vulnerabilities that seem to be outside of Apple’s threat model but can have severe consequences for the users,” the academics note in their research paper.
The researchers found that different owners’ locations could be correlated, provided that they are reported by the same ‘finder,’ which would essentially allow Apple to construct a social graph.
Furthermore, they discovered that, because “cached rolling advertisement keys are stored on the file system in clear text,” it was possi ..
Support the originator by clicking the read the rest link below.
