AirGuard: Protect yourself from being tracked by AirTags and Find My accessories | Hacker News Reader

AirGuard: Protect yourself from being tracked by AirTags and Find My accessories

github.com

298 pointscommoner147 comments

> With the app you can play a sound on AirTags and find it easily.

I wonder how it does that. Unauthenticated BLE characteristic? This would imply anyone could force an arbitrary AirTag to make a sound. Obvious application: force all AirTags nearby to keep making sounds.

Seems so, there’s a constant named AIR_TAG_SOUND_CHARACTERISTIC with this value: 7DFC9001-7D1C-4951-86AA-8D9728F8D66C

The small evil part of me wants to extract this part of the source and just bring my phone onto public transit for a while to see what happens.

You don’t AirDrop cat photos to people at mass gatherings?

Pre pandemic I would change my phone name to cta lemur and send lemur pics to people on the “L”. I’ve been on public transit twice since March 13th 2020 and there’s not enough people to get away with this anymore.

Isn't the default AirDrop setting to receive from people in your contact list only? (It was on my Mac and iPhone.)

Probably some people change the configuration to take AirDrops from everyone, but I'd expect that to be a small minority.

Unfortunately yes it is.

All of this reminds me of good old bluejacking, which was when we did the same thing using Bluetooth.

Funnily enough, I just found out BT Info (or SuperBluetoothHack) still exists and you can run the old .jar with J2ME Loader on Android. Or you can use the new apk. But of course it only works on the old phones.

Now I'm curious too - if you decide to do it, let me know :D

starts at line 93 of https://github.com/seemoo-lab/AirGuard/blob/main/app/src/mai...

Why annoy people like this? My e-bike has Find My tracking built in to the firmware. As long as you don’t steal my bike you have no privacy concerns from me securing my bike. Even better I can track my bike down without involving the police, so the potential thief doesn’t even have to worry about being shot by some trigger happy cop.

Is “cop shoots bike thief” something you actually think is common enough to note?

This implies a concerning reality departure.

The police department is recommending people store their documents in an always-visible pouch to avoid getting shot.

https://dps.mn.gov/divisions/ooc/news-releases/Pages/dps-par...

This is a solution in the same way anti-homeless design is a solution

And they called the pouches "not reaching pouches". I wonder if they get the irony of "not reaching".

The sad reality is buried under so many layers of derangement, I can’t really understand what exactly they are trying to solve here

> deadly force encounters can be catastrophic for police officers

Oy vey.

At least where I live it is. I’ve personally witnessed two instances of excessive force and been a victim of excessive force myself.

And the last police shooting was ultimately about stolen property. They killed a father to be and a fetus over a suspected stolen car.

So no, I haven’t departed reality. But yes, not all police departments are like this (mine specifically has been under federal oversight for years).

> At least where I live it is

In the US? I wonder which part of the US (if I may ask)

> last police shooting .. killed a father ..

How sad that they did that. (If it got covered by any news, it'd be interesting (or is there a better word) to read)

I don't know if this is the case, but it seems to match:

https://www.washingtonpost.com/nation/2020/06/10/oakland-eri...

https://www.ktvu.com/news/attorney-for-brianna-colombo-confi...

I find the wording itself interesting. I guess it's a sort of class-tribalism that's developed to the point where it's so ingrained in some people's mindsets that they causally append bizarre comments like that to their sentences.

Broadcasting your bona fides far and wide is certainly en vogue in certain circles; anecdotally speaking, the incidence of people manifesting their vanilla pronouns is orders of magnitude higher than otherwise.

Seems it's on par with yelling go packers or similar at a crowded bar.

Great, now instead of getting shot by a cop you’ll get the crap kicked out of you instead.

In many areas of the US, that trigger happy cop will be the difference between you recovering your property and you being severely beaten when you show up in a rough neighborhood trying to get your bike back.

In my experience, the most an American cop is going to do to help you resolve a property crime is take a report. If they happen to find the item, you _may_ get it back.

However this is a required step for submitting to many consumer insurance programs

And probably the answer for why things are the way they are: most people likely just want the report for insurance payout, and not getting their used thing back.

> In many areas of the US, that trigger happy cop will be the difference between you recovering your propert

A cop's not going to get your bike back. They'll write a report and then throw it away when you leave.

In what area of the US do the police actually recover bikes?

If you show the police officer a live location of your stolen property moving on a map, that's usually enough to motivate them into action. I've seen two stolen phones recovered this way. If you tell them your bike is stolen and that's all the information you have, they rightly deduce that there's almost no chance of you getting it back.

There's tons of people who've posted about people telling cops exactly which house their stolen property is in (using Find My Phone/Whatever) and cops simply saying they can't/won't do anything.

This is what happens most of the time -- cops just don't care in the majority of cases.

That's why it's important to be friends with ex-Special Forces and ex-MMA fighters.

What if someone else is tracking your bike? Or backpack, or car, etc? GPS trackers exist so this doesn't eliminate that concern, but at least if someone tries tracking you with an AirTag you have an option to locate it.

> Why annoy people like this?

Does it matter? Someone is going to do it anyway. They might just think that it's funny that they can make all the tags in the subway car start making noise.

So maybe the question should be "why did Apple design it to allow this?".

Apple devices create an encrypted mesh network. So every Apple device nearby potentially can pass encrypted messages from either a "Find my iPhone" or "Find my AirTag" BT beacon. Eventually it finds a device that is connected to the internet and the packets are forwarded to the Apple Account bound to the Air Tag.

I think the encryption and tie to an Apple account prevent arbitrary people from doing that.

Pretty cool but why does it have to be limited to AirTag or any specific devices? It would be easy to expand it to keep track of any nearby Bluetooth device and a corresponding whitelist. (Or do AirTag devices rotate Bluetooth MACs?)

Airtags are just one implementation of a Bluetooth transmitter and a long life battery but anyone could probably build a similar device dedicated to tracking with off the shelf parts.

AirTags, like all Apple devices, use randomized Bluetooth addresses, otherwise they allow scanners to follow their users location over time.

I don't think that's an Apple thing, but rather a BLE thing, isn't it (though technically opt-in)?

https://www.bluetooth.com/blog/bluetooth-technology-protecti...

Private resolvable addresses are a BLE thing, but very few devices (aside from Apple products and Android phones) actually use them. It’s a shame, really, because most embedded BLE stacks support the feature.

My company is working on a platform to make BLE product development much easier than it is today, and also to improve the quality of BLE products. We plan to make privacy a standard feature.

Airtags are the only devices (that I know of) that can leverage a worldwide network of iPhones to transmit their location rather than a power intensive LTE or GSM link. They also don't require any external antennae for location determination like those GPS trackers stalkers use.

Those features make make AirTags more practical for any use, good or bad. They do rotate Bluetooth MAC addresses so only you and Apple can follow where the tag has been, supposedly.

Furthermore, if your target has an iPhone, you can partially leverage their phone against them. Of course Apple saw this coming and added a warning. If you're on Android you'll have to rely on apps like these (or the theoretical app Apple promised at some point) to prevent AirStalking

Tile has offered a similar mechanism for years but the lack of a worldwide network of automatic data collection points makes their network a lot less useful for good or bad people.

Tile will now leverage Amazon sidewalk to have a similar affect - which is all alexa and ring doorbells I think?

Amazon Sidewalk isn't really a worldwide thing. Amazon has a localized website in only 20 countries, my guess is that in most other countries there aren't many Alexa and Ring devices.

Same difference. The majority of people reading this are regularly within a half mile of a Sidewalk device (well, the ones that work on 900MHz) and might be wary of a Tile being used to track them as well.

It irks me that the onus of not being tracked is on the "target" themselves.

Further, there's no protection if you have no smartphone but are in a dense population area surrounded by devices that are part of this surveillance network.

There is no aspect of this that is privacy friendly except for the hand waving.

There’s protection even if you’re standing there naked (except for the AirTag, of course, that has been secretly duct-taped to your buttocks): if the paired phone isn’t around, the AirTag makes noise. I can confirm this because my spouse is currently out of town, and I’ve grabbed her RV keys a couple of times to put stuff in the RV. And every time I pick the keys up, the AirTag goes off. It eventually shuts up just shy of my threshold of looking for a way to turn it off. (Or I could just make sure to grab my keys instead of hers. ¯\_(ツ)_/¯ )

You can remove the battery pretty easily thankfully, if it’s annoying you. https://found.apple.com/airtag/disable#

It is trivial to damage airtag to disable the dynamic. So a committed stalker will do it without difficulty.

At some point, a committed stalker has access to lots of other options for stalking that are easier than the AirTag game.

What other options allow them to embed a tiny almost invisible device in a piece of clothing or a toy and learn its location from anywhere in the world?

GPS trackers are larger, require a fair amount of power (big battery), don't work well indoors, and require cellular service.

I was thinking about this - if I were a stalker, I wouldn’t bother with any physical device. I’d just add myself (or an innocuous looking account) to “share my location” on their phone.

The non-HN public would probably never notice, and it wouldn’t be too hard to get someone’s unlocked phone (especially in an abusive-relationship scenario)

In cases where you can get access to the phone, sure.

But these trackers mean that you can give a stuffed animal to your favorite streaming star at a conference (or sent one in the post to their mailbox service) and then learn where they live... and you can do so with a few minutes effort and a few dollars in cost above the toy.

If you know you're at risk you can protect your phone. I think the threat from these apple-powered trackers is much more severe, but it's true that these sorts of risks still exist without them.

> There’s protection even if you’re standing there naked … if the paired phone isn’t around, the AirTag makes noise.

Unless someone piggybacks on Apple’s find my network using their own hardware.

I read the specification and turned my laptop into an airtag clone one day I was particularly bored, really isn’t complicated.

  > I read the specification and turned my laptop into an airtag clone one day I was particularly bored

This is believable.

  > really isn’t complicated.

This isn't.

> Airtags are the only devices (that I know of) that can leverage a worldwide network of iPhones to transmit their location rather than a power intensive LTE or GSM link

Sure, but “of iPhones” is doing a lot of work in that sentence. Worldwide network of <users of some common hardware or software> generally isn't as uncommon.

Name a product which allows me to find my dog, without paying monthly subscription fees.

A prominent group of Virtual YouTubers (whose talents use avatars and keep their real identities anonymous) recently needed to stop allowing fans to send gifts to talents, despite them always having been screened, because the gifts might contain AirTags that could ping the sender when they arrive ina talent’s home. It’s not that this wasn’t possible before, but it suddenly became easy for a would-be stalker to execute the attack.

A tool like this that reliably detects AirTags rather than relying on whatever heuristics Apple uses to say “an AirTag is following you” would be invaluable for people’s opsec, be they performers or journalists or anyone else desiring anonymity.

Why not just have all packages go through a central location first, like an office in the city or something, where someone can open them and pass on the gifts? This is already a thing for celebrities/people who get targeted by stalkers/attackers.

AirTags are small enough that you can hide them inside the gift item itself.

They are probably even thin enough that can embedded into cardboard or somewhere in the product so only open the box to inspect doesn't matter

The gifts could then sit in "quarantine" for a day or so, with an Android phone running AirGuard sitting nearby.

Is it possible to build a "delay fuse" with a CR1216 or CR1616, Nch FET and a 6-pin AVR all inside a CR2032? Yes, with plenty of room to spare for caps[1]

1: https://pbs.twimg.com/media/E_oLLKOVUAItesC?format=png&name=...

e: meant to say delay fuse, not slow [blow] fuse

You can remove the speaker

Can’t realistically inspect dozen random products from Amazon each day and never let an AirTag slip. They stream from home with an iPhone for face tracking so accuracy will be nothing short of ideal.

> Airtags are just one implementation of a Bluetooth transmitter and a long life battery but anyone could probably build a similar device dedicated to tracking with off the shelf parts.

There is nothing Dropbox does that can’t be done with rsync.

Nothing the Dropbox client does that rsync can't do.

Running even a NAS storage with remote backups and decent security is not trivial job.

While UX/client features is a factor for buying into Dropbox, the storage and backup costs are the primary cost driver.

> Our goal is to protect privacy and to find out how many people are opposed to tracking.

Asking how many ppl are opposed to tracking is a silly question that won’t get you anywhere — it’s answer in a vacuum doesn’t make sense as it needs to be contextualized. “Are you ok with google seeing your IP so they can sell you ads to give you free YouTube” is an example of context where people see trade offs. Most people won’t understand the full spectrum of what’s going on, and if it all in the end results in just ads, many are fine with that as long as they’re getting free stuff with it.

The bigger questions on societal level trade offs shouldn’t be answered by lay people but rather regulation in the name of public interest.

Google doesn't just "see your IP" to sell you ads. They collect a lot more information about you than that, so I don't know why you consider your question to be more useful than the one you quoted.

Neither one provides enough information for the average person to give an informed answer. They're both equally biased/leading, but in opposite directions.

This is something Apple should be providing themselves (edit: for Android). They already have "Apple TV", "Apple Music", and a "Move to iOS" app. Is it really so much to ask for a stalking prevention app?

I can see those cheery iStalking ads already, telling you to get anti-stalking subscription.

And, of course, for adventurous devs they’re going to introduce a StalkingKit!

This already is the case. iOS alerts you of any airtag it detects for a long enough time.

Since this app is for Android and the Apple apps mentioned by the parent comment are for Android, I think he's saying Apple should be the ones providing their own AirTag app for Android, not university students.

I would far prefer that the app be developed by a third-party, not Apple. But Apple's spec that the app uses should be open (which I believe is in fact the case).

Apple should provide a “find my” app on android that not only detects rouge airtags but lets you participate in tracking your, and other’s, airtags like an iPhone can.

This has to be at the OS level or it will either be killed by the OS or ruin your battery life.

Don't AirTags already start beeping if they spend too much time around a single phone other than their owner's?

Yup. When other people get into my truck the AirTag in the glove box beeps.

So if someone steals my air tagged device they can just turn it off. Nice

I think the marketed goal of AirTag isn't to prevent theft, it's to help find lost (but not stolen) objects, like if you left your keys somewhere.

If someone steals your AirTagged device, after it's away from whatever you paired it with for a while, it'll start beeping, which will quickly alert the thief that they need to find the AirTag and throw it out. So I don't think AirTags were meant to deter theft; I think they're just there to help people find stuff they've misplaced.

Great. So you just made an app that helps bike thieves find the airtag hidden in my bicycle.

Why would you assume the bike thief doesn't have an iPhone?

Because the bad guys never have one in the movies /s

Future movie spoilers alert! And it’s actually true isn’t it! :-) Apple won’t let bad guys use their hardware; https://www.cnbc.com/2020/02/26/apple-wont-let-bad-guys-use-...

That is nonsense. Legally, Apple can do nothing if a movie maker wants to go out and buy an Apple product and show a bad guy using their products.

That director is probably referring agreements the movie maker made with Apple in exchange for free Apple devices to use in the movies. Or he is trying to misdirect for the next movie he is making.

Of course it wouldn’t be anything legal, most likely just to do with the free supply of hardware as you suggested!

The legalities of it probably revolve around the Apple trademark and nothing to do with the hardware.

Won't the AirTag start beeping if your bike is stolen (that is, if the tag is away from your iPhone for too long)? I think that will alert them much better than this app will.

Some people are disabling the speaker by opening the airtag and and removing its connection.

No the time for that mechanism to activate is longer than a thief who has this app and checks immediately.

I understand using it for keys and stuff, but attaching airtags to valuables and carrying them out in public has to be the stupidest idea ever. Apps like these are soon going to turn them into "steal me!" beacons.

Please explain to me how a thief is going to use the existence of this tech to enable theft.

I think their point is that knowing there’s an air tag on something nearby indicates it’s probably something of value worth stealing.

How often is that something otherwise invisible, however? Like if I put one on my bike are there really many thieves who would otherwise not have considered it? I’m sure there are some small things which are relatively covert but it seems like a relatively uncommon situation.

Feel free to steal my daughter's water bottle. I don't track it because it's valuable, I track it because she's irresponsible.

Unlike my eyeballs that can see an expensive bike in the range of the airtag transmission.

Almost all of the tags are on people’s keys which hold close to no value

I’m confused about the difference between keys and valuables (as if keys aren’t valuables). Both suck to misplace and it’s helpful being able to find their pinpoint location or event of separation.

Does Apple have any incentives to release a first party tool to handle this? There’s precedent for Apple releasing Android tools and if anything should get sherlocked it’s this.

This seems to notify you of nearby tags but does not disable them in some way.

How would an app on device A disable device B?

Airtags do allow non-owner devices to disable some functionality such as turning off the alarm. I doubt they let you turn off the tracking since that would completely defeat the anti-theft aspect of Airtags.

> I doubt they let you turn off the tracking

I'm not sure how they would even do that in the first place, since the AirTag doesn't track anything.

I meant it could let you turn the device 'off'? Sure the AirTag isn't the device doing the tracking but if it isn't broadcasting itself then other devices can track it.

Although, if you find one, it's trivial to remove the battery or smash it with a hammer.

Removing the battery is the official way of turning them off. If the anti stalker mode activates on your iPhone. It shows an animation of how to twist and remove the battery.

A moving AirTag will start chirping was little as a few hours after not being near it’s paired device - which alerts the thief, unfortunately.

But, AirTags use a proper speaker rather than a piezo one - so it is possible to remove the permanent magnet and make them silent. (See YouTube for details)

If you were worried about a high value item (eg a motorcycle) you could hide two - a sacrificial regular one, and a better hidden silenced tag that should remain undetected for at least a few days.

Constant buzzing would presumably make the batteries run out.

You need a separate app for that, I think I've heard it called "Ball-peen Hammer"

Think about what you just suggested. If I could arbitrarily disable airtags around me, I could go around in public and disable everyones' airtags.

>If a devices follows you, you will get a notification in less than an hour!

Not sure if this is right for me, my wife could cheat on me faster.

Legislation is the proper protection here.

Is there a specific policy you think should be legislated that would prevent unwanted tracking?

A blanket ban on hoarding, storing and selling personal data for any purposes other than natsec. Basically, treat personal data like nuclear materials in the laws.

I wasn't onboard at first, but I actually think that's a pretty reasonable take to have on it. Apple should be allowed to implement Find My, but only as an open standard that other manufacturers can implement so they can also have safety features. Simply notifying every iPhone isn't going to stop someone from putting it in a kid's backpack, tracking your vehicle, or any other obvious edge case. There are lots of solutions here, but all of them involve Apple tipping their hand: something they've vehemently opposed in the past.

As of spring 2021 they actually opened up the Find My spec for third party manufacturers [1] - that’s how those electronic bikes and headphones can have built-in Find My tracking now.

[1]: https://developer.apple.com/find-my/

How does that relate to AirTags (or similar devices, like Tile)? The companies that make these trackers aren't selling the data to anyone external, only displaying it to the person who bought the device.

Tracking someone like that would be a felony, ideally, with an order to stop operations for the company who's facilitating it. Using my analogy above, that's like dropping a bag with nuclear waste into someone's pocket.

Couldn't this fall under stalking legislation?

> with an order to stop operations for the company who's facilitating it

So, you want to shut down all manufacturers of phones, GPS devices, and Bluetooth devices? Because that's what you're asking for here.

That should be a clear indication your analogy is garbage...

Civil and commercial penalties would be a start

Isn't it already illegal in most places to put tracking devices on people without their knowledge?

I don’t think it actually is / or at least is ambiguous in many states.

Kidnapping is already illegal. Curious, it still happens

Name one company in the US that's built business around kidnapping.

I’d like protection against devices not made by US companies too

Well, since Apple isn't owning its own phone production, that would have interesting consequences, wouldn't it?

Right Direction (http://www.rdas.net/)

The tracking using Airtags has very little to do with Apple or any entity that could be controlled via legislation. Airtags themselves don't allow a non-owner to access location data anyway.

The tracking via Airtags is just putting a device on someone's person without their knowledge. That is already illegal but unless you know a crime has been committed you are SOL.

Not to mention you can detect an airtag, cellular devices your out of luck

Of course you can detect a cellular device. You mean, can't detect with an app on your phone.

Government intervention is not the answer to everything. It is slow and inefficient.

Reply on news.ycombinator.com