Apple AirTags use Apple's Find My network: when nearby iDevices detect a lost tag, they anonymously forward an encrypted location report to Apple, which the tag's owner can then fetch to locate the item. That encryption protects privacy -- neither the finder nor Apple learns the owner's identity -- but it also prevents Apple from validating the correctness of received reports. We show that this design weakness can be exploited: using a relay attack, we can inject manipulated location reports so the Find My service reports a false position for a lost AirTag. The same technique can be used to deny recovery of a targeted tag (a focused DoS), since the owner is misled about its whereabouts.

翻译：苹果 AirTag 利用苹果的“查找我的”网络：当附近的 iDevice 检测到丢失的标签时，它们会匿名将加密的位置报告转发给苹果，标签所有者随后可获取该报告以定位物品。这种加密方式保护了隐私——发现者或苹果都不会得知所有者的身份——但也阻止了苹果验证所接收报告的正确性。我们展示了这一设计弱点可被利用：通过中继攻击，我们能够注入被操纵的位置报告，使得“查找我的”服务为丢失的 AirTag 报告虚假位置。同样的技术可用于阻止目标标签的找回（一种定向拒绝服务攻击），因为所有者会被误导其所在位置。