IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Apple's AirTag tracker has already been hacked

An IT security researcher redirected the device’s finding feature to his own website

Apple’s AirTag has only been out for around a week, but it’s already been hacked.

A German cyber security researcher cracked the AirTag’s microcontroller, the tiny integrated circuit that controls the device. 

The AirTag, a small locator that retails for $29, can help you find your car keys or anything else it’s attached to. Normally, when you use your phone to find an AirTag, your phone opens in the “Find My” website at found.apple.com to initiate the “Lost Mode” process. However, the researcher found he could redirect the microcontroller to his personal website instead.

Security researcher Thomas Roth, who goes by the name Stack Smashing, posted a video of the process to Twitter, and wrote: “After hours of trying (and bricking 2 AirTags) I managed to break into the microcontroller of the AirTag."

This means hackers could potentially direct hacked AirTags to phishing or malware sites, and it remains to be seen whether Apple will implement some mechanism to block this sort of attack.

Although this sounds alarming, the tech review website SlashGear cautions that even if a hacker can reprogram an AirTag, “the process and the end result might not yet be worth the worry.”

Related Resource

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Prevent fraud and phishing attacks with DMARC - whitepaper from MimecastFree download

“The security researcher hasn’t disclosed yet the process but he admits bricking at least two AirTags to get there,” SlashGear noted. “Unless the tracker’s firmware can be modified remotely over the air, the only way you’ll get a hacked AirTag would be if you acquired it through other parties.”

As always, there are proactive ways to avoid falling victim to phishing and malware campaigns like this. When you navigate to a site, always verify the URL looks exactly as you expect. Many times, these spoofed sites will have one character off or a different domain extension. 

If you see anything suspicious in the link, close the browser, open a fresh browser and navigate to your target site by typing it manually into the URL bar.

Featured Resources

Big data for finance

How to leverage big data analytics and AI in the finance sector

Free Download

Ten critical factors for cloud analytics success

Cloud-native, intelligent, and automated data management strategies to accelerate time to value and ROI

Free Download

Remove barriers and reconnect with your customers

The $260 billion dollar friction problem businesses don't know they have

Free Download

The future of work is already here. Now’s the time to secure it.

Robust security to protect and enable your business

Free Download

Recommended

Apple patches yet another zero-day flaw in substantial security update
zero-day exploit

Apple patches yet another zero-day flaw in substantial security update

13 Sep 2022
Apple breaks update policy to secure older iPhones and iPads against zero-day
zero-day exploit

Apple breaks update policy to secure older iPhones and iPads against zero-day

1 Sep 2022
Apple expands Xcode Cloud platform with launch of paid subscriptions
software development

Apple expands Xcode Cloud platform with launch of paid subscriptions

31 Aug 2022
Escape the ransomware maze
Whitepaper

Escape the ransomware maze

23 Aug 2022

Most Popular

The human brain is far more complex than AI researchers imagine
artificial intelligence (AI)

The human brain is far more complex than AI researchers imagine

17 Sep 2022
How to secure your hybrid workforce
Advertisement Feature

How to secure your hybrid workforce

23 Sep 2022
What your hybrid workforce needs from their laptops
Advertisement Feature

What your hybrid workforce needs from their laptops

21 Sep 2022