Live Monitoring Active

Your Apple account
is being watched.
Now you can watch back.

If your company manages Apple devices, MDM and Declarative Device Management (DDM) sit with IT. That is normal. What is not is that Apple’s CloudConfig path can enroll a device under a DDM administrator with no user-visible profile, no confirmation, and no limit on how many outside devices can be credentialed as Owner against an executive Apple ID. Screen share and proximity sessions can follow without anything appearing in Settings. There is no official way for the person being managed to audit the managers. Forensic Monitor is that audit. It reads Apple’s own rapportd and bluetoothd output in real time and alerts when a foreign device authenticates as owner of the account. The record is Apple’s, timestamped and sealed — including the screen-share and AWDL markers counsel can put in front of a court. You do not take IT’s word for it. You do not have to ask.

SAMPLE DATA:
CRIMINAL EVIDENCE OF PROXY STALKING → 18 U.S.C § 2261A
CRIMNAL EVIDENCE OF UNAUTHORIZED SCREEN-SHARING → 18 U.S.C. § 2511
CRIMINAL EVIDENCE OF AUTOMOTIVE TAMPERING → 18 U.S.C. § 1030, 33
FROM DDM INJECTION TO FEDERAL CRIME → HOW A DDM EXPLOIT WORKS

FEATURES:
PROXY TRACKING AND DEVICE ID→
DEVICE TRACKING IN 10 FT INCREMENTS →

⬇ FM Light (Beta) — Free ♥ Support This Project Launch 10/15/2026
1,731
Devices Documented
Against Account
39
Day Window
8,919
Trackers Devices Within 33 Feet
—
Latest Nefarious MAC ID Captured

Plug it in. It captures the invisible — unknown devices, crowdsourced operations, individuals — authenticating against your Apple account through unauthorized MDM/DDM installation without your knowledge, their proximity to you, use of their peer-to-peer connection to your device to obtain screen sharing, camera sharing and keyboard access.

The evidence is immutable. Every captured device is logged, timestamped, and sealed under a SHA-256 chain of custody that cannot be altered without breaking the math.

Print the Vault Hardening Report. Hand it to your attorney.

The logs are presumed authentic under Federal Rules of Evidence 902(13) and 902(14). The defendants have to prove the impossible — that the math is wrong.

This type of exploit is undetectable to the user and to the Apple Store Genius Bar. Apple will tell you to wipe your hard drive which has no effect. If you hand our FM report to the Apple Store you will find they have no protocol in place for the criminal use of their MDM software and send you away without a repair and do not report it to the corporate office. Compounding this, once the nefarious DDM is installed there is no cap on the amount of unauthorized accounts that can be added.

ZERO TRUST EXECUTIVE PERIMETER
Forensic Account Monitor is purpose-built for executives and high-value targets who require an independent security perimeter — including scenarios where the threat originates from inside their own IT infrastructure.

Unlike enterprise MDM solutions that route telemetry through managed servers, this tool reads Apple's native system daemons directly on the monitored device and writes output locally. There is no cloud dependency, no managed endpoint, and no third-party data handling. The monitoring chain cannot be intercepted, altered, or disabled by a network-level administrator.

WHO THIS TOOL IS FOR
Forensic Account Monitor is most useful for typical targets of crowdsourcing campaigns — individuals and professionals whose positions, work, or beliefs make them targets of coordinated swarming tactics.

Corporate Deployment
Once approved by your IT department, law partners, and accounting partners, corporate executives can use it as an independent audit layer that operates entirely outside the managed IT perimeter — providing a ground-truth record in the event your IT department is collecting unauthorized data or has provided unauthorized access to your device.

Government and Law Enforcement Personnel
ICE and Border Patrol agents, judges, politicians, and public health officials are frequent targets of organized harassment campaigns that use proximity-based surveillance to track movements and monitor communications.

Whistleblowers and Dissidents
Corporate whistleblowers and political dissidents face well-resourced adversaries with the organizational capacity to deploy the kind of MDM-based fleet infrastructure this tool is specifically designed to detect.

Activists and Journalists
Those who investigate extremist groups, cults, or organized crime are routinely subjected to swarming tactics. This tool documents those operations in real time using Apple's own self-authenticating system logs — producing evidence that is admissible in federal court.

Celebrities and Public Figures
High-profile individuals — entertainers, athletes, executives, and social media personalities — are increasingly targeted by coordinated proximity-based surveillance operations. Their public schedules, recognizable locations, and high-value personal data make them prime targets for the kind of organized, technology-enabled stalking this tool is specifically designed to detect and document.
// How it works

FM Light first locates your trusted Apple mobile device linked to your account by plugging your device into your laptop or computer. FM reads your CoreBluetoothDevice ID (IDID) instantly. Next it hunts for your Rapport Bluetooth Address (rpBA)—the hexadecimal beacon ID your device broadcasts. This beacon number is software-driven and rotates to obfuscate your identity.2 FM counts the total number of beacons within a 33 ft radius and determines which one is you then continues to sample local BLE beacons.

After that it looks for impostors—other rpBAs sharing your account ID (IDS) and claiming authorized ownership access.3 If it finds them—evidence of unauthorized DDM access—FM separates those from your ID tags and flags them.


While it’s doing that, it also looks for services that have been provisioned against your device. On an exploited device you will typically see these first, because your attacker—once in—will flood your device with screen sharing and keyboard sharing to harvest intel. FM flags those as well, in separate listings.

01
Apple's Own Software Writes the Evidence
The script reads rapportd — Apple's Continuity authentication daemon — in real time using macOS's built-in log stream command.1 Every entry in the output is written by Apple's software, not by this tool. The monitor captures; it does not generate.
02
PairVerify Proves Prior Enrollment
For a device to authenticate as owner of your Apple account via DirectLink, it must pass Apple's PairVerify M2 challenge-response cryptographic handshake. This requires a private key generated at enrollment and registered on Apple's Identity Services servers. Proximity alone cannot produce this result. Every captured device is pre-enrolled before any proximity event occurred.
03
Four Parallel Streams, Zero Latency
The monitor runs four concurrent streams: RSSI proximity trapping via rapportd, SameAccountDevice authentication monitoring, MAC address harvesting with repeat-offender tracking, and BLE early warning via bluetoothd. All four run simultaneously in the background and write to separate log files.
04
Real-Time Push Alerts, Tiered by Severity
Every event triggers a push notification to your iPhone or Android device via Pushover, prioritized by severity — from normal proximity approach to emergency-level owner access and batch credential deployment events. New MAC addresses and repeat offenders are distinguished automatically.
05
Self-Authenticating Under FRE 902
Log output qualifies as self-authenticating under Federal Rule of Evidence 902 as records generated in the ordinary course of system operation. The LIVE_STREAM.log produced by this tool constitutes the primary forensic record produced by this tool.
06
INTEGRATED COMPONENTS
SHA-256 Vault Daemon
The SHA-256 Vault Daemon provides a complete, unbreakable evidentiary chain. The optional LaunchDaemon installer unlocks several capabilities unavailable to a standard terminal script: root-level execution, tamper-proof hash sealing in a user-inaccessible vault, automatic restart on crash, and persistence across logout and reboot — running continuously whether or not anyone is logged in.
07
Legal-Ready Audits
The vault installer generates a timestamped Hardening Report automatically on installation — and on demand at any time via generate_report.sh. Each report documents daemon status, vault integrity, live forensic statistics, and asserts the evidentiary basis under Federal Rules of Evidence 902(13) and 902(14). The report is sealed in the root vault and its SHA-256 hash is appended to the master chain of custody at the exact moment of generation. Run it before any court filing, discovery response, or supplemental submission.
// References

1. Milan Stute, Alexander Heinrich, Jannik Lorenz, and Matthias Hollick, “Disrupting Continuity of Apple’s Wireless Ecosystem Security: New Tracking, DoS, and MitM Attacks on iOS and macOS Through Bluetooth Low Energy, AWDL, and Wi-Fi,” in Proceedings of the 30th USENIX Security Symposium (USENIX Association, 2021), 3920–22, §§3.3, 3.6.2. Documents analysis of Apple Continuity through rapportd using the macOS log stream command, and identifies rapportd as the secure transport for Continuity services.

2. Stute et al., “Disrupting Continuity,” 3924, 3929, §§4.1.3, 5.4. Identifies rpBA as a randomized, rotating device identifier carried in Apple’s companion-link service records.

3. Stute et al., “Disrupting Continuity,” 3923–24, §§4.1.1, 4.1.3. Documents that same-account device resolution depends on keys synchronized through the account’s iCloud keychain (RPIdentity-SameAccountDevice and Bluetooth Identity Resolving Keys).

Full text: usenix.org/system/files/sec21-stute.pdf →