A security researcher has successfully reverse-engineered Apple’s exclusive Find My People protocol, illustrating that a Linux system can interface with Apple’s internal services to access an existing location-sharing key. This breakthrough allows the decryption of a friend’s real-time location without the need for a Mac or iPhone.
Unraveling Apple’s Protocol
The researcher embarked on this project with the intent to create Discord geofence alerts using location data already shared via Apple’s Find My app. What initially seemed like a straightforward API call evolved into an intensive week-long reverse-engineering effort, tackling Apple’s private device-identity and messaging infrastructure, which had not been replicated by any open-source initiative before.
By employing decompilations of Apple’s fmfd, findmylocated, and searchpartyd daemons, along with open-source tools such as FindMy.py and pypush, the researcher meticulously reconstructed the communication pipeline, field by field.
Simulating an Apple Device
The primary challenge was authentication. Standard iCloud login tokens yielded 401 errors when used with the old Find My Friends API, as each Apple service issues unique credentials via a broker exchange. Through GrandSlam, Apple’s account login protocol, the researcher secured a delegate token for IDS, Apple’s private identity and encrypted messaging layer, integral to both iMessage and Find My services.
Transforming this token into a functional device identity mandated a certificate signing request with specific, undocumented parameters: a 2048-bit RSA key, a SHA-1 signature, and a common name based on the SHA-1 hash of the profile ID, compressed into a gzip XML property list.
Accessing Shared Keys
Registering as a Find My device required enrolling under Apple’s “alloy” multiplexer service, incorporating six distinct sub-services, rather than directly registering with Find My Friends. The most complex aspect was persuading Apple to dispatch the encryption key for an already-approved share to the newly established Linux “device.”
According to a Zerotistic researcher, a SubscribeAndFetch request with the intent of distributeKeys incites the sharing device to redistribute its existing key via Apple Push Notification Service, enclosed in a signed, ECDH-verified envelope known as pair-ec. Importantly, this process did not necessitate resharing or account modifications, as Apple’s system is designed to transfer existing keys to newly added devices automatically.
The retrieved key employed elliptic-curve cryptography on the P-224 curve, differing from the P-256 keys used in the messaging envelope itself. With this key, the researcher accessed Apple’s SearchParty service, which stores encrypted location reports, and decrypted the data locally using ECDH key exchange and AES-GCM. The result was a live, verified location coordinate, accuracy radius, and timestamp for the consenting friend’s device, all achieved through Linux tools.
Implications and Future Outlook
This exercise did not expose a security flaw requiring Apple’s intervention, as it only accessed a location willingly shared with the researcher’s account. Its significance lies in providing a detailed documentation of Apple’s private IDS and SearchParty protocols and their method of distributing and rotating location-sharing keys. This information is invaluable for researchers developing interoperable or self-hosted Find My clients.
As technology continues to evolve, understanding such protocols might pave the way for innovative applications and enhanced interoperability in location-sharing services.
