OpenHaystack is an open-source framework developed by the Secure Mobile Networking Lab of TU Darmstadt that allows users to create custom Bluetooth tracking tags leveraging Apple's extensive Find My network. The project stemmed from reverse-engineering and security analysis of Apple's offline finding system, identifying how devices can be located even when offline through a clever combination of Bluetooth advertisements, public-key cryptography, and a central encrypted database. OpenHaystack comprises a macOS application, which retrieves and decrypts location reports via a custom Apple Mail plugin, and firmware deployable to various Bluetooth-capable devices (e.g., BBC micro:bit, ESP32). While a severe vulnerability found during analysis was fixed by Apple, OpenHaystack remains experimental. A mobile version (OpenHaystack Mobile) is also available, though it requires a Mac-hosted proxy server for report fetching.
Summarizing OpenHaystack: Building Custom Find My Trackers
What is OpenHaystack?
OpenHaystack is a framework that enables users to create their own tracking tags, utilizing Apple's vast "Find My" network for tracking personal Bluetooth devices anywhere without cellular coverage.
It consists of a macOS application to display device locations and firmware that allows Bluetooth devices to broadcast beacons discoverable by iPhones.
Project History and Security Analysis:
The project is a result of reverse-engineering and security analysis of Apple's Find My network, specifically its offline finding capabilities.
Researchers identified how Apple devices can be found when offline, involving Bluetooth advertisements, public-key cryptography, and a central database of encrypted location reports.
Two vulnerabilities were found, with a severe one (CVE-2020-9986, allowing malicious app access to location data) subsequently fixed by Apple.
Disclaimer and Limitations:
OpenHaystack is experimental, untested, and incomplete software.
Current firmware broadcasts a fixed public key, meaning accessories are trackable by other devices in proximity.
It is not affiliated with or endorsed by Apple Inc.
System Requirements and Installation:
Requires macOS 11 (Big Sur).
Installation involves a custom Apple Mail plugin (used to access Apple's private API for location reports), which requires temporarily disabling Gatekeeper and activating the plugin in Mail preferences.
How Apple's Find My Network is Leveraged:
Pairing: A public-private key pair (P-224 elliptic curve) is generated, with the private key stored securely on the Mac and the public key deployed on the accessory.
Losing/Broadcasting: Accessories broadcast their public key as Bluetooth Low Energy (BLE) advertisements. Nearby iPhones cannot distinguish these from genuine Apple devices/accessories.
Finding/Uploading: iPhones (iOS 13 or newer) receiving an advertisement encrypt their current GPS location using the accessory's public key and upload the report to Apple's servers.
Searching/Retrieving: OpenHaystack leverages this system by downloading these end-to-end encrypted reports (requiring Mail to be open for authentication) and decrypting them with the private key to display the device's most recent location on a map.
Supported Devices:
The firmware can be deployed to specific embedded devices like the BBC micro:bit v1 and Espressif ESP32 (via USB deployment through the app).
Linux devices are supported via a generic HCI script.
OpenHaystack Mobile:
A complete reimplementation for smartphones (Android and iOS) using Flutter.
The mobile app requires a proxy server hosted on Mac hardware to fetch location reports, as direct fetching on the smartphone is not possible.
Key Takeaway: OpenHaystack offers a unique open-source solution for personal Bluetooth tracking by cleverly integrating with and replicating the behavior of Apple's existing crowd-sourced Find My network.