Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System
Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System
复制标题
谁可以找到我的设备？Apple 众包蓝牙位置跟踪系统的安全性和隐私性
DOI：
--
复制
发表时间：
2021
影响因子：
--
通讯作者：
M. Hollick
中科院分区：
文献类型：
--
作者：
A. Heinrich;Milan Stute;T. Kornhuber;M. Hollick
一夜之间，苹果公司将其数千万台设备的生态系统变成了世界上最大的众包位置跟踪网络，称为O~ine Finding（OF）。OF利用在线查找器设备使用蓝牙检测丢失的在线设备的存在，并通过互联网向所有者报告大致位置。虽然OF不是同类系统中的第一个，但它是第一个致力于强大隐私目标的系统。特别是，OF旨在确保发现者的匿名性、防止跟踪所有者设备以及位置报告的保密性。本文首次全面分析了OF的安全性和隐私性。为此，我们通过逆向工程的方式恢复的规范的闭源OF协议。我们的实验表明，未经授权的访问位置报告允许准确的设备跟踪和检索用户的顶部位置，在城市地区的误差在10米的顺序。虽然我们发现OF的设计实现了其隐私目标，但我们发现了两个不同的设计和实现缺陷，这些缺陷可能导致位置相关攻击和未经授权访问过去七天的位置历史，这可能会使用户匿名化。苹果已经部分解决了我们负责任披露后的问题。最后，我们将我们的研究成果公之于众。
Abstract Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.