A security researcher has reverse-engineered Apple’s private Find My People protocol to allow Linux systems to register with Apple’s internal services, acquire an existing location-sharing key, and decrypt a friend’s live shared location—without ever using a Mac or iPhone. This work maps out previously undocumented internal Apple protocols and tools. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
How the Reverse Engineering Unfolded
The project began when the researcher set out to use location data from Apple’s Find My app—already shared by a friend—to create geofence alerts for Discord. Trying a simple authenticated API call instead triggered a week of deep reverse-engineering of Find My’s device identity, messaging, and backend services, since no open-source implementation fully replicated the workflow. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
By analyzing Apple’s internal daemons—”fmfd”, “findmylocated”, and “searchpartyd”—and leveraging open tools like FindMy.py and pypush, the researcher reconstructed the entire pipeline, field by field. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
Faking Apple Devices and Fetching Keys
The ability to decrypt shared location data rested on convincing Apple’s services that a Linux device was an Apple device. To do this, the researcher first authenticated via Apple’s GrandSlam login system to obtain a delegate token for IDS, Apple’s internal encrypted-messaging framework used by services such as iMessage and Find My. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
Then came the challenge of generating a valid device identity: the device needed to submit a certificate-signing request (CSR) with very specific, undocumented requirements. These included using a 2048-bit RSA key, a SHA-1 signature, and a “common name” matching the SHA-1 hash of the Apple account’s profile ID, wrapped in a gzip-compressed XML property list. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
Next, the Linux machine had to enroll as a Find My device—specifically via Apple’s “alloy” multiplexer service, specifying six sub-services—rather than registering under the legacy Find My Friends API. Only after that could it be treated like any other device that’s been granted location sharing. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
Receiving Existing Keys and Decrypting Live Locations
One of the most critical discoveries: Apple’s system automatically distributes an already-accepted location share’s encryption key to newly added devices. Through a “SubscribeAndFetch” request marked with intent “distributeKeys”, the sharing device will redistribute its current key via Apple Push Notification service, enclosed in a signed envelope using ECDH (Elliptic-Curve Diffie-Hellman) verification called “pair-ec”. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
The researcher found that per-share encryption keys use the elliptic curve P-224, while the envelope protecting the messaging channel uses P-256. With the share key in hand, they could query Apple’s SearchParty service—which holds encrypted location updates—and decrypt them locally using ECDH and AES-GCM. The result: obtaining live coordinates, accuracy radius, and timestamps for a consenting friend’s device without Apple hardware. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
It’s important to note that this process did not expose any unintended data: it only accessed location info already shared by the friend with the researcher’s Apple account. There was no breach or flaw that allowed bypassing Apple’s sharing consent. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
The primary value of this work lies in its documentation. For the first time, researchers have laid out how Apple’s IDS and SearchParty frameworks distribute, rotate, and protect location-sharing keys. This could pave the way for more interoperable Find My clients or self-hosted tooling that can interact with Apple’s services in a more transparent way. ([cybersecuritynews.com](https://cybersecuritynews.com/apple-find-my-people-reversed/))
What this means: while this doesn’t represent a vulnerability in the traditional sense—no unauthorized bypass of permission—it clarifies Apple’s mechanisms around key distribution and might shift how people think about privacy when sharing locations. The research gives new insight into Apple’s internal security architecture.
