A 22-year-old security researcher managed to enroll a Linux device into Apple's Find My network and retrieve live location data from it, according to a report published August 20, 2026 by The Register. The researcher, who uses the handle "Zerotistic," developed a technique that tricks Apple into transmitting people-location data—a feature the company exclusively reserves for Apple hardware like iPhones and Macs—to a non-Apple machine. The breakthrough allows a Linux-based device to access location information that friends or family members have already chosen to share with the account owner, bypassing Apple's typical hardware restrictions.
The technique involved multiple technical steps to convince Apple's systems that the Linux machine belonged to its network. Zerotistic first linked the Linux device to their Apple account by obtaining an identity delegate through Apple's GrandSlam authentication protocol, then used it to construct a custom certificate signing request for an Apple Identity Services device certificate. After extensive trial and error, the researcher discovered the request had to use PKCS#10 format with a 2048-bit RSA key signed using SHA-1, bundled into a compressed XML file and transmitted to Apple's authenticateDS profile-enrollment endpoint. Apple then signed the request, providing the IDS certificate needed to register the Linux device's public key to the researcher's Apple account. To fully activate Find My capabilities, the Linux machine had to subscribe to six different subservices, specify supported encryption types, provide public keys for Apple's device-to-device messaging format, and obtain signatures from both an IDS certificate and an APNs certificate secured during initial network setup.
The researcher told The Register it took less than a week of tinkering to develop the technique. Zerotistic noted that the SHA-1 signature requirement and XML encoding came as surprises, with their "best guess" being that the certificate signing request had to conform to older standards because authenticateDS is a legacy endpoint. The report emphasizes this is not an exploit that permits arbitrary retrieval of any Apple user's location—it refers only to registering a non-Apple device to the Find My network and accessing location data from people who had already chosen to share their whereabouts with the account owner.
The method works by establishing a persistent binary TLS connection to Apple's private APNs servers, then issuing a SubscribeAndFetch request that prompts the device of someone who'd already shared their location to push an encrypted location key to the newly registered Linux machine. Retrieving people-location data requires Apple to trust that the machine being used belongs to its network and can receive the data, which is transmitted over Apple's Push Notification service. The final technical hurdle involved creating a Linux script to unwrap Apple's messaging envelope, extract the shared location key, and decrypt the Find My location data—composed of coordinates, timestamps, and accuracy information. Once developed, the script could fetch and decode subsequent location reports for the existing location share. The Register asked Apple if it was aware of the researcher's work and whether it had plans to address the issue, but the company did not immediately respond.
The disclosure highlights how tightly Apple controls access to its ecosystem features, even when the underlying data involves user-authorized sharing rather than security vulnerabilities. Organizations that rely on platform-specific features for workforce coordination may face unexpected constraints when employees or partners operate outside approved hardware environments.