Cybersecurity researchers have discovered a way to run malware on Apple's iPhones, even when the device is switched off.
A report published by the Technical University of Darmstadt in Germany details an exploit that takes advantage of the iPhone's low-power mode (LPM) to track location and perform various malware attacks.
LPM allows certain smartphone facilities – such as Bluetooth, near-field communication (NFC) and or ultra-wideband – to run even when the device is turned off or when its battery is depleted.
When an iPhone is shut down, it’s never truly off, as these components can still run 24/7. The idea is that people will still be able to their on-device wallets and keys, even when they are out of battery.
Functionality vs. security
The problem with such a system is that the Bluetooth chip cannot digitally sign or encrypt the firmware it runs, the report explains.
“The current LPM implementation on Apple iPhones is opaque and adds new threats. Since LPM support is based on the iPhone’s hardware, it cannot be removed with system updates. Thus, it has a long-lasting effect on the overall iOS security model. To the best of our knowledge, we are the first who looked into undocumented LPM features introduced in iOS 15 and uncover various issues,” the researchers state.
“Design of LPM features seems to be mostly driven by functionality, without considering threats outside of the intended applications. Find My after power off turns shutdown iPhones into tracking devices by design, and the implementation within the Bluetooth firmware is not secured against manipulation.”
Thankfully, abusing the flaw is far from practical, because the attacker would first need to jailbreak the iPhone, which is a feat in itself.
But in the unlikely case of a successful attack, the intruder would be able to operate more stealthily, as compromised firmware is almost impossible to detect.
Apple has been notified of the findings, the researchers have said, but has not yet responded to the disclosure. TechRadar Pro has also asked the company for comment.
Via Ars Technica
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba