Defeat air-gapped systems by exfiltrating data using Apple Find My network(github.com)

21 pointsby austinallegro10 hours ago2 comments

buibuibui4 hours ago
Very interesting. What's the max payload size we can transfer with this setup?
ano-ther6 hours ago
This looks like a custom Airtag which is great — but I cannot find where it exfiltrates data from an air-gapped system.
What did I overlook?
- tiagod5 hours ago
  Looking at the code, looks like it advertises under a different private key for each bit in each message.
  https://github.com/HouzuoGuo/hzgl-air-bridge/blob/master/web...
- ButlerianJihad4 hours ago
  In this age of NFC, WiFi, BT, RFID, and everything in between, I am really not sure that the elite security concept of “air-gapping” is even meaningful or useful anymore.
  - gunalx2 hours ago
    Just because a measure is less useful doesn't mean it is useless. There is always a compromise between convince and security and in this case one would have to do even more screening (less convince) for the same security level. Even if airgaps like before increases effort needed for exfiltration.
    ButlerianJihad32 minutes ago
    Look, in the corporate/enterprise world, I am sure that it's still possible to purchase devices and machines that literally have no receiving or transmitting radios at all. But that feat is no longer possible for consumers.
    At home, on the go, any device I purchase is basically bristling with radio transceivers, whether it's a dishwasher, refrigerator, smartphone, printer, or whatever. It seems that radio-based connectivity has been established by Divine Mandate.
    It really gets me down, because wired Ethernet is far more reliable and secure, and those features are exactly why nobody wants consumers to have reliable or secure connectivity. I recently purchased an enterprise-class HP LaserJet that has no radios in it, but it is also not even compatible with the consumer OSes that I use at home!
    If a device has a radio in it, and that radio is fully software-controlled, it's literally impossible to "air-gap" the device, short of performing surgery on it. This is my point: that for ancient technology, "air-gapping" was a meaningful practice, because if you didn't connect the cables, connectivity was impossible. In today's world of ubiquitous radio connectivity, my 5G reception in the middle of a cemetery on a Saturday afternoon is, unfortunately, crystal clear.
    https://m.xkcd.com/416/