Researcher tricks Apple’s Find My into sharing location data with Linux

A security researcher demonstrated a method to register a Linux machine with Apple’s Find My service by obtaining an identity delegate, creating a PKCS#10 CSR with a 2048-bit RSA/SHA-1 signature, and using Apple’s legacy authenticateDS endpoint to get an IDS certificate and APNs access; the enrolled device then subscribes to Find My services and can receive and decrypt location updates that were already shared with the Apple account owner.