Lagrange Point beat Apple's AirPods region lock by faking the Wi-Fi air

When Apple's iOS 18.1 update switched on hearing-aid features for AirPods Pro 2 in early November 2024, Rithwik Jayasimha and his dad bought a pair for his hard-of-hearing grandmother — and fifteen minutes after the purchase found the feature missing. India was not on Apple's list of supported countries, and the omission stung because of price: dedicated hearing aids in India commonly cost ₹50,000 to ₹800,000, while Apple advertised correction of hearing loss up to 60 dBHL in a consumer earbud.

The obvious bypasses failed. Proxying Apple's IP-geolocation endpoint, changing store region, locale and time zone, and even Xcode's simulated CoreLocation all left the feature locked, and certificate pinning broke other connections. Pulling the locationd and countryd binaries showed why: Apple's CLCountryTracker deliberately skips simulated location, and console logs showed the device still knew it was not in the US.

A friend explained the channel they were missing: a Wi-Fi-only iPad has no GPS or cellular, so iOS infers location from the Wi-Fi SSIDs and MAC addresses around it. The trio pulled Menlo Park beacon data from the open Wigle database, forked the Skylift project so an ESP32 cycled about 100 California SSIDs, wrapped the iPad in an aluminium-foil Faraday cage and ran a kitchen microwave — a 2.4GHz jammer — to drown out Bengaluru's real networks. After a reboot inside the cage, the iPad's regulatory domain flipped to the US and the hearing-aid setup appeared.

Once enabled, the flag and hearing profile sync through iCloud, so the feature travels with the owner's account rather than the single device. The collective published the full method, offered to unlock AirPods at small sessions in Bengaluru, and rebuilt the cage in a sturdier second version for further radio and network experiments.

A Wi-Fi-only device locates itself from ambient SSIDs, so teleport it by changing the air, not the GPS

A device without GPS or cellular locates itself from ambient Wi-Fi beacons, so faking those beacons fakes the one sensor the whole location decision trusts.

Apple's hardened defenses — certificate pinning and a simulated-location check inside locationd — protect the channels an attacker is expected to use, leaving the Wi-Fi positioning channel open.

The physical workaround is cheap and reproducible: foil, cardboard, a 2.4GHz microwave and an ESP32 cycling open-source beacon data.

Because the enabled flag rides the owner's iCloud account, one successful unlock sticks and propagates to their other devices without repeating the teleport.

The prize justified the effort: with dedicated aids costing up to ₹800,000 in India, the AirPods route priced hearing correction like consumer electronics.

When a platform gates a feature by location, find the sensor that actually feeds the check and simulate there: spoofing the obvious channels loses, changing the ambient Wi-Fi air wins.

Wired ran the story the same day, and the Hacker News thread drew 591 points and 193 comments as the authors answered technical questions about the hack. The group said dozens of people across India contacted them for help and planned unlock sessions using a second, sturdier cage. Not every replication succeeded — some readers found the AirPods retained the last connected region — and the authors expected Apple could close the loophole, though Apple did not comment at the time. The episode also left the collective with a Faraday cage they planned to reuse for radio and network research.