Hey, so I managed to dump and modify the firmware of the newly released Apple AirTags,effecitvely
jailbreaking them, and in this video I’ll show you how I did that!
Before we start hacking the AirTags though, we need to look at the hardware to understand
what’s inside, and what’s hackable!
Luckily, Colin O’Flynn, famous hardware hacker and a good friend of mine, made some
high-resolution pictures of the PCB, and allowed me to use them here.
This here is the front-side of the AirTag, and this is where all the interesting stuff
is: The big silver chip is the Apple U1, a custom chip that is responsible for the ultra-wide-band
functionality of the Airtag. So far this chip was only available on recent iPhones, the
Apple Watch and the Homepod, but now you have it in a $30 device - and so being able to
experiment with them in a cheap way is really awesome.
The secolnd biggest chip, is this one: a Nordic Semiconductor nRF52832. This is a microcontroller
with integrated bluetooth and NFC. I’m pretty familiar with it, as I’ve seen it a lot
in recent years. I even published hardware attacks on it in 2019 already.
Then we have a small 32 mbit SPI-flash, and as I’ve shown in other videos, these are
in general really simple dump.
Now personally I wasn’t really interested in the AirTags at first, but on friday morning,
I woke up and saw that someone sent me a dump of the contents of the SPI flash. And after
taking a quick look inside, I got hooked: I looked through the flash-contents, saw that
it contained the RTKit firmware for the U1, saw some nRF code, and new that I wanted to
get code-execution on the device.
And so I did what any hardware hacker would do: I got an Appointment at the Apple Store,
and bought a pack of AirTags.
Now what was really cool is that, Colin, who by the way builds awesome hardware hacking
tools for a living and also has a great Youtube channel, had already posted all the testpins
and so on Twitter, and so once I had my AirTags, I didn’t really have to search for much.
He even found two testpins on which the debugging interface of the nRF52 is exposed. Unfortuantely
it was locked down: This means that you can erase and program the chip, but you can’t
dump the firmware that is on it.
My goal was to change that, and to try to break into the nRF52 microcontroller, as it
seemed like the most interesting target: I assumed that it’d would run the bluetooth
stack, handle the communication with the iPhone, and probably a lot of the other things. But
how can we unlock this processor and get debugging access?
Now as said I’m pretty familiar with the nRF52, and I also do a lot of voltage fault-injection
attacks. And even better, I knew that in 2020, the security researcher working under the
name Limited Results published an article in which he documents how he used fault-injection
to re-enable the debugging features on an nRF52840. This chip is very closely related
to the one found in the AirTag, and so I assumed that the same attack would also work here.
You can find a link to his posts, and also to the hardware he builds & sells in the description.
And so at this point, the approach I wanted to take was clear: Lets use voltage based
fault-injection to hack into the device. Now you might be wondering: What is fault-injection,
or, as it’s more commonly called, glitching?
Well,simplified, if you take the power-supply to for example a micro-controller, and you
interrupt it for a verrrrry short amount of time, you can manage to change the behavior
of the chip. And so for example you can corrupt memory reads, and even skip instructions.
NOw if we imagine the boot of chip, at some point in time there might be a check that
is similar to this: The chip checks whether debugging is disabled. And if it is, it will
skip enabling the debugging hardware. However if we manage to glitch during the
exact time of the check, we might be able to trick the chip into enabling the debugging
hardware. And that’s exactly what I did on the AirTag.
A Naturally, this is not super trivial, but
it’s also not very hard! The first thing we have to figure out is: What do we want
to glitch? If you look at a microcontroller, you will often see that it has a single power
supply of lets say 1.8V. However in the chip, often other voltages are generated using regulators.
And so for example the CPU core might run on a different voltage than the bluetooth
peripheral and so on.Now when we glitch, we really want to try to only glitch for example
the CPU core, which isn’t really possible when we would try to glitch on the 1.8V supply.
However, regulators tend to be noisy, and to compensate that, there are often external
decoupling capacitors external to the chip. And these capacitors, give us direct access
to the voltage of for example the CPU core! And so if we attach a switch to ground to
that capacitor, and we press down the switch, we create a short circuit to ground that will
interrupt the power to the CPU core. And if we open the switch again, power will be back.
Now obviously with a physical switch, you won’t be able to do this super precisely,
and so instead of a switch, we can use an n-channel mosfet, and instead of triggering
it with our fingers, we can use a device. Now normally you’d use an FPGA or something
else with very precise timings, but I thought it be fun to try to glitch the AirTag,.. With
a 4 dollar raspberry pi pico.
And so if the Pico will enable the GPIO, the power to the CPU core will get interrupted.
And if the GPIO goes down again, the power will be restored.
Now how does this work on the real device? Luckily for us, the capacitor for decoupling
the CPU core voltage, is easily accessible on the under-side of the device. you don’t
even have to remove the PCB from the Tag, you just need to remove the backside.
And even better, there’s a nice testpad connected to it, which makes soldering much
much easier. Now a fair warning: I was impatient when I soldered this on my AirTag, and I immediately
ripped off that testpad and had to solder directly onto the pads of the capacitors instead.
So be careful if you try this at home!
Now basically, I connected that CPU core testpad to my raspberry pi pico using an n-channel
mosfet. Then, for the pico to detect when the nRF
is turned on, I also connected the power-supply of the nRF to the Pico - I had use a level-shifter
here, as the Pico runs at 3.3V and the nRF itself is running at 1.8.
I also connected the battery contacts of the AirTag directly to my raspberry pi, so that
I could control when the AirTag is powered on.
All that’s left to do now is to connect an SWD programmer to the programming pins
that were found by Colin O’Flynn, and so after each glitch, we will simply try to connect
to the chip using SWD, and if it succeeds, we were successful!
And the nice thing is: We can try this a ton of times! In fact, we can restart the Tag,
glitch it, and then try to connect multiple times per second. And so we don’t have to
be super precise, we can basically brute-force it!
Now lets look at this on the actual hardware: This is the AirTag on which I managed to re-enable
debugging and dumped the firmware. This is after I just had broken 2 other ones while
trying to remove the PCB, and so you can see that I didn’t have the patience anymore
for a nice soldering job - but it worked, so what can I say? I thought about doing a
nicer one for the video, but I felt like showing this is more honest.
Now a couple of weeks ago I started designing a Raspberry Pi Pico based hardware-hacking
slash analysis device that includes level-shifters and a mosfet for glitching, and so I used
that for performing the actual attack, however you can just as well put this together on
a breadboard. If you want to support my work on it I put a link to details in the description!
And this here is the final setup: I’m using a J-Link as the debugger, and hooked the airtag
directly up to the Pico based board.
To check whether everything is working I also hooked up an oscilloscope. In the end, I had
this nice setup.
The firmware on the raspberry pi pico is really simple: It waits for the nRF to be powered
up, then waits a configurable delay, and then it glitches the chip for a configurbable pulse-width
.
For the timing on where to glitch, I again looked at limited result’s blogpost, and
saw that he glitches roughly where the CPU core voltage slightly dropped. And so using
the oscilloscope I found that point in time, and set it up. For the pulse-width I used
the pulse-width I used back in 2019, as I very extensively experimented with different
ones back then.
To control the glitcher, I wrote a simple Python script in a jupyter notebook, which
gives nicer UI output: As you can see, it’s really simple:
We loop through a delay range, then we try two different pulse width, and then we use
openocd to check whether we can connect to the chip.
Lets start it, and look at the oscilloscope. We can see on the yellow line here that our
glitch is working, but if we zoom out we can also that our glitch jumps around a lot, and
so it’s not great - - our timing is not very precise. But remember, we only have to
get lucky once!
And after only a couple of minutes the script output what I hoped to see: “SUCCESS”!
Now once this was running, I immediately saw that the setup is not great: You can see that
my glitch jumps around a lot, and that the timing is not very precise.. But remember,
we only have to get lucky once!
And indeed, the debugger is able to connect to the chip!!! And I can dump the firmware!
I just managed to hack the AirTag!
And the cool thing is: With the dumped firmware, I can flash other airtags without having to
glitch them, as the locked down nRF52 still allows for flash-erase. I tested this on a
second airtag, which looks like this.
Next I wanted to see whether I can modify the firmware, and so I changed the URL that
is sent when the AirTag is NFC scanned. And what better thing to do than to try to rickrol
people with an airtag?
And so when you scan my modified AirTag, you get a notification that you scanned a YouTube
link and... it leads you straight to a rick-roll.
So we’ve got a fully jailbroken AirTag, with which we can now experiment.
And I think it will be interesting to see what people build with this, especially for
research surrounding the U1 it will be interesting, and you might even be able to use the accelerometer
of the AirTag as a makeshift microphone!
I hope you enjoyed this video, and to see you on this channel again soon. Thank you!