3 ms·
IIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip whi
by morpheuskafka 7y ago
IIRC from the San Bernardino case, that was the case on the shooter's phone (a 5S I think), but since then it has been built in to the "Secure Enclave" chip which is not affected by the vulnerability. But you could flash a fake iOS that logged the user's code and/or directly exfiltrated the data--the user would have no idea that it was not the stock iOS they were giving their code to. It would leave them which a bricked device the next time they rebooted, which could raise suspicions.
- earenndil 7y agoIt was a 5c; 5s and later had the SEP. You don't 'flash' a fake ios; you can use the bootrom exploit to put your modified version of ios into memory, and once you reboot you would get back straight stock ios. They could even make it reboot as soon as the password was harvested, leaving behind no trace. This is scary stuff. You can keep yourself safe by rebooting as soon as you get your phone back from border patrol, but many people would not know to do that.