Find My Turns Strangers' iPhones Into Your Stolen Mac's Informants, and Activation Lock Survives the Wipe

Chris Pirillo in tin-toy style watches a map as a stolen laptop in a backpack sends signal waves to a stranger's phone on a bus seat — Illustration: LockerGnome

A stolen MacBook sitting in a backpack on a bus, lid shut, no Wi-Fi, can still tell you where it is. Every iPhone on that bus is the messenger.

Apple’s Platform Security guide describes the trick. “Any Apple devices within Bluetooth range that have offline finding enabled can detect a signal from another Apple device,” and then “the finder devices encrypt their current location information and relay it to Apple.” The owner’s device holds the key to read it. “Apple never has the decryption key, so Apple can’t read the location encrypted by the finder,” the guide says. Offline finding turned on by default with macOS 10.15.

When LockerGnome ran “Nothing worse than a lost laptop” in August 2010, the best tools were software you installed before the loss. Prey, a GPLv3 project copyrighted 2010, called itself “a lightweight application for tracking your stolen laptop.” It ran “at a specified interval in your machine,” checked a web address for its orders, and on Linux pulled webcam shots and screenshots through streamer and scrot. It was clever, and it lived on the disk. A thief who reinstalled the system wiped it out along with everything else.

That bash client is archived now, marked “DEPRECATED,” its repo read-only since May 27, 2021.

Why it matters

The lock moved off the disk. Apple’s Activation Lock “is designed to prevent others from using your Mac if it’s lost or stolen.” It needs a Mac with Apple silicon or the T2 Security Chip, macOS Catalina 10.15 or later and two-factor authentication on the Apple Account, and you get it by turning on Find My. In 2010 a fresh install was a clean slate for a thief; on these Macs it’s a setup screen asking for your account.

A wipe no longer means you lose the argument. Apple’s erase instructions say an erase on an offline device “begins the next time it’s online,” and afterward “Activation Lock remains on to protect it.” You can scrub your data and still keep the machine worthless to whoever has it.

The clock is shorter than people think. Find My shows “No location found” when more than 7 days have passed since the device last sent its location, per Apple’s Find My guide. A week of waiting to see if it turns up can cost you the trail.

Windows got the map, with conditions. Microsoft’s Find My Device finds and locks a PC from account.microsoft.com/devices, but it has to be “turned on before you can use it,” needs an Administrator account and a Microsoft personal account, and works only “when location is turned on for your device.” The page offers Find and Lock and says nothing about a remote erase.

The 2010 version of this story ended with hope and a webcam photo. Today’s ends with a Mac that phones home through strangers and stays locked through a wipe, at least on Apple’s side.

Laptops without a chip that holds the lock, or without the vendor account turned on, are still in 2010. The question for every fleet is how many of those are still in the backpacks.

More Security