Skip to main content
LiMP VPN
ENRU
Try it
← All news

Linux Enrolled in Apple Find My — Your Location Data at Risk

Emily ParkerEmily ParkerContent & SEO Specialist
Linux Enrolled in Apple Find My — Your Location Data at Risk

In short: A 22-year-old researcher known as Zerotistic enrolled a standard Linux computer into Apple's closed Find My network in under a week, gaining real-time access to the location data of people who had shared their coordinates via the service. The barriers keeping Find My Apple-only are software policies — not hardware constraints.

What Happened

On August 20, 2026, The Register published research by a security enthusiast known as Zerotistic (22 years old). He accomplished what Apple implicitly markets as impossible: enrolling a Linux device into the Find My infrastructure — a platform designed exclusively for macOS, iOS, watchOS, and iPadOS.

Find My is Apple's global tracking network spanning more than 1.5 billion devices. Apple positions it as a privacy-first, closed ecosystem where encrypted location data is accessible only to the account owner and explicitly trusted contacts. The researcher demonstrated that the wall between Apple's ecosystem and the outside world is a software policy, not a hardware impossibility. Understanding where real privacy protections actually live is critical for users who rely on these systems.

How the Technique Works

Zerotistic spent less than a week reverse-engineering Apple's closed protocols. The key steps:

  1. GrandSlam authentication. The researcher completed a standard Apple ID login via the GrandSlam protocol — the same flow used by iPhones and Macs.
  2. Custom certificate signing request (CSR). Rather than relying on an Apple T2 chip or Secure Enclave, Zerotistic crafted a PKCS#10 CSR with a 2048-bit RSA key and SHA-1 signature — standard cryptography, no Apple silicon required.
  3. IDS device certificate. Submitting the CSR to Apple Identity Services' authenticateDS endpoint returned an official certificate linking the Linux machine to the researcher's Apple account.
  4. Find My subservice enrollment. The Linux device subscribed to six Find My subservices, becoming a recognized participant in Apple's network.
  5. SubscribeAndFetch API call. This request retrieved the same encrypted location messages that a real iPhone would receive.
  6. Location decryption. Zerotistic wrote a Linux script to unpack Apple Push Notification Service messages, extract decryption keys, and decode plaintext coordinates, timestamps, and accuracy readings.

Result: a standard Linux laptop functioned as a full Find My client, receiving real-time location data from people in the researcher's network.

What This Means in Practice

One key clarification: this technique does not enable arbitrary tracking of iPhone users without their knowledge. It only works for location data someone has voluntarily chosen to share with the researcher's Apple account.

However, the real-world risk surfaces in several concrete scenarios:

  • Compromised Apple ID. If an attacker gains access to an Apple account, they inherit all location-sharing permissions attached to it — readable from any device, including Linux, without the victim noticing.
  • Corporate or domestic surveillance. Anyone with "legitimate" shared Find My access through Family Sharing or workplace arrangements could silently extract live location data from unrecognized hardware.
  • Social engineering. An attacker could convince a target to "temporarily share" their location, then harvest that data indefinitely through a Linux client.

More broadly, the research challenges Apple's implicit claim that Find My restrictions are hardware-based. With that assumption disproven, the research community probing alternative bypass paths is likely to grow. Reviewing your active sharing permissions and using encrypted connections are practical first-line defenses.

Apple's Response

As of The Register's August 20, 2026 publication, Apple had not released an emergency patch and did not officially comment on the findings. Technically, Zerotistic used a legitimate Apple ID and standard public-facing APIs — simply from non-Apple hardware. Apple has been aware of community interest in Find My protocols since the OpenHaystack project in 2021 and the nRootTag vulnerability disclosure in 2025, making targeted API adjustments each time without redesigning the core architecture.

How to Protect Your Location Data

This research is a practical prompt to audit your Find My sharing settings:

  • Review who can see your location in the Find My app → People tab. Remove contacts you no longer actively trust with real-time access to your coordinates.
  • Enable two-factor authentication on your Apple ID. If someone you've shared location with has their account compromised, the attacker inherits your location data too.
  • Use time-limited sharing — Apple offers "Share for One Hour" and "Share Until End of Day." Prefer these over indefinite access.
  • Keep iOS and macOS updated. Apple periodically tightens Find My API controls; staying current narrows the potential attack surface.

At the network layer, Find My traffic is encrypted by the protocol itself. However, metadata about your connections — when and how often your device contacts Apple's servers — can be visible to your ISP. LiMP VPN encrypts this layer and reduces passive profiling of your network behavior.

Sources

← All news
Linux Enrolled in Apple Find My — Your Location Data at Risk