Heinrich, Alexander ; Stute, Milan ; Kornhuber, Tim ; Hollick, Matthias (2022)
Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System.
The 21st Privacy Enhancing Technologies Symposium. Online (12.07.2021-16.07.2021)
doi: 10.26083/tuprints-00020598
Conference or Workshop Item, Secondary publication, Publisher's Version
 | There is a more recent version of this item available. |
Abstract
Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.
| Item Type: | Conference or Workshop Item |
|---|---|
| Erschienen: | 2022 |
| Creators: | Heinrich, Alexander ; Stute, Milan ; Kornhuber, Tim ; Hollick, Matthias |
| Type of entry: | Secondary publication |
| Title: | Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System |
| Language: | English |
| Date: | 2022 |
| Place of Publication: | Darmstadt |
| Year of primary publication: | 2022 |
| Event Title: | The 21st Privacy Enhancing Technologies Symposium |
| Event Location: | Online |
| Event Dates: | 12.07.2021-16.07.2021 |
| DOI: | 10.26083/tuprints-00020598 |
| URL / URN: | https://tuprints.ulb.tu-darmstadt.de/20598 |
| Corresponding Links: | |
| Origin: | Secondary publication service |
| Abstract: | Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available. |
| Status: | Publisher's Version |
| URN: | urn:nbn:de:tuda-tuprints-205985 |
| Additional Information: | Keywords: Apple, Bluetooth, location privacy, reverse engineering, trackings tags, user identification Erscheint auch in: Proceedings on Privacy Enhancing Technologies, Volume 2021, Issue 3, pages 227-245, eISSN: 2299-0984 Presentation video: https://youtu.be/unXQwBrcUSw |
| Classification DDC: | 000 Generalities, computers, information > 004 Computer science |
| Divisions: | 20 Department of Computer Science 20 Department of Computer Science > Sichere Mobile Netze Profile Areas Profile Areas > Cybersecurity (CYSEC) LOEWE LOEWE > LOEWE-Zentren LOEWE > LOEWE-Zentren > emergenCITY |
| TU-Projects: | HMWK|III L6-519/03/05.001-(0016)|emergenCity TP Bock HMWK|LOEWE|emergenC TP Gurevych |
| Date Deposited: | 20 Jun 2022 12:07 |
| Last Modified: | 22 Jun 2022 11:21 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
Available Versions of this Item
- Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System. (deposited 20 Jun 2022 12:07) [Currently Displayed]
 |
Send an inquiry |
Options (only for editors)
 |
Show editorial Details |
Drucken
Impressum