Beware poisoned Apple AirTags that exploit unpatched "Lost Mode" flaw
If you're unlucky enough to mislay your Apple AirTag tracking device, or the item it is attached to, then never fear. Apple AirTags have a feature that allows anyone who finds one to scan it with their smartphone, and be taken to information which lists the owner's phone number so your property can be returned to you.
That's very cool. But what isn't cool is that the feature can be abused to deliver malware or steal credentials from the unwitting Good Samaritan who is trying to locate an AirTag's genuine owner.
Security researcher and penetration tester Bobby Rauch has shared details of the security flaw after failing to receive an adequate response from Apple.
As Rauch describes, Apple has so far ignored a security vulnerability in the "Lost Mode" functionality of AirTags which allows an attacker to weaponise the information displayed when the location-tracking device is scanned via near-field communication (NFC).
Someone who finds a lost AirTag and scans it with their smartphone finds themselves taken to a webpage at https://found.apple.com, containing custom instructions on how to contact the device's owner.
However, Apple has not prevented the planting of a malicious script in the phone number field by the AirTag's owner. Cross-site scripting code planted in the phone number field could redirect visitors to a fake iCloud login page, or trick users into downloading a malicious app.
"Other XSS exploits can be carried out as well like session token hijacking, clickjacking, and more. An attacker can create weaponised AirTags and leave them around, victimising innocent people who are simply trying to help a person find their lost AirTag."
In short, the security failing could be exploited by a hacker to perform an equivalent attack to leaving malware-infected USB sticks lying around in the car park of a company they want to break into.
Sooner or later, someone will find the AirTag and attempt to scan it to find its true owner - and could end up having their credentials phished, or malware planted, as a result.
At the time of writing Apple has not patched the flaw, despite being informed about it by Rauch in June. Until the problem is fixed, exercise caution when scanning lost AirTags, just in case a malicious hacker is attempting to trick you - a Good Samaritan - into handing over your iCloud passwords or installing malware.
Ultimate Privacy Guide for Your Facebook Account
August 31, 2021
7 Signs It’s Time to Use Parental Controls On Your Family’s Devices
August 27, 2021
Your Netflix Account May Be on Sale on Darkweb. Protect It
August 13, 2021
Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US
July 16, 2021
How to protect yourself against cyberstalking
July 06, 2021