6 ms·
> if there's a real security risk There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it)
by wklauss 7y ago
> if there's a real security risk
There is, but it's not that great. You need physical access to the device and it won't be persistent (a reboot will clean it).
- dguido 7y agoIt certainly will _feel_ persistent if you're successfully attacked with this technique. If your iOS software is swapped out for a version with a backdoor, then the attacker will have collected your passwords and authentication tokens to services you use. If you reboot to clear the backdoor (and let's be honest: no one reboots their phones), then you won't also "clear" your attacker's memory of all your passwords.
- deleted 7y ago[deleted]
- justicz 7y agoHa, I wonder if an attacker could use this bug to prevent or fake the rebooting process by changing the behavior of the lock/volume buttons when they’re held. I know there’s also a “hard reset” you can do with volume up -> volume down -> power, not sure if that works at a lower level.
- kvakil 7y agoSeems likely that the hard reset works on a lower level as it works even if the phone is hung.
- dguido 7y agoYes, an attacker using checkm8 could do that if they had a separate exploit for persistence. That exploit would be in iOS and take over at a later point in the boot process, and it would be possible for Apple to patch it with an iOS update. Those bugs are hard to find, but there have been dozens discovered in the past.
- justicz 7y agoI’m a little confused, which part of my comment would require persistence? I was suggesting a lulzy payload that would prevent the user from _actually_ restarting their device by changing the behavior of the power button. As a means of bypassing the “just restart your phone every time you use it” countermeasure.
- willstrafach 7y agoWould not work, as this is indeed a lower-level function.
- tptacek 7y agoI reboot my phone once in a blue moon, but my phone reboots itself roughly every other day (usually because I space on charging it). Am I that unusual, or is "the phone is rarely going to reboot" not really a reliable predicate for attackers?
- tedunangst 7y agoMy reboot frequency is slightly more than 1.0 times per update, but less than 2.0 times per update.
- ladberg 7y agoI similarly reboot my phone rarely, but my phone never runs out of battery. I never charge it during the day (except if I'm using it for GPS in my car), and it's just a routine to charge it at night. I don't think my current phone, which I've had for about a year, has ever run out of battery.
- saagarjha 7y agoAnecdotal, but my family members reboot slightly less frequently than iOS updates come out (they miss a couple).
- wglb 7y agoOnly on update, and only if the update requires it.
- selectodude 7y agoIf your iOS version is swapped out with one that is backdoored, it won’t boot after you reboot it without using this boot loader exploit on a computer again. This makes you ever so slightly more vulnerable to an evil maid attack, but we don’t even have a jailbreak yet using this so it’s to be determined how it all shakes out.
- withzombies 7y agoYou don't need to modify the kernel or iBoot on disk to inject a patched OS (or malware). redsn0w didn't, it would boot over dfu every time. It's totally possible to rootkit a phone and have it reboot just fine (with the rootkit removed).
- saagarjha 7y agoI believe a reboot will cause you to boot stock iOS again.
- jplayer01 7y ago> You need physical access I don't understand why people keep downplaying this. The whole point of a secure phone is that the data can't be accessed even with physical access.
- shawnz 7y agoThe attack where you implant some kind of backdoor to capture the data is possible even without this exploit, it just makes it easier.
- gruez 7y agoHow would such an attack (without this exploit) be pulled off?
- shawnz 7y agoFor example, you could implant a hardware backdoor that monitors the touchscreen inputs
- gruez 7y agoTo do that, you'd need to disassemble the phone to insert your implant. That might be hard to do in the field (ie. not in a repair shop/lab setting with plenty of tools lying around). Not to mention the difficulties of designing and manufacturing an implant. How are you going to get it to fit? I don't think there's a lot of empty space inside a phone. How many variants would you need to design and carry around? I'd imagine that the iPhone SE would need a different implant than the iPhone XS, for example. A bootrom attack allows you to replace all of that with plugging in your victim's device into your "hackbox" for 10 seconds. Vastly simpler to execute for your typical goon/henchmen and way less likely to get detected.
- shawnz 7y agoAgreed there is a substantial difference in difficulty between the attacks. I am only speaking to the parent's point about the phone somehow previously being secure and now not being secure. The only thing that's changed is the difficulty of the attack. There are easier physical attacks too: for example just replace the whole device with an identical one you control. Replicate the target's lock screen in software and capture their inputs.
- brudgers 7y agoAnything electronic connected via the lightening port has physical access for example: a charger. A charger could be programmed to let a device in a low battery state to run the rest of the way down to empty to cause a reboot before starting to recharge. Not undetectable. But typical users would probably assume user error or a faulty charger before suspecting malware.
- ryeights 7y agoThe exploit only works in DFU mode. The user would have to press a button chord in order to reboot into DFU for that to work, and it’s not easy to do accidentally
- Tepix 7y agoAre you saying if an evil government puts a backdoor on my phone while I'm at customs, can I just reboot twice to completely get rid of it reliably? But this hack also allows exfiltration of data from your phone, doesn't it?