Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers

• URL: http://arxiv.org/abs/2606.21067v1
• Date: Fri, 19 Jun 2026 03:32:52 GMT
• Title: Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers
• Abstract summary: Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE)<n>This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices.<n>We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware.
• Score: 5.464858737467414
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE). This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices. We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware. Snatcher identifies vulnerabilities in unencrypted BLE advertisements, unauthenticated acoustic triggers, and slow MAC address randomization. Through three levels - sound-based direction finding, RSSI-IMU sensor-fusion navigation, and spatial-temporal clustering - our Android-based platform physically tracks and locates lost Apple accessories and devices in real-world tests. Our results highlight a crucial conflict between privacy protection, anti-stalking design, and physical security, urging Apple to strengthen Find My defenses.

Related papers

• ARIstoteles -- Dissecting Apple's Baseband Interface [8.84250777643946]
  We reverse-engineer and fuzz-test the Apple Remote Invocation (ARI) interface on iOS.<n>Our Ghidra scripts automatically generate a Wireshark dissector, called ARIstoteles, by parsing closed-source iOS libraries.<n>By releasing ARIstoteles open-source, we also aim to facilitate similar research in the future.
  arXiv  Detail & Related papers  (2026-04-25T22:11:50Z)
• Breaking ECDSA with Electromagnetic Side-Channel Attacks: Challenges and Practicality on Modern Smartphones [1.9139579957073902]
  We assess the feasibility of electromagnetic (EM) SCA on a Raspberry Pi 4 and a Fairphone 4.<n>We present case studies illustrating how hardware and software stacks impact EM SCA feasibility.<n>Our findings show weaknesses in ECDSA software implementations and underscore the need for independently certified secure elements.
  arXiv  Detail & Related papers  (2025-12-08T08:31:40Z)
• WatchWitch: Interoperability, Privacy, and Autonomy for the Apple Watch [50.89778047875175]
  We reverse-engineer the Apple Watch's wireless protocols.<n>With WatchWitch, we break out of Apple's walled garden.<n>We thus pave the way for more consumer choice in the smartwatch ecosystem.
  arXiv  Detail & Related papers  (2025-07-09T18:33:58Z)
• Securing the Invisible Thread: A Comprehensive Analysis of BLE Tracker Security in Apple AirTags and Samsung SmartTags [0.0]
  This study presents an in-depth analysis of the security landscape in Bluetooth Low Energy (BLE) tracking systems. Our investigation traverses a wide spectrum of attack vectors such as physical tampering, firmware exploitation, signal spoofing, eavesdropping, jamming, app security flaws, Bluetooth security weaknesses, location spoofing, threats to owner devices, and cloud-related vulnerabilities.
  arXiv  Detail & Related papers  (2024-01-24T16:50:54Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• AirGuard -- Protecting Android Users From Stalking Attacks By Apple Find My Devices [78.08346367878578]
  We reverse engineer Apple's tracking protection in iOS and discuss its features regarding stalking detection. We design "AirGuard" and release it as an Android app to protect against abuse by Apple tracking devices.
  arXiv  Detail & Related papers  (2022-02-23T22:31:28Z)
• Achieving Real-Time LiDAR 3D Object Detection on a Mobile Device [53.323878851563414]
  We propose a compiler-aware unified framework incorporating network enhancement and pruning search with the reinforcement learning techniques. Specifically, a generator Recurrent Neural Network (RNN) is employed to provide the unified scheme for both network enhancement and pruning search automatically. The proposed framework achieves real-time 3D object detection on mobile devices with competitive detection performance.
  arXiv  Detail & Related papers  (2020-12-26T19:41:15Z)
• DPAttack: Diffused Patch Attacks against Universal Object Detection [66.026630370248]
  Adversarial attacks against object detection can be divided into two categories, whole-pixel attacks and patch attacks. We propose a diffused patch attack (textbfDPAttack) to fool object detectors by diffused patches of asteroid-shaped or grid-shape. Experiments show that our DPAttack can successfully fool most object detectors with diffused patches.
  arXiv  Detail & Related papers  (2020-10-16T04:48:24Z)
• The Dark (and Bright) Side of IoT: Attacks and Countermeasures for Identifying Smart Home Devices and Services [4.568911586155096]
  We build up a model describing the traffic patterns characterizing three popular IoT smart home devices. We prove that it is possible to detect and identify with overwhelming probability their presence and the services running by the aforementioned devices.
  arXiv  Detail & Related papers  (2020-09-16T13:28:59Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.