Connect to airtag / findmy device on non-iOS device?

[YeapGuy]

Is it possible to connect to an official FindMy-enabled device from another device than the owning iPhone? I know this isn't exactly the right place to ask this question, but there seem to be a lot of knowledgeable people around here. I'll be thankful for any, even small pointers!

[malmeloo]

Yes, that should be possible, but only for "public" features such as making a sound. Although admittedly I don't know exactly how the BLE authentication works, so there might be a way to access authorized features as well given the right credentials. What functionality are you looking for exactly?

I've been meaning to expand the current scanner functionality anyway, so something like this will probably be supported in the future. I haven't been able to spend as much time on it as I've wanted, but it will get there... eventually.

[YeapGuy]

Making a sound is possible for sure. The AirGuard Android app (https://github.com/seemoo-lab/AirGuard) does that. Just need to find it in the source 😄

I don't know how the BLE authentication works either, that's what I'm interested in finding out. I'd intercept it myself, but I don't even know where to start 😅 I've done HTTP MITM reverse engineering many times, but not Bluetooth.

As for why I'm interested in this... Well, my plans of using FindMy devices with an Android device as the "master" are kind of ruined by the fact AirTags (and other FindMy devices) are designed to be connected to the host iPhone at least once in a while. They go into this special lost mode when disconnected for a longer period and beep occasionally. Also, if an iPhone owner travels for a while with a disconnected device, they get a tracking alert. That's really unpractical.

[malmeloo]

Hmm. It appears that communication with the owner device is encrypted using a link encryption key, which also rotates in 15 minute intervals. That key should be derivable from the same shared secret that's in the file you decrypted from MacOS. Since pairing happens at the Find My protocol layer and I cannot find any other authentication methods, I hope that means it should be possible to manage the airtag using those secrets. Do you happen to know whether airtags also enter lost mode when they're near another device connected to the same apple account?

Once the airtag has transitioned from to separated state (due to the missing owner device), I believe it's necessary to broadcast on a specific address to make it transition back and disable the tracking alerts. That address can be generated using the same secrets. I'm trying to decide whether that would be in scope for this library; however, generating that address should definitely be doable.

[YeapGuy]

Thanks for all the info :)
I don't think Airtags enter this "lost mode" when near another device with the same Apple ID, as on the macOS Find My app, you can manage Airtags the same as on iPhones, provided you have Bluetooth turned on.