2 min read

Beware poisoned Apple AirTags that exploit unpatched "Lost Mode" flaw

Graham CLULEY

September 30, 2021

Ad One product to protect all your devices, without slowing them down.
Free 90-day trial
Beware poisoned Apple AirTags that exploit unpatched "Lost Mode" flaw

If you're unlucky enough to mislay your Apple AirTag tracking device, or the item it is attached to, then never fear.  Apple AirTags have a feature that allows anyone who finds one to scan it with their smartphone, and be taken to information which lists the owner's phone number so your property can be returned to you.

That's very cool.  But what isn't cool is that the feature can be abused to deliver malware or steal credentials from the unwitting Good Samaritan who is trying to locate an AirTag's genuine owner.

Security researcher and penetration tester Bobby Rauch has shared details of the security flaw after failing to receive an adequate response from Apple.

As Rauch describes, Apple has so far ignored a security vulnerability in the "Lost Mode" functionality of AirTags which allows an attacker to weaponise the information displayed when the location-tracking device is scanned via near-field communication (NFC).

Someone who finds a lost AirTag and scans it with their smartphone finds themselves taken to a webpage at https://found.apple.com, containing custom instructions on how to contact the device's owner.

However, Apple has not prevented the planting of a malicious script in the phone number field by the AirTag's owner.  Cross-site scripting code planted in the phone number field could redirect visitors to a fake iCloud login page, or trick users into downloading a malicious app.

Rauch explains:

"Other XSS exploits can be carried out as well like session token hijacking, clickjacking, and more. An attacker can create weaponised AirTags and leave them around, victimising innocent people who are simply trying to help a person find their lost AirTag."

In short, the security failing could be exploited by a hacker to perform an equivalent attack to leaving malware-infected USB sticks lying around in the car park of a company they want to break into.

Sooner or later, someone will find the AirTag and attempt to scan it to find its true owner - and could end up having their credentials phished, or malware planted, as a result.

At the time of writing Apple has not patched the flaw, despite being informed about it by Rauch in June.  Until the problem is fixed, exercise caution when scanning lost AirTags, just in case a malicious hacker is attempting to trick you - a Good Samaritan - into handing over your iCloud passwords or installing malware.

tags


Author



Right now

Top posts

Abode IoT Security Camera Vulnerabilities Would Let Attackers Insert Images, Bitdefender Finds

Abode IoT Security Camera Vulnerabilities Would Let Attackers Insert Images, Bitdefender Finds

December 21, 2021

2 min read
Online Shoppers Beware, Mobile Scams Are on the Rise

Online Shoppers Beware, Mobile Scams Are on the Rise

December 17, 2021

2 min read
The Holiday Guide to Tech Support: Fixing the Family Computer

The Holiday Guide to Tech Support: Fixing the Family Computer

November 24, 2021

2 min read
Bitdefender Celebrates 20 Years of Cybersecurity Leadership

Bitdefender Celebrates 20 Years of Cybersecurity Leadership

November 04, 2021

3 min read
Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

Bitdefender Study Reveals How Consumers Like (and Dislike) Managing Passwords

October 26, 2021

3 min read
What are drive-by download attacks and how do you prevent them?

What are drive-by download attacks and how do you prevent them?

October 25, 2021

2 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Data of 500,000 already vulnerable people stolen from Red Cross Data of 500,000 already vulnerable people stolen from Red Cross
Radu CRAHMALIUC

January 20, 2022

1 min read
Printing Giant RR Donnelley Forced into Talks with Conti Ransomware Group to Stave Off Corporate Data Leak Printing Giant RR Donnelley Forced into Talks with Conti Ransomware Group to Stave Off Corporate Data Leak
Filip TRUȚĂ

January 20, 2022

1 min read
Top Five Security Tips for Mac Users in 2022 Top Five Security Tips for Mac Users in 2022
Filip TRUȚĂ

January 19, 2022

4 min read