A security researcher discovered that Apple’s AirTag can be hacked.
German security researcher known as “Stack Smashing” tweeted that he was was able to “break into the microcontroller of the AirTag” and modified elements of the item tracker software by reverse-engineering its microcontroller, reads a new report from 9to5Mac.
The tweet thread, which was first published by The 8-Bit on Saturday, contains some information about the researcher’s investigation of the unit.
“German security researcher and YouTube content creator that goes by the name Stack Smashing tweeted today that they were successful in ‘breaking into the microcontroller of the AirTag,'” reads the report. “They were then able to re-flash the microcontroller that enabled them to modify elements of AirTag’s software.”
After gaining control over the microcontroller, the researcher tweaked the URL that appears within a notification when an AirTag in the Lost Mode is tapped on by an NFC-enabled device.
Instead of Apple’s Find My website, the researcher uses his hacked AirTag to spit out a different URL, which can reportedly be used for phishing or for delivering any kind of malware.
Since the researcher says the device can be re-flashed, changing the NFC URL is perhaps just the first and the simplest demonstration of what bad actors can do with a jailbroken AirTag tracker.
It’s unclear as of now what security measures Apple has in place to avoid this from happening, although it’s possible that the Cupertino company could prevent this from happening with the next AirTag firmware update.
