How the Apple AirTags were hacked

Name: How the Apple AirTags were hacked
Uploaded: 2021-05-11T18:30:38Z
Duration: 8 min 38 s
Channel: stacksmashing
Description: This video demonstrates how to bypass the debug protection on Apple AirTags using voltage glitching to dump the firmware.

stacksmashing

229K subscribers • 15 videos on Hallway

YouTube

Recommended by 4 people: 4 in engineering communities.
A classic. People kept recommending it from 2022 to 2026.

Intermediate. Assumes working knowledge.

1.6M views5 years ago4 recommendations

Security Hardware Exploits and vulnerabilities Reverse engineering Embedded systems

This video demonstrates how to bypass the debug protection on Apple AirTags using voltage glitching to dump the firmware.

On Saturday, I managed to dump the firmware of the newly released Apple AirTags - and in this video I'll show how I did it. I won't share firmware dumps or so, so please don't ask :) Links: - Colin on Twitter: twitter.com/colinoflynn - Colin on YouTube: youtube.com/channel/UCqc9MJwX_R1pQC6A353JmJg - Colin's company: newae.com - LimitedResults Appprotect bypass: limitedresults.com/2020/06/nrf52-debug-resurrection-approtec… - LimitedResults Pocketglitcher: limitedresults.com/2021/03/the-pocketglitcher/ My links: - Twitter: twitter.com/ghidraninja - Patreon: patreon.com/stacksmashing - Pico Debug'n'Dump board: gum.co/picodnd Timestamps: Intro AirTags hardware Debugging interface Fault-Injection Glitching the AirTags Hardware Setup Lets Glitch Firmware modification

Why it's here

4 people recommend this

What people say. Recommended as a great demonstration of hardware fault injection and firmware dumping using accessible tools like the RP2040.

u/andrewheppin r/embedded • 4 years agoRecommends

On “With lot of IOT systems and connected mobility in active deployment, what part of cyber security is going to be significant/relevant for embedded systems?”

> An attack that's kinda hard to mitigate is glitching I saw a really cool video on voltage glitching the Apple Airtags and getting it to dump flash. It wasn't too hard to replicate, hardest part by far was soldering to the tiny little test pads.

6View on Reddit

u/JessyPengkmanin r/embedded • 9 months agoRecommends

On “How to read the code of home automation products?”

Yep link to this video

4View on Reddit

u/andfulin r/FPGA • 3 years agoRecommends

On “looking for guidance”

The same method has been used to hack airtags. I think, all you need is a fast and reproducible switching of a MOSFET. In the video they use the rp2040's programmable IO which is an assembly language for precisly timed switching of the IOs. That can be done with an FPGA, but unless you are doing something more sophisticated or need a higher clock speed than 33MHz, I would be using the rp2040, or the raspberry pi pico.

3View on Reddit

u/TrulyEmbeddedin r/embedded • 9 months agoRecommends

On “Complete beginner needs help dumping firmware”

I would recommend following someone on YouTube with the product they’re using rather than starting from scratch. There’s a lot of variability on different hardware. The link below shows this guy dumping the firmware of an Apple AirTag using brownout shenanigans. Good luck! link to this video

1View on Reddit