A Relay a Day Keeps the AirTag Away: Practical Relay Attacks on Apple's AirTags

TL;DR

This paper demonstrates practical relay attacks on Apple's AirTags, exploiting a privacy-preserving design flaw to inject false location reports or cause denial of service, highlighting security vulnerabilities.

Contribution

The authors reveal a novel relay attack method on AirTags that can manipulate or deny location reports, exposing security weaknesses in the system's privacy design.

Findings

Relay attacks can inject false location reports

Attack can cause targeted denial of service

System's encryption prevents validation of reports

Abstract

Apple AirTags use Apple's Find My network: when nearby iDevices detect a lost tag, they anonymously forward an encrypted location report to Apple, which the tag's owner can then fetch to locate the item. That encryption protects privacy -- neither the finder nor Apple learns the owner's identity -- but it also prevents Apple from validating the correctness of received reports. We show that this design weakness can be exploited: using a relay attack, we can inject manipulated location reports so the Find My service reports a false position for a lost AirTag. The same technique can be used to deny recovery of a targeted tag (a focused DoS), since the owner is misled about its whereabouts.