I'm not sure I'm comvinced this is a problem. I can do th e same thing just by putting QR codes on stuff. Someone is curious, scans the code, clicks the link. Way cheaper to print sheets of QR code stickers than $30 a pop AirTags
Apple makes a gadget that has an explicit mode for good samaritans to locate the original owner. This mode has a security flaw (lack of input validity checks, I thought we overcame this stuff last decade?) that opens up the good samaritan to abuse by means of phishing. And somehow you want to explain to me that that is not a problem? Just because I can take a random car and drive into people doesn't mean a self-driving car having a bug that drives into people isn't an issue, to give an example of why your logic doesn't pass.
The reason this is a serious problem and not equivalent to any other situation where you can get people to click an arbitrary link wasn't immediately obvious to me either. I'm glad the question was asked and answered. I'm not a diehard Apple defender, just someone who's not immersed in this phishing stuff on a daily basis. shrug
As it stands, a malicious user can replace the entire website, still under an apple.com domain, with content of their own devising. This content can, for example, pretend to be an Apple login page, and exfiltrate entered credentials.
I hope it's obvious why this form of attack is more malicious and more dangerous than simply putting up an arbitrary QR code.
Now you’ve phished the apple credentials off someone thinking they’re helping find you lost keys. Less people would scan a random QR code they found. And even fewer would mistake it for a real apple login and feel compelled to login.
It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care?
Then I ain’t scanning no Airtag.
The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"
Those recent articles about large groups of employees pushing the company to take stands on anything but work-related matters makes me wonder if the sane, competent employees have either left or have "mentally checked out."
See: https://www.nytimes.com/2021/09/17/technology/apple-employee...
An airtag is a product by a big company, claiming to be trustworthy. Claiming their products are safe. You are actually told by Apple to scan those airtags, made by them. So you find an Apple airtag, scan it with your Apple iPhone, and an Apple login form is presented to you. Way, way different from that qr code scenario.
Basically, a victim finds an air tag, and as a Good Samaritan, opens the "found" link to attempt to reunite the air tag with its owner. The key is, the victim may trust the Apple Airtag to direct them to a secure, private web page, so may be willing to do something like provide their iCloud credentials when prompted.
It's not an attack that would be deployed indiscriminately -- it costs an attacker $30 for a chance that a desired target will find the Airtag, be a Good Samaritan and interact with the "found" page as hoped. But it could make sense against high value targets.
[1] https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred...