Apple: Airtag hacked, stalking said to be "frighteningly easy" to do

After various hardware modifications, an expert has now also been able to manipulate the software of the trackers. Moreover, stalking via the item trackers is "frighteningly easy".

Ten days after the official launch, security researcher Stack Smashing has managed to hack the accessory. He tweeted that he was able to break into the micro-controller and manipulate its software. The controller controls the device. For example, the German was able to change the NFC URL and make the item tracker open a different domain instead of the "find-my" website. A phishing page or similar could then be hidden behind it. Other specialists wonder about the fact that the firmware of the Airtags (test) is not encrypted. The hack is also called a jailbreak.

Airtag stalking too easy thanks to security weaknesses

Another report in recent days also criticized Apple's anti-stalking measures as inadequate. After testing them, Washington Post editor Geoffrey Fowler wrote, for example, "Airtags are a new tool for low-cost, effective stalking. [...] Apple's efforts are simply not enough." He had a colleague track his backpack for a day and described that it could find his whereabouts "with remarkable precision." The "stalker" also had his exact home address displayed, he said.

Turning off security alerts without identification.

There is criticism that three days is a long time to be tracked without your own knowledge. This time period only applies to Android users. During this time, a foreign stalker could have already tracked the target person to the home address or to another sensitive location. Furthermore, the speaker of the Airtags can be deactivated to bypass the acoustic warnings. In addition, the option in the associated app that turns off the warnings for a day is under criticism. It can be activated without having to enter a pin or other authentication. Critics are calling for the same pop-up warnings for Android users and a password or pin lock to turn them off.

Comments

Post a Comment

Popular posts from this blog

Chrome targeted by criminals: Why users need to update quickly now

A security vulnerability in Google Chrome is currently being exploited by cyber criminals. Malware could land on your PC through it. Read here how you can protect yourself. The Google Chrome browser is currently struggling with some security vulnerabilities. In a blog post , Google warns about a total of seven vulnerabilities, with the majority of these gaps being classified as a "high" threat to users. The vulnerabilities have been fixed in the latest version of Chrome for Windows, Linux and macOS. If you have Chrome version 90.0.4430.85 installed, it can no longer be exploited. If you have an older version of the browser installed, you should update urgently. You can find the download of the new version below these lines. Smartphone users do not have to be afraid of the security vulnerability. Google has not had to take any security measures here for the time being. The security vulnerability probably remained undiscovered by cyber criminals for the time being. So far, noth...
Read more

Face and voice recognition: Why TikTok wants to be allowed to collect biometric data in the USA

TikTok's privacy policy for the US now mentions the collection of biometric data from faces and voices. The background is likely to be a legal dispute that cost the company $92 million. Neue Datenschutzbestimmungen sind oft eher etwas für Juristen, doch die jüngste Aktualisierung von TikTok sollte alle Nutzerinnen und Nutzer in den USA aufhorchen lassen. Denn in den am 2. Juni aktualisierten Datenschutzbestimmungen für die USA ist ein Abschnitt enthalten, den es zuvor nicht gab. Er lautet übersetzt: »Wir sammeln möglicherweise biometrische Identifikationsmerkmale und biometrische Informationen, wie sie im US-Recht definiert sind, wie etwa von deinem Gesicht und deiner Stimme, aus deinen Inhalten.« Im englischsprachigen Original ist von »faceprint« und »voiceprint« die Rede. »Bevor wir damit anfangen«, frage man jedoch nach dem Einverständnis, wenn dies gesetzlich nötig sei, fügte noch TikTok hinzu. In response to an initial inquiry from "TechCrunch" about the ba...
Read more

Microsoft Teams, Zoom, WebEx: Berlin authority warns against popular video systems

After an initial data protection audit, some video service providers have made improvements to their offerings. But the Berlin data protection commissioner still sees serious shortcomings. The State Commissioner for Data Protection in Berlin (Germany), Maja Smoltczyk, advises against using leading video conferencing systems such as Microsoft Teams, Skype, Zoom, Google Meet, GoToMeeting, Teamviewer and Cisco WebEx. The reason is a retest of various offerings. After a number of services had already failed a test of data protection requirements last year, a new test of the major providers did not reveal any substantial improvement. Smoltczyk said that she was pleased "that our comments had persuaded so many providers to improve their offerings, in some cases very significantly, in terms of data protection". There are now enough legally compliant services for a wide range of purposes that there is no reason to break data protection law for video conferencing. However, if a provid...
Read more