openhaystack-is-a-new-open-source-tool-that-lets-you-create-diy-airtags-on-apple’s-find-my-network

OpenHaystack is a new open-source tool that lets you create DIY AirTags on Apple’s Find My network

Apple has promised to open up its Find My app to third-party accessory makers. But ahead of that, there’s a new tool that will let anybody make their own Bluetooth tracking tag to use with the Find My network so they can track its location. OpenHaystack is a new open-source tool developed by security researchers at the Secure Mobile Networking Lab, who have essentially reverse-engineered the way Apple devices register themselves to the Find My mesh network.

It is, in short, a way to create your own DIY AirTags today.

OpenHaystack works via a custom Mac app that can be used to track the location of custom tags that you create. As of right now, the tool has direct support to make a tracking tag using the BBC micro:bit mini computer, though other Bluetooth Low Energy (BLE) device support could be added by other developers in the future. Once registered on Apple’s Find My network, the OpenHaystack app will be able to report the tag’s location just like Apple’s Find My app works for iPhones and other Apple devices.

The whole system is a bit of a hack — in the sense that it’s complex, not in the sense that it’s actually hacking anything. It uses a plugin for Apple Mail (which authenticates you as a genuine Apple user) to get the necessary access to Apple’s Find My network to create and locate the keys — so Mail needs to be running for OpenHaystack to work.

There don’t appear to be serious security implications for the Find My network itself, either (though the team has submitted other bug reports to Apple). That doesn’t mean you should just go ahead and start using OpenHaystack, however. There’s an important disclaimer on the project:

OpenHaystack is experimental software. The code is untested and incomplete. For example, OpenHaystack tags using our firmware broadcast a fixed public key and, therefore, are trackable by other devices in proximity (this might change in a future release). OpenHaystack is not affiliated with or endorsed by Apple Inc.

A high-level understanding of how the security model for Find My works also helps understand why OpenHaystack is possible.

Find My works by using a combination of public and private keys. Any Apple user can access the public keys for devices in the Find My network, but you need the private key in order to actually access location information. This means not even Apple can access your location information without your private keys. The network is possible because Apple devices communally track the public keys, but only users can get location data from private keys.

How OpenHaystack gets on the Find My network.
Image: OpenHaystack

What OpenHaystack does is create one of those public / private key pairs for your own Bluetooth tag and uses Apple Mail to register it in the Find My network. To Apple, it just looks like another iPhone. The Mac app then accesses the public key database, pairs it with the private key you created, and bam: secure location data.

From the way it’s designed, it seems like it might be difficult for Apple to cut off OpenHaystack easily without also cutting off a bunch of older Apple devices. However, it’s also surely true that Apple as a company won’t like the whole thing and may try to find a way to block it. A developer could use the system to create a way to add Android devices to the Find My network.

The team behind OpenHaystack has written a paper detailing its methods and disclosing a now-fixed security flaw. It also released the source code for its firmware, which other developers could use to adapt OpenHaystack to other BLE devices.

Apple’s official support for third-party accessories is still coming. Belkin has already announced a set of earbuds that will support Find My. Given how complex the setup of OpenHaystack is, it probably won’t gain mass adoption. It’s similar in some ways to AirMessage and Beeper, two tools that use Mac utilities to redirect iMessages to Android devices. Apple’s ecosystem is locked down in any number of ways, but the Mac finds a way.

youtuber-builds-m1-equipped-imac

YouTuber Builds M1-Equipped iMac

(Image credit: Luke Miani)

Apple said it expects to switch the entire Mac product line over to its own silicon by the end of 2022. YouTuber Luke Miani didn’t want to wait that long for the company to update the iMac, however, so he decided to build one with an M1 chip himself.

Miani started with an iMac that he “completely fried” in 2018 and a new Mac mini. From there all he needed was a bevy of tools from iFixIt—which sponsored the video—and a converter that allowed the iMac to be used as an external monitor.

The resulting DIY Mac had some limitations. It suffered from poor wireless connectivity, lacked any ports, and could only be turned on by removing the display. Some of those issues could be worked around with more extensive mods, however.

Should most people attempt mods like this? Probably not. It would be easier to simply use the iMac as an external monitor, and for anyone who doesn’t have an iMac just lying around, buying an actual monitor would be even better still.

But it’s not hard to see the appeal of an iMac featuring Apple silicon. The M1-equipped MacBook Pro offers better performance than the latest iMac in a variety of benchmarks despite being much smaller and using significantly less power.

Bloomberg reported in January that Apple plans to release a redesigned iMac later this year. These new models would reportedly feature “a design similar to Apple’s Pro Display XDR monitor” with ”a flat back” instead of the curved one used today.

The report said the new iMac would feature Apple silicon, too, but didn’t specifically name the M1 chip. Perhaps the company will use the extra space in the iMac’s case for a chip that supports additional ports and offers even greater performance.

Or maybe it will just cram more of the so-called Fusion Drives—hybrid drives that offer a small amount of SSD-based storage to complement larger HDDs—even though it’s 2021. Miani’s video showed there will be plenty of space for them.