{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:JPI4CMYCZGFTTRLQJCT4TEL6QZ","short_pith_number":"pith:JPI4CMYC","canonical_record":{"source":{"id":"2606.21067","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T03:32:52Z","cross_cats_sorted":[],"title_canon_sha256":"064e62f85708eaedcf6f4a2561150e2e774d15300177a1bfea0bf6cc4bb1259a","abstract_canon_sha256":"f8250aeb8fe1eeb2b18dcffcef889eb75d7e8cddba77fba5b55de6fa21376742"},"schema_version":"1.0"},"canonical_sha256":"4bd1c13302c98b39c57048a7c9917e86764380361f2c398128b8e6bb30118dd6","source":{"kind":"arxiv","id":"2606.21067","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.21067","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"arxiv_version","alias_value":"2606.21067v1","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.21067","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_12","alias_value":"JPI4CMYCZGFT","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_16","alias_value":"JPI4CMYCZGFTTRLQ","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_8","alias_value":"JPI4CMYC","created_at":"2026-06-23T01:12:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:JPI4CMYCZGFTTRLQJCT4TEL6QZ","target":"record","payload":{"canonical_record":{"source":{"id":"2606.21067","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T03:32:52Z","cross_cats_sorted":[],"title_canon_sha256":"064e62f85708eaedcf6f4a2561150e2e774d15300177a1bfea0bf6cc4bb1259a","abstract_canon_sha256":"f8250aeb8fe1eeb2b18dcffcef889eb75d7e8cddba77fba5b55de6fa21376742"},"schema_version":"1.0"},"canonical_sha256":"4bd1c13302c98b39c57048a7c9917e86764380361f2c398128b8e6bb30118dd6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-06-23T01:12:28.769905Z","signature_b64":"mzQ1W79gXLyqzPXT1mlMQEKbbGAbgYc3w8lnnYD2MPYuWXr+LRkTyfYpWBFI52YNMDVlWDCR0QSsbgKNVqCCDA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4bd1c13302c98b39c57048a7c9917e86764380361f2c398128b8e6bb30118dd6","last_reissued_at":"2026-06-23T01:12:28.769442Z","signature_status":"signed_v1","first_computed_at":"2026-06-23T01:12:28.769442Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2606.21067","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-23T01:12:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"KYSvinNwKvvJs+wXqENs5bjdVj/Hm/CJnO0JrKx392AZ/mQR/hVLHRkjhPSBp/9vBT2SMJGahWminuYSgCyrDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T15:53:56.397722Z"},"content_sha256":"2e36c4010309128ccd40f9694945fd5f8f84315610e9e10e79523647bb526312","schema_version":"1.0","event_id":"sha256:2e36c4010309128ccd40f9694945fd5f8f84315610e9e10e79523647bb526312"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:JPI4CMYCZGFTTRLQJCT4TEL6QZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Boya Liu, Mo Li, Yanbo Zhang, Zhenyu Ren","submitted_at":"2026-06-19T03:32:52Z","abstract_excerpt":"Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE). This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices. We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware. Snatcher identifies vulnerabilities in unencrypted BLE advertisements, unauthenticated acoustic triggers, and slow MAC address randomization. Through three levels - sound-based direction finding, RSSI-IMU sensor-"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.21067","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2606.21067/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-06-23T01:12:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"8b4ZoVGF9ja13R0u63LbNd3RHA9VqBRst3cav8baxLTB6NtJFUIXTvXNjjl/W4BBn7WSXC2iCcFUJgSbjNMnBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-24T15:53:56.398106Z"},"content_sha256":"d0e527fe319feb993d102b6ced883c4d85dbbf283186ad19fffa8c9c5015e6d3","schema_version":"1.0","event_id":"sha256:d0e527fe319feb993d102b6ced883c4d85dbbf283186ad19fffa8c9c5015e6d3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/bundle.json","state_url":"https://pith.science/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-24T15:53:56Z","links":{"resolver":"https://pith.science/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ","bundle":"https://pith.science/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/bundle.json","state":"https://pith.science/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/JPI4CMYCZGFTTRLQJCT4TEL6QZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:JPI4CMYCZGFTTRLQJCT4TEL6QZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"f8250aeb8fe1eeb2b18dcffcef889eb75d7e8cddba77fba5b55de6fa21376742","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T03:32:52Z","title_canon_sha256":"064e62f85708eaedcf6f4a2561150e2e774d15300177a1bfea0bf6cc4bb1259a"},"schema_version":"1.0","source":{"id":"2606.21067","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2606.21067","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"arxiv_version","alias_value":"2606.21067v1","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2606.21067","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_12","alias_value":"JPI4CMYCZGFT","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_16","alias_value":"JPI4CMYCZGFTTRLQ","created_at":"2026-06-23T01:12:28Z"},{"alias_kind":"pith_short_8","alias_value":"JPI4CMYC","created_at":"2026-06-23T01:12:28Z"}],"graph_snapshots":[{"event_id":"sha256:d0e527fe319feb993d102b6ced883c4d85dbbf283186ad19fffa8c9c5015e6d3","target":"graph","created_at":"2026-06-23T01:12:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2606.21067/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Apple's Find My network connects nearly one billion devices to locate missing property via Bluetooth Low Energy (BLE). This paper reveals that insecure BLE advertisements and design tradeoffs allow unauthorized discovery and physical theft of lost Apple devices. We develop Snatcher, an attack and analysis framework implemented fully on Android smartphones without specialized hardware. Snatcher identifies vulnerabilities in unencrypted BLE advertisements, unauthenticated acoustic triggers, and slow MAC address randomization. Through three levels - sound-based direction finding, RSSI-IMU sensor-","authors_text":"Boya Liu, Mo Li, Yanbo Zhang, Zhenyu Ren","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T03:32:52Z","title":"Snatcher: Apple Find My Network Exposes Your Lost Devices To Strangers"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2606.21067","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:2e36c4010309128ccd40f9694945fd5f8f84315610e9e10e79523647bb526312","target":"record","created_at":"2026-06-23T01:12:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"f8250aeb8fe1eeb2b18dcffcef889eb75d7e8cddba77fba5b55de6fa21376742","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-06-19T03:32:52Z","title_canon_sha256":"064e62f85708eaedcf6f4a2561150e2e774d15300177a1bfea0bf6cc4bb1259a"},"schema_version":"1.0","source":{"id":"2606.21067","kind":"arxiv","version":1}},"canonical_sha256":"4bd1c13302c98b39c57048a7c9917e86764380361f2c398128b8e6bb30118dd6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"4bd1c13302c98b39c57048a7c9917e86764380361f2c398128b8e6bb30118dd6","first_computed_at":"2026-06-23T01:12:28.769442Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-06-23T01:12:28.769442Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"mzQ1W79gXLyqzPXT1mlMQEKbbGAbgYc3w8lnnYD2MPYuWXr+LRkTyfYpWBFI52YNMDVlWDCR0QSsbgKNVqCCDA==","signature_status":"signed_v1","signed_at":"2026-06-23T01:12:28.769905Z","signed_message":"canonical_sha256_bytes"},"source_id":"2606.21067","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:2e36c4010309128ccd40f9694945fd5f8f84315610e9e10e79523647bb526312","sha256:d0e527fe319feb993d102b6ced883c4d85dbbf283186ad19fffa8c9c5015e6d3"],"state_sha256":"a58fb3a4641028d2d35598a42b4b0f58d8de6f7a04dc2ec0de5e2bbeedd83b42"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"HipFjVM3qmPmrqKwW4dZ2fQDV5ZU3xSwfQZDc0w3uxp0IlxIN43lqqY+iQ/PY58j4jzaETlADx1s4pAkCAdxCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-24T15:53:56.400181Z","bundle_sha256":"643b3dd1cb771871c32a5831eb25e02c4fcdf4bc1cbd6b343b1ac2b108d20e0b"}}