Jacked and Hacked: just how safe are tracking tags?

AirTags...what if you bought one? Is it unsafe? (Good news: not really.)
nakedsecurity....
nakedsecurity....-airtags-hacked-again/

[@rob876]

Thanks for the important tips and interesting hacking ideas. It helps to know the tricks possible in order to be aware of what could go wrong. There have been times when I could have done with one of these AirTags - but not at £29! One occasion I can recall that really stands out above all others is when I couldn't find the HP sauce after I'd already made myself a bacon butty.

[@hans8201]

Hey what happened to the podcast? I used to enjoy listening

[@MikeTrieu]

I believe you were wrong about them not being able to exfil crypto keys. They (or someone adjacent) were able to exfil the private key used to request the entire location history from the Find My network for that AirTag. That's worrying. They were also able to clone an AirTag and spoof the location data. So tracking lost/stolen items essentially become meaningless. They were also able to cycle the device ID constantly just like when it's still paired with the owner's device so it will never notify nearby iPhones that they're being tracked. None of this is good. Apple can't have any privacy guarantees until they can properly secure the AirTag. That means Secure Boot, but that will likely take another hardware revision.