The Apple AirTag has a flaw that lets anyone infuse malicious code into it. This can cause phishing attacks and stalking. This bug has the potential to impact millions of users and is worth investigating. You can learn more about the security issues with AirTag by reading on.
XSS flaw in Apple’s AirTags
Apple’s AirTag product is prone to an XSS flaw that could be exploited by hackers. This flaw could redirect users to malicious web pages. While Apple has not yet released a patch for this vulnerability, the flaw is a huge security concern for anyone who uses the AirTags. This vulnerability is particularly problematic because AirTags can store arbitrary data, which attackers could exploit to gain access to sensitive data.
The flaw can be exploited to target the Lost Mode feature of AirTags. In this mode, an AirTag generates a URL that contains contact information for its owner. When a loser scans this URL, they can contact the owner via email or phone number. Unfortunately, the vulnerability can be used to compromise these links and trick good Samaritans into giving out their personal information.
This flaw can be exploited by placing malicious scripts in the phone number field. Then, the attacker can redirect the user to a fake iCloud login page, or trick them to download a malicious app. The security researcher has publicly reported the bug, but Apple has not yet acknowledged it.
The researcher first notified Apple of the problem on June 20th, but the company did not act quickly. The company responded slowly and sent replies about specialists working on the bug. Furthermore, Apple did not provide any answers to the researcher’s requests for credit for discovering the vulnerability. Ultimately, Rauch published the details of the flaw in the public domain.
This vulnerability is the result of a flaw in the Lost Mode functionality of Apple’s AirTags. In addition, an attacker could seed the device with arbitrary computer code, and use this to harvest iCloud credentials. AirTags are battery-powered devices designed to locate misplaced items.
While Apple has not publicly responded to the flaw, the company has a bug bounty program that can reward researchers for reporting it. The reward is up to $1 million. Although this is a major reward, the company has been reluctant to publicly acknowledge a large number of software flaws.
Because most mobile users have installed banking applications on their devices, this flaw is potentially dangerous for them. Fraudsters can use the flaw to send fake messages or make users visit phishing sites. It can also be used to hijack session tokens. Hence, it is important to avoid any malicious activity using the exploited Apple AirTags.
Potential for phishing attacks
The Apple AirTag bug opens the door for phishing attacks. The feature allows the owner of an AirTag to inject arbitrary code into the phone number field on the URL of the device to send its finder to a phishing website. This enables the attacker to steal credentials and personal information from the victim. It is also possible for malicious people to buy AirTags and turn them into malicious trojans.
Hackers can weaponize AirTags by injecting malicious URLs into the phone number field, which would then redirect the user to a malicious iCloud login page. The user then unwittingly enters their iCloud credentials on the fake site, enabling the attacker to obtain juicy data. People are prone to reusing passwords across multiple services, making this vulnerability particularly dangerous.
Because the Apple AirTag is very small and can be attached to items that are easily lost, it can be abused to send malicious SMS messages to a recipient. Alternatively, a malicious website can use a weaponized AirTag to direct a “Good Samaritan” to a phishing website.
A zero-day exploit for the AirTag was recently discovered. According to an independent security researcher, the exploit enables arbitrary computer code to be injected into the phone number field of an AirTag. This could potentially allow attackers to hijack credentials and steal tokens.
Apple’s newest iOS update will fix this bug, but it hasn’t yet released the patch. Until Apple fixes this vulnerability, it’s not safe for users to rely on AirTags for their personal data. In the meantime, they should leave them alone if they see them in public.
A security researcher revealed the bug to Apple privately on June 20. Apple has since said it’s investigating the vulnerability. The researcher has now published his findings online. He says it is a relatively easy bug to reproduce. This vulnerability has been known to allow for malicious phishing websites to gather data and use it to perform phishing attacks.
Apple has a history of lax response to security issues. While Apple claims it cares about its security, ignoring these bugs only harms users. Inaction leaves victims vulnerable to attacks. Therefore, the vendor needs to be explicit about when it plans to fix this issue.
Potential for stalking
The potential for stalking when Apple AirTags enable good is real, and the tech giant should take steps to prevent it. Despite the fact that AirTags are inexpensive and effective, they can be easily tracked by GPS-based stalkers, who can buy these devices on Amazon. Because of this, it is important for police departments to have an anti-stalking mechanism ready. Tile, one of the leading competitors to AirTags, does not yet offer such a feature, but it has promised to implement one in early 2022.
Apple has taken several precautions to combat the risk of stalking, including alerts that appear on the victim’s device and an audible alert on the tag. However, these safeguards can be circumvented. The victim can place the tag on her person and regularly reconnect it to the stalker’s device, so that it will trigger the alerts. This can be done by returning home within range of the stalker, but it also allows abusive partners to circumvent the alerts.
The downside of the AirTag bug is that it only works after 8 hours of the victim leaving their phone. This means that in a situation of intimate partner abuse, where the victim has no way to escape, this technology will not help. If the stalker is in contact with the victim frequently, a few hours may be enough for him or her to catch them.
Although Apple has partnered with law enforcement to trace the misuse of AirTags, a lingering concern is that it could be used by stalkers to track the victims. Though they have worked to develop an anti-tracker app for iOS, this is not yet ready for the public.
The AirTag is a simple device that connects to an iPhone to track personal items. It is easy to use, and it can be a great way to find lost items. However, the fact that it can connect to millions of iOS devices means that it is also a potential stalking tool.
