Collect what is known about tags in owner-connected mode - #171
Merged
Conversation
The one case this app cannot handle: a tag that is with its owner, so it is not in the Offline Finding network and there is nothing on Apple's servers to fetch however far back anyone looks. Everything about it was scattered across two blog series, four papers, three GitHub threads and a FRIDA repository, and none of it says which parts are settled. **The finding worth the whole document** is stek29's, in FindMy.py #88: the proof of concept everyone reaches for writes GATT to a characteristic that is not present on a real AirTag with its owner nearby, because it is the *unauthorised* sound command. Authorised ringing - the owner's own tag, sitting next to them - is a different protocol over L2CAP. Somebody starting from the obvious PoC would spend a week finding that out. That has a bearing on #139, which plays a nearby accessory's sound over GATT, so it is said in the document rather than left to be noticed. Also collects: what a nearby tag actually broadcasts and how that differs from a separated one (primary key every 15 minutes, secondary key daily at 04:00); Adam Catley on the first six key bytes travelling as the BLE address; the WOOT'22 firmware work behind seemoo-lab/airtag and what its jailbreak requirement really is; and AirGuard, which malmeloo says already rings tags from Android - marked unverified, because that claim is the strongest lead here and it should not be taken on trust. Nothing was read out of rustpush, apple-private-apis or export-findmy, per the clean-room note in docs/findmy-export/README.md. stek29's public comments are quoted; his branches are not. Index row added per rule 10. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docs/owner-connected-tags.md— a reading list for the one case this app cannot handle, with a summary of what each source actually establishes rather than just a pile of links.Why
A tag that is with its owner is not in the Offline Finding network at all. No stranger's iPhone reports it, so there is nothing on Apple's servers to fetch however far back we look — which is why Apple's own app falls back to "last seen by your device". Everything in this area has to happen over Bluetooth, locally.
What is known about it was scattered across two blog series, four papers, three GitHub threads and a FRIDA repository, and none of it says which parts are settled.
The finding worth the document
stek29, in FindMy.py #88. He tested the proof of concept everyone reaches for against real AirTags with the owner device nearby, and it failed — the characteristic it writes to,
4F860003-943B-49EF-BED4-2F730304427A, was not present on the device at all. His own correction:Unauthorised ringing (any passer-by) and authorised ringing (the owner, tag nearby) are two different protocols, and only the first is a simple GATT write. Somebody starting from the obvious PoC would spend a week finding that out.
That has a bearing on #139, which plays a nearby accessory's sound over GATT — so the document says so rather than leaving it to be noticed later.
Also collected
seemoo-lab/airtag— the FRIDA scripts that do play sounds on a paired tag, and what its jailbreak requirement actually is (iOS 14.6–14.8, checkm8 hardware). This is the resource stek29 named for the L2CAP sideClean room
Nothing was read out of
rustpush,apple-private-apisorexport-findmy, perdocs/findmy-export/README.md. stek29's public issue comments are quoted; his branches are not opened.Index row added to
docs/README.mdin the same commit, per rule 10.🤖 Generated with Claude Code