openhaystack
Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
Science Score: 54.0%
This score indicates how likely this project is to be science-related based on various indicators:
-
✓CITATION.cff file
Found CITATION.cff file -
✓codemeta.json file
Found codemeta.json file -
✓.zenodo.json file
Found .zenodo.json file -
○DOI references
-
○Academic publication links
-
✓Committers with academic emails
3 of 15 committers (20.0%) from academic institutions -
○Institutional organization owner
-
○JOSS paper metadata
-
○Scientific vocabulary similarity
Low similarity (14.4%) to scientific vocabulary
Keywords
Repository
Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
Basic Info
- Host: GitHub
- Owner: seemoo-lab
- License: agpl-3.0
- Language: Swift
- Default Branch: main
- Homepage: https://owlink.org
- Size: 8.98 MB
Statistics
- Stars: 11,491
- Watchers: 136
- Forks: 548
- Open Issues: 138
- Releases: 15
Topics
Metadata Files
README.Reproducibility.md
PoPETs Artifact Review
We submit the research artifacts of our paper Who Can Find My Devices? Security and Privacy of Apple's Crowd-Sourced Bluetooth Location Tracking System to the PoPETs Artifact Review process. Our submission includes (1) the experimental evaluation of the offline finding system in Section 7 of our paper and (2) the PoC implementation of the attack presented in Section 10. The OpenHaystack framework in this repository goes beyond the contributions made in our PoPETs paper and, therefore, is not part of our submission. However, we invite the reviewers to test this code as well.
Location Report Accuracy (Section 7)
We provide the raw data and evaluation scripts used for the experimental evaluation of the offline finding system in Section 7 of our paper. The code should be self-explanatory and generates Figures 4, 5, 8, 9, 10, and 11 and Tables 5, 6, and 7 of our paper.
Requirements
- Web browser to run the code via the online Binder service
Alternative: Python environment to run the code locally
Instructions
We implement all code in a single Jupyter notebook provided in an external repository. Please refer to the included README file for detailed instructions: https://github.com/seemoo-lab/offline-finding-evaluation.
Unauthorized Access of Location History (Section 10)
We provide a proof-of-concept (PoC) implementation of the attack presented in Section 10 of our paper. The PoC consists of two parts: (1) the application that reads the private keys from the victim's device and (2) the application that downloads and decrypts the corresponding location reports.
Requirements
Since our PoC targets a fixed vulnerability in macOS 10.15.7, the reviewer requires a device that is vulnerable to the attack. A second Apple device is required to trigger the generation and synchronization of keys. In summary, the reviewer needs
- a macOS device running macOS 10.15.6 or earlier (provided as a VM) and
- a second iOS (>=13.0) or macOS (>=10.15.0) device.
Both devices need to be logged into the same iCloud account, and both participate in Apple's Find My network (see Apple's official documentation).
Instructions
The PoC consists of two applications that are needed: OFReadKeys and OFFetchReports. OFReadKeys is the malicious application installed by a user. The user needs to install this application manually. OFFetchReports must run on the attacker's Mac. We provide the schematic overview from our paper below. For testing, both applications can also be installed on the same machine, which we describe in the following.
Preparation: disable SIP and AMFI
The attacker machine needs to have system integrity protection (SIP) and AMFI disabled. This allows OFFetchReports to access Apple account tokens necessary to authenticate at iCloud to download location reports.
- Boot macOS into recovery mode (hold ⌘+R during boot).
- Open Terminal (from the Utilities drop-down menu).
- Execute
csrutil disablein Terminal to disable SIP. - Execute
nvram boot-args="amfi_get_out_of_my_way=0x1"to disable AMFI. - Reboot macOS normally.
Reading keys
- Open the Xcode project in CVE-2020-9986/OFReadKeys.
- Run the OFReadKeys target.
- Export the advertisement keys using the single button to a file.
Fetching reports
- Run the Run OFFetchReports target.
- Import the exported key file via drag and drop.
- Watch OFFetchReports downloading and decrypting the location reports.
Owner
- Name: Secure Mobile Networking Lab
- Login: seemoo-lab
- Kind: organization
- Location: Darmstadt, Germany
- Website: https://seemoo.de
- Repositories: 92
- Profile: https://github.com/seemoo-lab
Citation (CITATION.cff)
# This CITATION.cff file was generated with cffinit.
# Visit https://bit.ly/cffinit to generate yours today!
cff-version: 1.2.0
title: OpenHaystack
message: 'If you use this software, please cite it as below.'
type: software
authors:
- given-names: Alexander
family-names: Heinrich
affiliation: 'SEEMOO, TU Darmstadt'
orcid: 'https://orcid.org/0000-0002-1150-1922'
- given-names: Milan
family-names: Stute
affiliation: 'SEEMOO, TU Darmstadt'
orcid: 'https://orcid.org/0000-0003-4921-8476'
- given-names: Matthias
family-names: Hollick
affiliation: 'SEEMOO, TU Darmstadt'
orcid: 'https://orcid.org/0000-0002-9163-5989'
repository-code: 'https://github.com/seemoo-lab/openhaystack'
abstract: >-
OpenHaystack is a framework for tracking personal
Bluetooth devices via Apple's massive Find My network. Use
it to create your own tracking tags that you can append to
physical objects (keyrings, backpacks, ...) or integrate
it into other Bluetooth-capable devices such as notebooks.
license: AGPL-3.0
commit: 7d72fa1ac19d2a9f6dec43011be07df8976a8b02
version: 0.5.3
date-released: '2023-10-09'
Committers
Last synced: 9 months ago
Top Committers
| Name | Commits | |
|---|---|---|
| Milan Stute | m****e@s****e | 53 |
| Alexander Heinrich | a****h@s****e | 45 |
| Sebastian | m****l@s****v | 6 |
| MaxGranzow | 2****w | 4 |
| Tomas Harkema | t****s@h****o | 2 |
| Sascha Mowtschan | m****n@g****m | 2 |
| yoution | y****n | 1 |
| Shai Mishali | f****c@g****m | 1 |
| Noah | n****h@h****e | 1 |
| Knut Hühne | k****t@k****u | 1 |
| Howard | g****o@g****m | 1 |
| Morten Harter | m****r@g****m | 1 |
| Frank Hessel | f****l@s****e | 1 |
| VladutLP | v****p@l****m | 1 |
| Alexander Heinrich | a****r@s****e | 1 |
Committer Domains (Top 20 + Academic)
Issues and Pull Requests
Last synced: 6 months ago
All Time
- Total issues: 131
- Total pull requests: 27
- Average time to close issues: 2 months
- Average time to close pull requests: 7 months
- Total issue authors: 115
- Total pull request authors: 20
- Average comments per issue: 6.34
- Average comments per pull request: 1.67
- Merged pull requests: 5
- Bot issues: 0
- Bot pull requests: 0
Past Year
- Issues: 9
- Pull requests: 0
- Average time to close issues: about 21 hours
- Average time to close pull requests: N/A
- Issue authors: 8
- Pull request authors: 0
- Average comments per issue: 0.44
- Average comments per pull request: 0
- Merged pull requests: 0
- Bot issues: 0
- Bot pull requests: 0
Top Authors
Issue Authors
- acalatrava (3)
- thirstyone (3)
- luke-jr (3)
- jaekim24 (3)
- jrusi (3)
- Stach-0 (2)
- mowtschan (2)
- ghost (2)
- Furtivo360 (2)
- Millo-max (2)
- moritztim (2)
- jsmith79 (1)
- ErfanDL (1)
- tnorm32 (1)
- das800 (1)
Pull Request Authors
- sebinbash (4)
- rkreutz (4)
- pawisoon (3)
- FauconSpartiate (3)
- davidbaumann (2)
- kaoz3000 (1)
- kerta1n (1)
- kholia (1)
- holygrolli (1)
- samaleksov (1)
- kauzu (1)
- vekexasia (1)
- Chapoly1305 (1)
- fureigh (1)
- MaxGranzow (1)
Top Labels
Issue Labels
Pull Request Labels
Packages
- Total packages: 1
- Total downloads: unknown
- Total dependent packages: 0
- Total dependent repositories: 1
- Total versions: 16
proxy.golang.org: github.com/seemoo-lab/openhaystack
- Documentation: https://pkg.go.dev/github.com/seemoo-lab/openhaystack#section-documentation
- License: agpl-3.0
-
Latest release: v0.5.3
published almost 3 years ago
Rankings
Dependencies
- actions/checkout v2 composite
- devbotsxyz/xcode-select v1 composite
- actions/checkout v2 composite
- devbotsxyz/xcode-select v1 composite
- ./.github/actions/build-esp-idf * composite
- actions/checkout v2 composite
- actions/checkout v2 composite
- ./.github/actions/build-esp-idf * composite
- actions/checkout v2 composite
- actions/create-release v1 composite
- actions/download-artifact v2 composite
- actions/upload-artifact v2 composite
- actions/upload-release-asset v1 composite
- devbotsxyz/xcode-select v1 composite
- DKImagePickerController 4.3.2
- DKPhotoGallery 0.0.17
- Flutter 1.0.0
- SDWebImage 5.12.3
- SwiftyGif 5.4.3
- file_picker 0.0.1
- flutter_secure_storage 3.3.1
- geocoding 1.0.5
- location 0.0.1
- maps_launcher 0.0.1
- path_provider_ios 0.0.1
- receive_sharing_intent 0.0.1
- share_plus 0.0.1
- shared_preferences_ios 0.0.1
- url_launcher_ios 0.0.1
- org.jetbrains.kotlin:kotlin-stdlib-jdk7 $kotlin_version implementation
- 106 dependencies
- flutter_lints ^1.0.0 development
- flutter_test --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess sdk: flutter development
- file_picker ^4.4.0
- flutter --- !ruby/hash:ActiveSupport::HashWithIndifferentAccess sdk: flutter
- flutter_colorpicker ^1.0.3
- flutter_launcher_icons ^0.9.2
- flutter_map ^0.14.0
- flutter_secure_storage ^5.0.2
- flutter_slidable ^1.2.0
- geocoding ^2.0.1
- http ^0.13.4
- location ^4.2.0
- maps_launcher ^2.0.1
- path_provider ^2.0.8
- pointycastle ^3.4.0
- provider ^6.0.1
- receive_sharing_intent ^1.4.5
- share_plus ^3.0.4
- shared_preferences ^2.0.9
- url_launcher ^6.0.17
- github.com/apple/swift-crypto 1.1.4
- github.com/apple/swift-nio 2.26.0
- github.com/apple/swift-nio-ssl 2.10.4
- github.com/apple/swift-crypto 1.1.7
- github.com/apple/swift-nio 2.40.0
- github.com/apple/swift-nio-ssl 2.20.2