Exfiltrating Data from Air-Gapped Systems via Apple's Find My Network: Attack Mechanics and Defense Insights

Air-Gapping Is Not Absolute Security

In the field of cybersecurity, air-gapped systems have long been regarded as the "ultimate fortress" for protecting critical infrastructure. Such systems are completely disconnected from the internet and any external networks, and are widely deployed in highly sensitive scenarios such as military, energy, financial, and industrial control settings. In theory, no network connection means data cannot be stolen remotely.

The concept of the air gap originated from military communications security practices during the Cold War. Its core idea is to prevent information leakage by completely severing physical connections. After the Cold War, with the large-scale deployment of programmable logic controllers (PLCs) and SCADA systems in industries such as power, water, and nuclear energy, the air-gapping strategy expanded from the military communications domain to the industrial control systems (ICS) security domain, and gradually evolved into an almost religious security tenet. This evolution profoundly shaped the security design paradigm of critical infrastructure worldwide—air-gapping gradually solidified from a technical option into a compliance requirement, objectively creating a serious path dependency: many organizations began to view air-gapping as the endpoint of security rather than the starting point, neglecting the necessity of implementing defense in depth within the isolation boundary. The U.S. National Institute of Standards and Technology (NIST), in its SP 800-82 Guide to Industrial Control Systems Security, lists air-gapping as a foundational requirement for the highest security level (SL-4), further reinforcing the industry's reliance on this defensive measure at an institutional level.

However, the most famous air-gapped attack case in history—the Stuxnet worm of 2010—has already proven that this defensive strategy is not an impenetrable wall. Stuxnet infiltrated the industrial control systems of Iran's Natanz nuclear facility via infected USB drives, ultimately causing the physical destruction of approximately 1,000 centrifuges. In the aftermath of the Stuxnet incident, the U.S. Department of Homeland Security (DHS) and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) successively released dedicated security guidelines for air-gapped systems, and the security community's understanding of the proposition that "air-gapping ≠ absolute security" began to spread from academic circles to the practical level. Since then, security researchers have successively discovered various side-channel attack techniques targeting isolated systems, including highly creative channels that exploit hard disk LED lights (AirHopper), fan noise (Fansmitter), power line fluctuations (PowerHammer), and even keyboard electromagnetic radiation (TEMPEST). Together, these studies reveal a profound systemic problem: any computing device with a physical presence will inevitably exchange energy with the external environment in various forms, and these exchanges can, in principle, all become channels for information leakage.

It is worth noting that the reason these side-channel attack techniques have long remained at the academic level is due in part to their reliance on physical proximity and dedicated receiving equipment—attackers typically need to deploy sensors near the target facility, which carries a very high risk of exposure. However, the novel attack technique introduced in this article completely breaks through this limitation.

A new study reveals an ingenious attack method: using Apple's Find My network as a covert data exfiltration channel to successfully steal data from air-gapped systems. This discovery once again confirms an iron rule of security research—there is no absolutely secure system, only attack surfaces that have not yet been discovered.

The Find My Network: An Invisible Data Relay Covering the Globe

How the Find My Network Works

Apple's Find My network is essentially a crowdsourced positioning network composed of hundreds of millions of Apple devices worldwide (iPhone, iPad, Mac, etc.). When an AirTag or a Find My-enabled device is lost, it broadcasts an encrypted signal via Bluetooth Low Energy (BLE). Any nearby Apple device that receives this signal will anonymously upload the location information to Apple's cloud servers, allowing the owner to locate the lost item accordingly.

The key characteristic of this mechanism is that the target device does not need to be connected to the internet, and the receiving party does not need to actively participate. Any Apple device that happens to pass by will automatically complete the relay and upload of the data—and this is precisely the characteristic that attackers exploit.

It is worth taking a deeper look at how Bluetooth Low Energy (BLE) itself works. BLE is an important feature introduced with the Bluetooth 4.0 standard in 2010, designed specifically for power-sensitive scenarios such as IoT and wearable devices. Unlike classic Bluetooth, BLE uses the Advertising mechanism as its core communication mode: a device can continuously broadcast data packets to all surrounding devices without needing to pair or connect, with a coverage range of up to 100 meters. Each BLE advertising packet has a maximum payload of 31 bytes (extended to 255 bytes in BLE 5.0), containing device identifiers, signal type, and custom data fields. It is precisely this customizable data field that lays the foundation for how the Find My network works, and it also provides the carrier for the attack technique described in this article.

Another key characteristic of BLE is that its operating frequency band (the 2.4GHz ISM band) overlaps with Wi-Fi, which means that in many air-gapped environments where Wi-Fi is "disabled," Bluetooth hardware is often retained as well, forming a systematically overlooked attack surface. Even more noteworthy is that in modern laptops and embedded industrial computers, Wi-Fi and Bluetooth functions are usually integrated onto the same combo chip—typical examples being the Broadcom BCM series and the Intel AX series of wireless network cards. This means that even if only Bluetooth is enabled at the software level, the underlying 2.4GHz RF hardware is still operating. This hardware architecture characteristic means that the common security strategy of "disabling Wi-Fi but retaining Bluetooth" has a fundamental flaw—the two wireless capabilities share the same analog front-end circuitry, and the functional partitioning at the software level cannot physically eliminate RF transmission capability, providing an objective condition for the generation of side-channel signals.

When designing the Find My network, Apple also adopted a rolling key scheme based on elliptic curve cryptography (ECC) to protect user privacy. Every 15 minutes, the broadcast key of each device automatically rotates, and the current key cannot be correlated by third parties to the historical locations of the same device. Relay devices (such as a passerby's iPhone) can only see the encrypted location report and cannot know which device sent the request, nor can they access the location data itself—this is a carefully designed differential privacy architecture. Specifically, Apple uses an asymmetric encryption scheme based on the P-224 elliptic curve: the AirTag generates a public-private key pair locally, sends the public key out as the broadcast payload, nearby iPhones use this public key to encrypt GPS coordinates before uploading them to the server, and only the device owner holding the corresponding private key can decrypt the location information. This design means that even Apple's servers cannot interpret the stored location data, achieving a privacy guarantee of "even the service provider doesn't know where you are" from a cryptographic architecture standpoint.

While this privacy design protects legitimate users from being tracked, it also objectively provides natural cover for potential abuse: because relay devices cannot decrypt the content they are transmitting, the entire network inherently lacks the ability to filter abnormal payloads at the design level. This "design-as-blind-spot" characteristic is precisely the core issue that security researchers are concerned with.

From Positioning Beacons to Data Exfiltration Channels

Researchers discovered that the "location beacons" transmitted by the Find My network are essentially a controllable data payload. By encoding the data to be stolen into the encrypted field of the BLE advertisement, an attacker can "disguise" sensitive information on an air-gapped system as a positioning request from a lost device. When nearby Apple devices receive the broadcast, they unknowingly upload this data to Apple's servers. The attacker then only needs to query the location records of the corresponding "device" to reconstruct the stolen data.

This technique was previously proposed in a proof-of-concept study called Send My, and this application targeting air-gapped systems is a further extension of it in a real-world scenario. Send My was research published in 2021 by Fabian Bräunlein, a researcher at the Secure Mobile Networking Lab (SEEMOO Lab) of the Technical University of Darmstadt in Germany. Its core technical principle is that the AirTag's location beacon contains a public key (28 bytes) used for encryption within the BLE advertisement, and this public key field is essentially an arbitrarily controllable byte sequence. By encoding arbitrary data into this 28-byte public key field, researchers cause nearby Apple devices to mistake it for a legitimate Find My beacon and upload it to Apple's servers. The receiving end simply uses Apple's location query API to extract and decode the original data.

The measured upload bandwidth is about 3 bytes per hour. Although extremely limited, it is sufficient for stealing high-value short data such as AES keys (16-32 bytes) or fragments of RSA private keys. There is an easily overlooked information economics logic worth emphasizing here: in APT (Advanced Persistent Threat) attack scenarios, attackers typically do not pursue large-scale data exfiltration, but instead prioritize obtaining high-leverage information that offers "maximum impact from minimal effort"—a 16-byte AES-256 key is enough to decrypt an entire database, and a code-signing certificate private key is enough to forge a trusted malware update package. According to Kaspersky Lab's analysis report on the "Equation Group" (believed to be associated with the NSA), advanced attackers have an average dwell time within a target network of several years. During this period, they often extract only a very small but extremely high-value amount of data, rather than bulk-siphoning the database, precisely to maximize the product of stealth and data value. Viewed from this perspective, the bandwidth limitation of 3 bytes per hour is not an obstacle for advanced attackers, but rather a natural form of operational discipline.

This research targeting air-gapped systems, building on the foundation of Send My, further solves the engineering problems of how to stably invoke BLE hardware on an isolated system and achieve automated data encoding and transmission. At the engineering implementation level, attackers need to bypass the operating system's access control over the Bluetooth protocol stack—on Linux systems, this means gaining direct access to the HCI (Host Controller Interface); on Windows systems, it means leveraging the WinRT Bluetooth API or lower-level driver interfaces. Although this engineering barrier raises the bar for the attack, it is not insurmountable for advanced malware with kernel-level privileges.

It should be noted that Apple's location query API itself has no authentication vulnerability—the reason the attack works is that it fully complies with the Find My protocol specification, exploiting the "compliance boundary" of the protocol design rather than a code defect. This "abusing legitimate functions" attack pattern (Living off the Land) is receiving increasing attention in the modern threat intelligence field, because it is extremely difficult to detect with rule-based security systems.

The Attack Chain: How to Breach the Air Gap

Prerequisites and Initial Infection Path

It must be made clear that this type of attack does not happen out of thin air. The attacker must first plant a malicious program on the target air-gapped system through means such as a contaminated USB drive, a supply chain attack, or an insider. This is a common prerequisite for all air-gapped attacks—without a network, initial intrusion still requires physical contact or human intervention.

Supply chain attacks are particularly noteworthy here. The 2020 SolarWinds incident demonstrated that even the management terminals of air-gapped networks can have backdoors pre-implanted through software update packages. For highly sensitive environments, malicious code pre-embedded at the hardware firmware level (such as the tools recorded in the NSA's ANT catalog) is even harder to guard against—this is also one of the core security rationales behind why some countries' critical infrastructure has begun promoting domestic replacement.

Viewed from the perspective of the Cyber Kill Chain model, the Find My exfiltration technique primarily covers the data exfiltration portion of the seventh stage, "Actions on Objectives," rather than the initial infiltration stage. This means that for defenders, merely blocking BLE signals is insufficient to constitute a complete defense—control of the initial infection vector (USB, supply chain, insiders) is equally important, and both must be addressed holistically as a single attack surface. Defenders should be especially wary of the fact that when an attacker simultaneously controls both the initial infiltration and the exfiltration channel, the entire attack chain can be completed end-to-end without triggering any traditional network security monitoring, making post-incident forensics and attribution extremely difficult.

Once the malicious program is resident, it can invoke the system's Bluetooth hardware (if present), encode the stolen data, and continuously broadcast it in the form of BLE beacons.

The Trade-off Between Stealth and Low Bandwidth

The greatest advantage of this exfiltration channel is its extremely strong stealth. Traditional air-gapped attacks often rely on physical side channels such as electromagnetic radiation, acoustic waves, optical signals, or heat, and usually require the attacker to be physically close to the target. With the help of the Find My network, data can "hitch a ride" and be relayed by passing strangers' devices to a distant location, and the attacker doesn't even need to be present on-site.

The price is extremely low bandwidth. Because the BLE beacon payload is limited and it relies on the chance passing of nearby Apple devices, the data transmission rate is very slow, making it suitable only for stealing small, high-value data such as passwords and keys. But for attackers, a few KB of encryption keys is often more than enough.

This information economics logic is fully reflected in real-world APT cases: an exfiltration rate of 3 bytes per hour is almost invisible against the background noise of normal BLE traffic, and its spectral characteristics are indistinguishable from normal AirTag broadcasts, thereby reducing the risk of triggering anomaly detection due to large-scale data transmission. This is precisely where the core threat value of such attack techniques lies—low bandwidth is not only not a weakness, but in a sense is precisely the source of its stealth.

In-Depth Analysis: What Deeper Problems Does This Expose?

The Double-Edged Sword Effect of Crowdsourced Networks

The value of the Find My network is built on the crowdsourced model of "everyone participates," and its breadth of coverage is its core competitive advantage. But this also means that any signal that can be injected into the network may be relayed indiscriminately. Convenience and security form a fundamental tension here—the end-to-end encryption that Apple adopts to protect user privacy is precisely what makes such abuse harder to detect and trace. This is the profound dilemma of modern privacy protection technology: encryption protects legitimate users from surveillance, but it equally protects abusers from detection. This paradox has similar manifestations in multiple technical ecosystems such as Telegram's end-to-end encryption and the Tor anonymity network, reflecting the value-neutral nature of cryptographic tools.

From a more macroscopic perspective, this dilemma is known in academia as the "Dual-Use Problem of Cryptography." In fact, when Apple designed the Find My privacy scheme, it had already fully considered abuse scenarios—the AirTag's anti-tracking alert mechanism is one of its countermeasures. However, for the threat vector of data exfiltration, existing mechanisms still lack effective technical countermeasures, because distinguishing a "legitimate beacon" from a "beacon that encodes sensitive data" is essentially impossible at the cryptographic level: the two are completely isomorphic at the protocol level, and no content detection method can distinguish their semantic differences.

This technical dilemma also appears in the defense practices against covert channel techniques such as Domain Fronting and DNS Tunneling—when legitimate traffic and malicious traffic are completely isomorphic at the protocol level, content-based detection methods become completely ineffective, and defenders can only settle for the next best option, turning to statistical analysis methods based on behavioral baseline anomaly detection. But this method also faces the dilemmas of high false-positive rates and difficulty in tuning in low-frequency, small-data-volume APT exfiltration scenarios: an exfiltration rate of 3 bytes per hour is almost invisible against the background noise of normal BLE traffic, and its spectral characteristics are indistinguishable from normal AirTag broadcasts.

Practical Insights for Air-Gap Protection

Defense in Depth is a multi-layered security architecture concept originating from military strategy, formally introduced into the information security field by the U.S. National Security Agency (NSA) in 2001. Its core idea is: rather than relying on any single security mechanism, it uses multiple, heterogeneous defensive measures to make the cost of an attack rise exponentially. For BLE exfiltration attacks, the practical layers of defense in depth can be divided into four levels: physical layer control (a Faraday cage shielded room can attenuate 2.4GHz signals by 50-80dB, or physically remove the wireless module), system layer hardening (disabling the wireless controller via UEFI/BIOS), behavioral monitoring (deploying wireless spectrum monitoring equipment to alert in real time on abnormal BLE broadcasts), and access control (strictly enforcing device admission audits within sensitive areas).

For organizations operating critical systems, this research conveys several signals worth heeding:

• Air-gapping does not equal absolute security, and must be supplemented with a defense-in-depth strategy.
• Wireless hardware is a long-overlooked attack surface. Many air-gapped systems still retain wireless modules such as Bluetooth and Wi-Fi, which should be thoroughly disabled or physically removed in critical scenarios.
• Electromagnetic shielding measures remain effective. Traditional shielding methods such as Faraday cages can effectively block BLE signal exfiltration and should be standard configuration for high-security-level facilities.
• Spectrum monitoring is indispensable. Deploying wireless spectrum monitoring tools such as Kismet can provide an immediate alert when abnormal BLE broadcasts occur, filling the blind spots of purely physical defenses.

In addition, from a compliance and policy perspective, both the U.S. NIST SP 800-53 standard and China's Multi-Level Protection Scheme 2.0 (MLPS 2.0) impose clear requirements on wireless interface control. However, in actual audits, the physical disabled state of Bluetooth modules often lacks effective technical verification means. The emergence of this research may drive relevant compliance standards to add more detailed technical verification requirements in the "wireless hardware audit" area.

It is worth noting that at the hardware level, the reliable means of completely eliminating Bluetooth RF capability is to physically sever the antenna connection or remove the wireless module, rather than relying solely on software disabling—this is because, in the face of malware with kernel-level privileges, the OS-level device disabled state may be bypassed. Some high-security-level facilities have begun to adopt customized industrial computers that do not integrate wireless modules at the motherboard design stage, fundamentally eliminating this attack surface. But this means significantly increased procurement costs and limited supply chain options. This trade-off itself also reveals the practical dilemma of industrial control system security: the more thorough the security hardening measures, the worse the compatibility with the mainstream commercial hardware ecosystem, and the maintenance costs and difficulty of obtaining spare parts rise exponentially accordingly.

Conclusion: The Continuous Evolution of Security Boundaries

Breaching air-gapped systems by leveraging the Find My network is yet another typical case in the continuous escalation of security offense and defense. It does not use any "black magic," but rather ingeniously transforms a legitimate infrastructure created for convenience into an attack tool. This reminds us: every piece of infrastructure that provides global connectivity capability can be repurposed for unexpected uses.

Although this type of attack has a high barrier to entry and limited bandwidth, and will not become a large-scale threat in the short term, its cautionary significance cannot be ignored for defenders of high-value targets (such as nation-level critical infrastructure). In an era where wireless signals are ubiquitous, true "isolation" is harder to achieve than ever before.

From a longer-term perspective, with the global proliferation of Starlink, low-Earth-orbit satellite internet, and 5G millimeter-wave technology, the "signal vacuum" assumption on which air-gapping relies will face increasing challenges. The security of future critical infrastructure may need to shift from the thinking paradigm of "how to block connections" to a new framework of "how to maintain data sovereignty in a fully connected environment"—and this is precisely the core question that Zero Trust Architecture (ZTA) attempts to answer.

Zero Trust Architecture (ZTA) was first systematically proposed by John Kindervag in 2010 during his tenure at Forrester Research. Its core principle can be summarized as "Never Trust, Always Verify." Fundamentally different from the perimeter defense thinking of air-gapping, Zero Trust assumes that the inside and outside of the network are equally untrustworthy, requiring identity authentication, device health checks, and least-privilege authorization for every resource access request, rather than relying on network location as a trust anchor. The U.S. federal government issued an executive order (EO 14028) in 2021 mandating that federal agencies migrate to a Zero Trust Architecture, marking the comprehensive implementation of this concept at the policy level.

For the air-gapped scenario discussed in this article, the key insight that Zero Trust provides is: rather than spending massive resources maintaining an increasingly fragile physical perimeter, it is better to push security control points down to the data and identity layers, ensuring that even if data is exfiltrated, what the attacker obtains is encrypted ciphertext that cannot be used independently—this is precisely the core of the "Data-Centric Security" concept. At the practical level, this approach means: even if an attacker successfully exfiltrates a few bytes of data via the Find My channel, as long as the target system is designed with fine-grained encryption and key management for all data at rest, the stolen data fragments will be worthless in the absence of a complete key hierarchy. This "Assume Breach" design philosophy is becoming the core design principle of the next generation of critical infrastructure security architecture.

Key Takeaways