All Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices

## Overview At Black Hat, Min Zheng (Spock) and Xiaolong Bai, security experts from Alibaba, presented research on device fingerprinting and cross-device tracking techniques targeting Apple devices running iOS and macOS. With multi-device usage common—highlighted by Google data showing 98% of surveyed US internet users use multiple devices daily—advertisers and tracking entities aim to map individual users across iPhones, iPads, and MacBooks.

Cross-device tracking fundamentally relies on two stages: uniquely identifying each individual device, and correlating devices belonging to the same user into a unified device graph using deterministic or probabilistic links.

## Persistent Device Identification Techniques While Apple provides ephemeral and user-controllable identifiers (such as IDFA, IDFV, and Keychain storage), these are insufficient for permanent or anti-fraud tracking because users can toggle "Limit Ad Tracking," reset advertising identifiers, or wipe data on jailbroken devices. Direct access to hardware identifiers like IMEI (`IOKit`/`MobileGestalt`) requires root/kernel privileges or entitlements.

However, researchers demonstrated several side-channel and IPC techniques to acquire persistent hardware identifiers from within standard application sandboxes without jailbreaking: - **ARP Cache Leakage (Wi-Fi MAC):** While BSD-style `getifaddrs` returns masked/meaningless values on iOS, standard sandbox apps could historically open raw sockets (`AF_ROUTE`, `SOCK_RAW`) to inspect the system ARP cache routines and retrieve MAC addresses (restricted in iOS 11). - **Bluetooth Daemon IPC (`bluetoothd`):** On older hardware (e.g., iPhone 6), Wi-Fi and Bluetooth MAC addresses were assigned consecutively at manufacturing time. Third-party sandboxed apps could leverage Mach messages and private Mach services exposed by `bluetoothd` (specifically `com.apple.server.bluetooth`). By attaching a session via `BTSessionAttachWithRunLoop` and invoking `BTLocalDeviceGetDefault` and `BTLocalDeviceGetAddressString`, sandboxed applications could extract the hardware Bluetooth MAC address directly.

## Cross-Device Correlation: Deterministic and Probabilistic Linking Once devices are fingerprinted, trackers construct a device graph using either probabilistic methods (e.g., matching device names, IP addresses, location data) or deterministic methods (matching unique user account IDs like phone numbers and Apple IDs). The speakers highlighted multiple vulnerabilities allowing sandboxed apps to leak Apple IDs deterministically: - **CVE-2014-4423 (OS X):** Missing sandbox verification in `ACAccountStore` (`Accounts.framework`) allowed applications to bypass access restrictions and obtain active iCloud account IDs and metadata across applications via `com.apple.account.AppleAccount`. - **CVE-2017-6976 (iOS):** A flaw in the `appleidauthagent` XPC service allowed sandboxed apps to connect to the authentication expiry service and retrieve linked Apple ID account information using raw command bytes. - **Game Center Daemon (`gamed`) Zero-Day / Vulnerability:** Discovered by the researchers and patched in iOS 12.4, the Mach service `com.apple.gamed` lacked proper entitlement checks. Sandboxed apps could establish an NSXPC connection and call `getAccountNameWithHandler:` via `GameCenterFoundation.framework` to extract the logged-in Apple ID username. - **AirDrop Reconnaissance & Leakage:** AirDrop utilizes Bluetooth Low Energy and Apple Wireless Direct Link (AWDL) with `mDNSResponder` and an HTTP web server. Sandboxed apps interfacing with private APIs in `Sharing.framework` (such as `SFBrowserCreate` and `SFBrowserOpenNode`) can actively scan nearby AirDrop devices to harvest computer names, service names, IPv6 AWDL addresses, and hashes/plaintexts of Apple ID email addresses.