Apple's AirTag tracker has already been hacked

An IT security researcher redirected the device’s finding feature to his own website

Apple’s AirTag has only been out for around a week, but it’s already been hacked.

A German cyber security researcher cracked the AirTag’s microcontroller, the tiny integrated circuit that controls the device. 

The AirTag, a small locator that retails for $29, can help you find your car keys or anything else it’s attached to. Normally, when you use your phone to find an AirTag, your phone opens in the “Find My” website at found.apple.com to initiate the “Lost Mode” process. However, the researcher found he could redirect the microcontroller to his personal website instead.

Security researcher Thomas Roth, who goes by the name Stack Smashing, posted a video of the process to Twitter, and wrote: “After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag."

This means hackers could potentially direct hacked AirTags to phishing or malware sites, and it remains to be seen whether Apple will implement some mechanism to block this sort of attack.

Although this sounds alarming, the tech review website SlashGear cautions that even if a hacker can reprogram an AirTag, “the process and the end result might not yet be worth the worry.”

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastDownload now

“The security researcher hasn’t disclosed yet the process but he admits bricking at least two AirTags to get there,” SlashGear noted. “Unless the tracker’s firmware can be modified remotely over the air, the only way you’ll get a hacked AirTag would be if you acquired it through other parties.”

As always, there are proactive ways to avoid falling victim to phishing and malware campaigns like this. When you navigate to a site, always verify the URL looks exactly as you expect. Many times, these spoofed sites will have one character off or a different domain extension. 

If you see anything suspicious in the link, close the browser, open a fresh browser and navigate to your target site by typing it manually into the URL bar.

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
Apple doubles down in the US with $430 billion investment
business intelligence (BI)

Apple doubles down in the US with $430 billion investment

27 Apr 2021
Apple patches iOS 12 after hackers exploit WebKit Engine flaws
zero-day exploit

Apple patches iOS 12 after hackers exploit WebKit Engine flaws

15 Jun 2021

Most Popular

Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Fastly blames software bug for major outage
public cloud

Fastly blames software bug for major outage

9 Jun 2021
GitHub to prohibit code that’s used in active attacks
cyber security

GitHub to prohibit code that’s used in active attacks

7 Jun 2021