A Relay a Day Keeps the AirTag Away: Practical Relay Attacks on Apple's AirTags

• URL: http://arxiv.org/abs/2604.10138v2
• Date: Tue, 14 Apr 2026 09:45:25 GMT
• Title: A Relay a Day Keeps the AirTag Away: Practical Relay Attacks on Apple's AirTags
• Abstract summary: We show that using a relay attack, we can inject manipulated location reports so the Find My service reports a false position for a lost AirTag.<n>The same technique can be used to deny recovery of a targeted tag (a focused DoS)
• Score: 1.2599533416395765
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Apple AirTags use Apple's Find My network: when nearby iDevices detect a lost tag, they anonymously forward an encrypted location report to Apple, which the tag's owner can then fetch to locate the item. That encryption protects privacy -- neither the finder nor Apple learns the owner's identity -- but it also prevents Apple from validating the correctness of received reports. We show that this design weakness can be exploited: using a relay attack, we can inject manipulated location reports so the Find My service reports a false position for a lost AirTag. The same technique can be used to deny recovery of a targeted tag (a focused DoS), since the owner is misled about its whereabouts.

Related papers

• Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers [5.464858737467414]
  Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE)<n>This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices.<n>We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware.
  arXiv  Detail & Related papers  (2026-06-19T03:32:52Z)
• Too Private to Tell: Practical Token Theft Attacks on Apple Intelligence [9.964425648424017]
  Apple Intelligence is a generative AI (GenAI) service provided by Apple on its devices.<n>We present our investigation into this token issuance mechanism with a goal to reveal possible vulnerabilities.<n>Specifically, we present the first practical cross-device token replay attack against Apple Intelligence.
  arXiv  Detail & Related papers  (2026-04-17T02:32:29Z)
• Symbolic verification of Apple's Find My location-tracking protocol [0.0]
  We present a symbolic model of the Find My protocol, as well as a precise formal specification of desirable properties.<n>We provide automated, machine-checkable proofs of these properties in the Tamarin prover.
  arXiv  Detail & Related papers  (2025-10-16T11:52:05Z)
• WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch [50.89778047875175]
  We reverse-engineer the Apple Watch's wireless protocols.<n>With WatchWitch, we break out of Apple's walled garden.<n>We thus pave the way for more consumer choice in the smartwatch ecosystem.
  arXiv  Detail & Related papers  (2025-07-09T18:33:58Z)
• Obfuscated Location Disclosure for Remote ID Enabled Drones [57.07815312703613]
  We propose Obfuscated Location disclOsure for RID-enabled drones (OLO-RID)<n>Instead of disclosing the actual drone's location, drones equipped with OLO-RID disclose a differentially private obfuscated location in a mobile scenario.<n>OLO-RID also extends RID messages with encrypted location information, accessible only by authorized entities.
  arXiv  Detail & Related papers  (2024-07-19T12:35:49Z)
• Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection [69.59980270078067]
  We explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministic. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verification.
  arXiv  Detail & Related papers  (2022-09-27T12:56:56Z)
• Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels [25.30364629335751]
  Apple introduced two significant changes with iOS 14: App Tracking Transparency (ATT), a mandatory opt-in system for enabling tracking on iOS, and Privacy Nutrition Labels. This paper addresses the impact of these changes on individual privacy and control by analysing two versions of 1,759 iOS apps from the UK App Store. We find that Apple itself engages in some forms of tracking and exempts invasive data practices like first-party tracking and credit scoring.
  arXiv  Detail & Related papers  (2022-04-07T16:32:58Z)
• AirGuard -- Protecting Android Users From Stalking Attacks By Apple Find My Devices [78.08346367878578]
  We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices.
  arXiv  Detail & Related papers  (2022-02-23T22:31:28Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)
• Decentralized Privacy-Preserving Proximity Tracing [50.27258414960402]
  DP3T provides a technological foundation to help slow the spread of SARS-CoV-2. System aims to minimise privacy and security risks for individuals and communities.
  arXiv  Detail & Related papers  (2020-05-25T12:32:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.