Apple's latest AirTag tracking accessory was unveiled just over two weeks ago at the Spring Loaded case, and the first shipments just started arriving in the hands of early adopters last weekend.
Hackers may be able to change the firmware of the latest Apple AirTag by exploiting security flaws in the system. Despite the fact that the product is still relatively new, it appears that Apple's latest AirTag has already been hacked by brilliant minds in the security research sector.
Apple launched the latest AirTag to help people track down missing products. According to a Tweet, a German cybersecurity researcher has hacked Apple's Bluetooth-enabled tracker, which is a first for the device. The researcher allegedly hacked the latest AirTag microcontroller using reverse engineering.
What actually happened
We learned that a user successfully broke into an AirTag's microcontroller in a brief teaser posted just this weekend on Twitter by IT security researcher Thomas Roth, also known as "stacksmashing" (@ghidraninja):
"Yesssss!!! After hours of trying (& bricking 2 AirTags) I finally managed to break into the microcontroller of the AirTag!"
The researcher claims that the hack enabled the AirTag's firmware to be dumped in a series of follow-up Tweets. Furthermore, it appears that the microcontroller can be flashed and that the NFC URL that appears in AirTag notifications can be changed to send custom messages to nearby iPhones.
It's important to remember that the AirTag is a small system in and of itself. With that in mind, a hacked AirTag's capabilities will be constrained as well. It's also worth remembering how difficult it is to hack an AirTag in the first place.
The logic board of the AirTag appears to have had to be gutted from its shell and wired to another board in order to tap into specific parts of the system, as seen in the photographs.
It's unclear what else a hacked AirTag might do, but one possibility is to change the actions of a simple AirTag to show the same specific animations as those included with the more costly Hermès-branded accessories. However, this is all conjecture.
Conclusion
When searched by an NFC-capable smartphone, an AirTag in Lost Mode normally shows a notification with a connection to the found.apple.com website, which displays information about the owner.
Hackers may take advantage of the flaws highlighted by the Twitter user.
At the time of the AirTag's official release last month, Apple stated that privacy and protection were two of the device's most important features. We'll have to see how Apple reacts to the allegation.
We anticipate hearing further as the investigation progresses. We'll keep you, our dear readers, updated if anything comes up that could be of interest to the general public.
