Hacking the Apple AirTags
Thomas Roth (stacksmashing) glitches the Apple AirTag within days of release, dumping microcontroller firmware and re-flashing the device with custom Find My payloads.
Summary
The Architecture of Apple AirTags and the Find My Network
Apple AirTags integrate Ultra-Wideband (UWB) and Bluetooth Low Energy (BLE) microcontrollers to enable precision tracking through hundreds of millions of Apple devices.
Executing Power Fault Injection (Voltage Glitching)
Thomas Roth performs precision power glitching against the Nordic nRF52832 microcontroller during early boot, successfully bypassing Readback Protection (APPROTECT).
Dumping and Reverse Engineering AirTag Firmware
Dumping the internal flash memory allowed Roth to analyze Apple’s proprietary Find My protocol implementation and BLE advertisement beacon formats.
Flashing Custom Firmware onto AirTag Hardware
Roth demonstrates reprogramming the AirTag to modify broadcast beacon URLs, transforming the commercial tracker into a custom hardware beacon.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.