7 ms·

Bricked iPhone 16 Can Be Restored Wirelessly Using Another iPhone

113 points by impish9208 2y ago

mdaniel 2y ago
If that can be done "off grid," then I welcome it because it's likely a jailbreak vector
- avianlyric 2y ago
  Not a chance. iOS installs are cryptographically bound to the hardware itself installed on. It’s not possible to get an iPhone to boot an iOS install without an Apple server providing that cryptographic binding.
  - 0l 2y ago
    Assuming it's implemented properly, that is. The whole reason Jailbreaks exist is due to bugs in Apple's implementations.
    - gjsman-1000 2y ago
      Almost certainly not affected; even if this new recovery mode had no signature verification at all, you would have to deal with Apple’s impenetrable-since-A12 secure boot.
  - mdaniel 2y ago
    Well, one will observe that I said "off grid," because I was acutely aware of the desire for them to approve OS reinstalls I know, "but muh sekurity" and all that, but when the grandkids find an antique iPhone 16 in a barn somewhere, and want to install an iOS image upon it to see how things were in the old-times, I want that to be technically possible even after Apple shuts down the old gatekeeping servers
    - astrange 2y ago
      That's not possible because the requirement is built into the ROM. They'd have to release the keys and then you could emulate it.
- deleted 2y ago
  [deleted]
- explaininjs 2y ago
  Curious what you want from a jailbreak at this point? It seems all of the old things that were actually helpful have found them into first party software, or at least in the sanctioned third party. (internet tethering, emulators, side loaded apps, etc.)
  - fragmede 2y ago
    Internet tethering is actually one that's gone backwards, with "unlimited" cellphone plans that are limited when tethering. Or plans that disable tethering even though all the software is there. The other thing from a jailbreak would be for it to become self hosting, that is, give the ability to make full blown iPhone ipa on an iOS device without needing a macOS device anywhere at all.
    - explaininjs 2y ago
      As someone who does a ton of networking/routing at the link layer for a day job, I can definitely see why they’re taking measures to reduce bandwidth hogs - to the extent I might actually prefer to be on a network that has taken measures to reduce hogging vs one that has not. When it really truly matters, like when I have a business need to download huge items in remote areas, the $10/GB+ justifies itself.
      - Dylan16807 2y ago
        Ironically, downloading huge items is easy to do without tethering. And video streaming, probably most people's biggest bandwidth use, fits very well on phones. Does anyone offer a tethering plan that's rate limited but not data limited?
        dwaite 2y ago
        > Does anyone offer a tethering plan that's rate limited but not data limited? T-Mobile in the US; they give you a set amount of high-speed tethering based on your plan, then it rate limits severely until the end of the billing cycle unless you upgrade your plan or buy a a pack of data.
- ElFitz 2y ago
  And just like the original PSP’s batteries, you would be able to jailbreak an iPhone simply using a jailbroken iPhone.
Brajeshwar 2y ago
Will this not increase the economic value of stealing iPhones? Right now, in India, iPhone sales compete with used iPhones. With an option to unbrick phones, what methods are preventing a new market of “Chor-Bazaar for iPhones” (market for stolen iPhones)?
- kylehotchkiss 2y ago
  I am so happy to see a chor bazaar reference here. I got one of my antique SLR cameras from there!
- toymin 2y ago
  Pretty sure this doesn't remove Activation Lock so it shouldn't make a difference
- brigade 2y ago
  Bricked as in doesn’t boot the OS, not bricked as in unable to be activated.
  - Brian_K_White 2y ago
    Then it's not a brick. Why is the term "bricked" in the first place? Because of the utterly dead properties of a brick. The whole point was a visceral image of just how not remotely recoverable under any circumstances, vs merely a little extra effort can recover. An unformatted empty computer with no os is not a brick in the same way a cd player with no cd inserted is not a brick. It's still fully functional.
    - Dylan16807 2y ago
      Okay, fine, but you're replying in the wrong spot. The point being made here is the difference between broken and locked, regardless of whether it's a little broken or very broken.
- dangsux 2y ago
  [dead]
lofaszvanitt 2y ago
w o w what could go wrong
- olliej 2y ago
  I'm not sure? what is the threat you're concerned about here? My reading of this is that it's just removed the requirement to use a wired connection to a laptop to restore a phone that is already in DFU/restore mode - I'm not sure what attack/flaw you get from allowing the recovery path over wifi that would not already be an option with the existing wired path?
  - MBCook 2y ago
    Well, IF you have an exploit capable of bypassing all iPhone security you could now use it by setting something on someone’s phone for a few minutes instead of plugging into it. Is that useful? Maybe. No fingerprints? Of course you still need that billion dollar exploit first.
    - olliej 2y ago
      You can't bypass "all iPhone security" - this is a restore path: the phone is already in a state where it cannot boot, and cannot access user data. Once an iPhone is in a restore state (restore mode or DFU which afaict are only marginally different) it cannot do anything except install a new OS. If an iPhone is in a restore mode it is not in an "update the device mode" it's in a "the OS is dead and the user data is gone by default". There are _some_ restore paths it is possible to not lose all of the data on the device, but that requires the user (on the device) to provide their passcode during the restore, and I think even requires their iCloud password to get through activation lock, and it takes like an hour to complete. There's fundamentally no reason that this should be less secure than the existing state where restore requires a wired connection to a laptop.
      - MBCook 2y ago
        Right. I was saying hypothetically if you had a big enough chain of exploits for all the various protections Apple has then this may let you use them without physically touching the device, only being really close. But if you had that chain of exploits, who cares. You already won the game. So I don’t think this matters to security.
SheinhardtWigCo 2y ago
This is presumably in preparation for removing USB-C next year?
- teruakohatu 2y ago
  The latest AirPods have usb-c, with the higher tier also including wireless charging. If there was ever a device category to remove usb-c it would be AirPods (which would still be a terrible idea)
  - derefr 2y ago
    I would argue the opposite: AirPods are a pure "client" device — they need to be connected to by something, they don't connect to something; and they have no display, input method, or other means to initiate/change Bluetooth pairing, if the state of the firmware somehow gets in a mucked-up state and they need to be flashed. The only possible way to recover broken AirPods is via tethered recovery. An iPhone is the opposite: both a "client" and a "host", with plenty of options (in theory) for interactively initiating and configuring a wireless recovery boot. Almost capable enough (again, in theory) to be used for standalone debugging of its own hardware faults (like you'd do with a PC using a live USB image.) For 99% of faults, an iPhone should be capable of non-tethered recovery — if Apple would just write the firmware so as to enable that. And the other 1% of the time, you've probably got at least one failed critical hardware component preventing early boot. At which point "flashing the OS" would be the least of your concern; and instead, you'd just take the thing into the Genius Bar, and they'd open it up, and then either tap into an interior debugging interface (as presumably they'll leave the lightning debug pins exposed as something like JTAG pads); or they'd temporarily swap the mainboard out into an "everything but the mainboard" recovery harness, flash it there, and then stick it back into the phone. At which point they could then use the recovered base firmware's recovery mode to QC the rest of the hardware!
    - ssl-3 2y ago
      > I would argue the opposite: AirPods are a pure "client" device — they need to be connected to by something, they don't connect to something; and they have no display, input method, or other means to initiate/change Bluetooth pairing, if the state of the firmware somehow gets in a mucked-up state and they need to be flashed. The only possible way to recover broken AirPods is via tethered recovery. Huh? The charging case (which is an integral part of the system known as "Airpods") has a display (LED indicator) and an input method (a pushbutton).
GeekyBear 2y ago
Needing to connect an iDevice that wouldn't boot to a PC or Mac in order to restore a factory OS image wasn't exactly a high bar to get over, but this does give you another option for recovery.
- devilbunny 2y ago
  It isn’t for most people here. But the most valuable tool for fixing a broken computer is a working one, and a lot of people don’t have more than one anymore. Some don’t even have that. My wife texted me on Friday as she was visiting her mother six hours’ drive away. She needed her laptop. They do not own a desktop, and her dad was at our house on a business trip with his laptop in tow. Do not underestimate the utility of just outfitting houses that you/spouse spend a fair amount of time at with at least functional computers and such. I put MoCA and three access points in their house as a Christmas gift. It cost me $500 and about two hours of work, but I have never gotten another call about bad WiFi. I bought an AppleTV for their house just to have a Tailscale endpoint. I think they will eventually end up actually using it as an AppleTV, but until then, it’s my door into their network (and another private VPN service for me). My 2008-era spare laptop isn’t snappy, and it’s not in good shape. But it boots Windows and Linux, and in the absence of anything else it can at least SSH and web-browse, write a USB drive, etc.
  - Aloha 2y ago
    You would be amazed how many normal people dont have a computer - they have an iPad and an iPhone (or android similars), and yeah - its like that now.
    - devilbunny 2y ago
      I would not, but quite a lot of HN readers might. I suppose that if you don’t know how to use the computer as anything more than a tablet with a keyboard and mouse, it probably makes little difference. Airport security used to go ape when they scanned my personal bag. Nowadays it seems they have largely accepted that yes, two people might need two laptops, two tablets, four phones (primary plus backup for each), two eInk readers, two cameras, at least two USB battery banks, and a giant bag of chargers and cables for everything, but at least I’m not caught flat-footed if things go south. It’s heavy, it’s not fun to carry, but it does the job. And neither of us works in tech.
brianpan 2y ago
As a former hardware engineer, if it can be restored wirelessly or otherwise, it's not a brick yet. Keep trying, you'll get there! ;)
- trash_cat 2y ago
  semi-brick
  - DonHopkins 2y ago
    Brick Different!
- fragmede 2y ago
  Keep trying to de-dramaticize language, you'll get there! Seriously though, the last time I truely bricked something was because I overwrote the bootloader on a chip that had no other way to flash, and it was an all-in-one, so I couldn't solder to the chip and reprogram it directly. Now that was a brick. A board that I can still solder to a chip and bus pirate my way to victory, isn't a brick. Being able to do so wirelessly? psh. Edit: I'm remembering now, that hardware was an Apple keyboard. I wanted to flash the firmware so I could have capslock be left Ctrl in hardware, but I flashed the wrong thing and then could not flash an updated image to it.
  - freedomben 2y ago
    > I wanted to flash the firmware so I could have capslock be left Ctrl in hardware You're a person after my own heart. If there is a God, you're doing his/her/their work. What was the hardware and firmware you were flashing?
    - HKH2 2y ago
      Why have three Ctrl keys? Why not use an empty modifier and have your own shortcut keys that you can guarantee no other program uses?
ChocolateGod 2y ago
> Apple's latest devices apparently come equipped with a dedicated recovery partition Didn't they always have this, minus the wireless functionality, isn't that the entire point of DFU/Recovery Mode?
- mdaniel 2y ago
  Well, pedantically DFU allows injecting someone else's recovery partition, usually from a computer over USB but probably from Apple's CDN if they have the equivalent of macOS's "Internet Recovery." What I'm guessing this change provides is that the iPhone itself carries a recovery partition, and based on the language allows pseudo-AirDrop-ing it to someone else
alliao 2y ago
this is the sort of functionality that only appears when the pain in the retail is felt by the corp. though can't say I think it's a good idea though.. feels like a free rein for state level adversaries...
- bpye 2y ago
  Presumably the signing requirements are the same as the normal USB DFU process?
- wmf 2y ago
  At smaller scale if a problem affects 1 out of 100,000 customers you just eat it. But at Apple's scale and profit margin they can afford to fix it.
  - MBCook 2y ago
    This may be an outgrowth that just sort of fell out of their project to allow updating the software on iPhones in the box. they did that so people wouldn’t buy a new phone that had been sitting on the shelf for a few weeks or whatever and then immediately have to update the OS. By using a special device they designed they can power up and update the phone with the latest OS in the box so buyers are almost always up-to-date when it hits their hands. But the fact that they did all that probably means that they had everything they needed to do this. Or maybe that’s how they “update” the phone, they don’t update the OS like a user would they just reflash it completely.
- grishka 2y ago
  > though can't say I think it's a good idea though.. feels like a free rein for state level adversaries... All iOS devices have secure boot that (unfortunately) can't be disabled.
  - fragmede 2y ago
    Most ;)
1-6 2y ago
Imagine the ramifications of this. I’m not a technician for any secret agents but I can see how this will make black hat attendees very excited.
- tsujamin 2y ago
  Yeah that they are confident enough in their chain of trust to allow this says a lot I think
supportengineer 2y ago
Not bricked if it can be fixed.
irobeth 2y ago
Locked iPhone owned by law enforcement target will accept remote firmware push from trusted device?
- olliej 2y ago
  It _sounds_ like this is just the standard restore path, only now it can be done wirelessly. Restore/DFU is an erase all content path - there are some cases where restore can avoid erasing the old data, but that path requires the device pin, and if you know the pin, then you definitionally don't need to jump through any hoops to unlock the device.
- astrange 2y ago
  iOS restore doesn't trust anything; that's why you need an internet connection to do it. This proxies the internet connection. https://support.apple.com/guide/security/secure-software-updates-secf683e0b36/web https://support.apple.com/guide/security/secure-software-upd...
heraldgeezer 2y ago
ooh sounds very exploitable! Would be interested in a deep dive. How "bricked" is recovery mode? Kernel borked? Like PSP pandora battery?
- zamadatix 2y ago
  This looks to be about enabling the "bricked" (as in not recoverable without external tools, in this case) iPhone to receive the recovery image over wireless connection as an alternative to receiving it over a wire. All of the same protections around needing to be a signed image, a device not on Apples stolen/banned list, and needing to be done from an iPhone already asking for recovery (i.e. it's not some state you push wireless TO the device, it's something it requests and other devices can accept helping with) stay in place regardless if the data is received over a wire or now wirelessly. At most the exploitability change here would be in removing the requirement to have another device connected via cable to execute some set of attacks that break the actual security steps.
gnabgib 2y ago
Source article iPhone 16 firmware can now be restored wirelessly from another iPhone https://9to5mac.com/2024/09/17/iphone-16-firmware-restored-wirelessly/ https://9to5mac.com/2024/09/17/iphone-16-firmware-restored-w...
spoonjim 2y ago
I've never heard of a "bricked" iPhone. I didn't think you could flash its firmware outside of official methods so how exactly would you brick it?
- eqvinox 2y ago
  You can always have something (e.g. overheat, battery failure, cosmic ray, …) go wrong during an "official method" and leave it in a bad state.
circularfoyers 2y ago
I still don't understand why Apple haven't changed their update model to A/B partitions, so if an update can't boot, it boots the previous partition. Android has been doing this for a while and Fedora Silverblue/IoT does the same thing, both of which I've found really useful in the past. If communicated well, it would elviate the update anxiety many people I know have with their iPhones.
- wmf 2y ago
  How much space should they reserve for iOS 24?
  - BonoboIO 2y ago
    Sell the base 128GB model that will be too small pretty soon and sell the cloud storage. Win win.
- yjftsjthsd-h 2y ago
  > and Fedora Silverblue/IoT does the same thing, Silverblue uses ostree, which AIUI uses hard links in a single filesystem. This is probably better most of the time, because it means minimal storage overhead, though it means you can't change filesystems over an update and you don't resist filesystem corruption.
- MBCook 2y ago
  What percentage of iPhones actually require DFU after a bad iOS upgrade? I’ve had iPhones since the 3GS and never experienced it, neither have anyone I’ve known. I’m sure it happens, but I suspect it’s really rare.
- dwaite 2y ago
  It will not be able to reliably work with the A partition once B boots the first time - the update process even for many minor releases will trigger local and cloud data upgrades, and there are security reasons to not leave the option to leave older/unpatched versions runnable. I don't think I've had a software update fail since iOS 7 beta 1 - and that was an issue with updating local data on first boot, so any attempt to revert to the prior OS without a wipe would have been pointless.
milabogdanova 2y ago
[dead]
system2 2y ago
Funny nobody is asking why a flagship gets bricked in the first place. Also, the author probably doesn't understand the meaning of brick. Bricked means bricked. Dead beyond recovery without doing some extraordinary stuff.
FloatArtifact 2y ago
I get the feeling in the future Apple wants to kill the usb c port and lock down the iPhone a access with the proprietary wireless only protocol.
deleted 2y ago
[deleted]

113 points by impish9208 2y ago

mdaniel 2y ago

If that can be done "off grid," then I welcome it because it's likely a jailbreak vector

avianlyric 2y ago
Not a chance. iOS installs are cryptographically bound to the hardware itself installed on. It’s not possible to get an iPhone to boot an iOS install without an Apple server providing that cryptographic binding.
- 0l 2y ago
  Assuming it's implemented properly, that is. The whole reason Jailbreaks exist is due to bugs in Apple's implementations.
  - gjsman-1000 2y ago
    Almost certainly not affected; even if this new recovery mode had no signature verification at all, you would have to deal with Apple’s impenetrable-since-A12 secure boot.
- mdaniel 2y ago
  Well, one will observe that I said "off grid," because I was acutely aware of the desire for them to approve OS reinstalls I know, "but muh sekurity" and all that, but when the grandkids find an antique iPhone 16 in a barn somewhere, and want to install an iOS image upon it to see how things were in the old-times, I want that to be technically possible even after Apple shuts down the old gatekeeping servers
  - astrange 2y ago
    That's not possible because the requirement is built into the ROM. They'd have to release the keys and then you could emulate it.
deleted 2y ago
[deleted]
explaininjs 2y ago
Curious what you want from a jailbreak at this point? It seems all of the old things that were actually helpful have found them into first party software, or at least in the sanctioned third party. (internet tethering, emulators, side loaded apps, etc.)
- fragmede 2y ago
  Internet tethering is actually one that's gone backwards, with "unlimited" cellphone plans that are limited when tethering. Or plans that disable tethering even though all the software is there. The other thing from a jailbreak would be for it to become self hosting, that is, give the ability to make full blown iPhone ipa on an iOS device without needing a macOS device anywhere at all.
  - explaininjs 2y ago
    As someone who does a ton of networking/routing at the link layer for a day job, I can definitely see why they’re taking measures to reduce bandwidth hogs - to the extent I might actually prefer to be on a network that has taken measures to reduce hogging vs one that has not. When it really truly matters, like when I have a business need to download huge items in remote areas, the $10/GB+ justifies itself.
    - Dylan16807 2y ago
      Ironically, downloading huge items is easy to do without tethering. And video streaming, probably most people's biggest bandwidth use, fits very well on phones. Does anyone offer a tethering plan that's rate limited but not data limited?
      - dwaite 2y ago
        > Does anyone offer a tethering plan that's rate limited but not data limited? T-Mobile in the US; they give you a set amount of high-speed tethering based on your plan, then it rate limits severely until the end of the billing cycle unless you upgrade your plan or buy a a pack of data.
ElFitz 2y ago
And just like the original PSP’s batteries, you would be able to jailbreak an iPhone simply using a jailbroken iPhone.

Brajeshwar 2y ago

Will this not increase the economic value of stealing iPhones? Right now, in India, iPhone sales compete with used iPhones. With an option to unbrick phones, what methods are preventing a new market of “Chor-Bazaar for iPhones” (market for stolen iPhones)?

kylehotchkiss 2y ago
I am so happy to see a chor bazaar reference here. I got one of my antique SLR cameras from there!
toymin 2y ago
Pretty sure this doesn't remove Activation Lock so it shouldn't make a difference
brigade 2y ago
Bricked as in doesn’t boot the OS, not bricked as in unable to be activated.
- Brian_K_White 2y ago
  Then it's not a brick. Why is the term "bricked" in the first place? Because of the utterly dead properties of a brick. The whole point was a visceral image of just how not remotely recoverable under any circumstances, vs merely a little extra effort can recover. An unformatted empty computer with no os is not a brick in the same way a cd player with no cd inserted is not a brick. It's still fully functional.
  - Dylan16807 2y ago
    Okay, fine, but you're replying in the wrong spot. The point being made here is the difference between broken and locked, regardless of whether it's a little broken or very broken.
dangsux 2y ago
[dead]

lofaszvanitt 2y ago

w o w what could go wrong

olliej 2y ago
I'm not sure? what is the threat you're concerned about here? My reading of this is that it's just removed the requirement to use a wired connection to a laptop to restore a phone that is already in DFU/restore mode - I'm not sure what attack/flaw you get from allowing the recovery path over wifi that would not already be an option with the existing wired path?
- MBCook 2y ago
  Well, IF you have an exploit capable of bypassing all iPhone security you could now use it by setting something on someone’s phone for a few minutes instead of plugging into it. Is that useful? Maybe. No fingerprints? Of course you still need that billion dollar exploit first.
  - olliej 2y ago
    You can't bypass "all iPhone security" - this is a restore path: the phone is already in a state where it cannot boot, and cannot access user data. Once an iPhone is in a restore state (restore mode or DFU which afaict are only marginally different) it cannot do anything except install a new OS. If an iPhone is in a restore mode it is not in an "update the device mode" it's in a "the OS is dead and the user data is gone by default". There are _some_ restore paths it is possible to not lose all of the data on the device, but that requires the user (on the device) to provide their passcode during the restore, and I think even requires their iCloud password to get through activation lock, and it takes like an hour to complete. There's fundamentally no reason that this should be less secure than the existing state where restore requires a wired connection to a laptop.
    - MBCook 2y ago
      Right. I was saying hypothetically if you had a big enough chain of exploits for all the various protections Apple has then this may let you use them without physically touching the device, only being really close. But if you had that chain of exploits, who cares. You already won the game. So I don’t think this matters to security.

SheinhardtWigCo 2y ago

This is presumably in preparation for removing USB-C next year?

teruakohatu 2y ago
The latest AirPods have usb-c, with the higher tier also including wireless charging. If there was ever a device category to remove usb-c it would be AirPods (which would still be a terrible idea)
- derefr 2y ago
  I would argue the opposite: AirPods are a pure "client" device — they need to be connected to by something, they don't connect to something; and they have no display, input method, or other means to initiate/change Bluetooth pairing, if the state of the firmware somehow gets in a mucked-up state and they need to be flashed. The only possible way to recover broken AirPods is via tethered recovery. An iPhone is the opposite: both a "client" and a "host", with plenty of options (in theory) for interactively initiating and configuring a wireless recovery boot. Almost capable enough (again, in theory) to be used for standalone debugging of its own hardware faults (like you'd do with a PC using a live USB image.) For 99% of faults, an iPhone should be capable of non-tethered recovery — if Apple would just write the firmware so as to enable that. And the other 1% of the time, you've probably got at least one failed critical hardware component preventing early boot. At which point "flashing the OS" would be the least of your concern; and instead, you'd just take the thing into the Genius Bar, and they'd open it up, and then either tap into an interior debugging interface (as presumably they'll leave the lightning debug pins exposed as something like JTAG pads); or they'd temporarily swap the mainboard out into an "everything but the mainboard" recovery harness, flash it there, and then stick it back into the phone. At which point they could then use the recovered base firmware's recovery mode to QC the rest of the hardware!
  - ssl-3 2y ago
    > I would argue the opposite: AirPods are a pure "client" device — they need to be connected to by something, they don't connect to something; and they have no display, input method, or other means to initiate/change Bluetooth pairing, if the state of the firmware somehow gets in a mucked-up state and they need to be flashed. The only possible way to recover broken AirPods is via tethered recovery. Huh? The charging case (which is an integral part of the system known as "Airpods") has a display (LED indicator) and an input method (a pushbutton).

GeekyBear 2y ago

Needing to connect an iDevice that wouldn't boot to a PC or Mac in order to restore a factory OS image wasn't exactly a high bar to get over, but this does give you another option for recovery.

devilbunny 2y ago
It isn’t for most people here. But the most valuable tool for fixing a broken computer is a working one, and a lot of people don’t have more than one anymore. Some don’t even have that. My wife texted me on Friday as she was visiting her mother six hours’ drive away. She needed her laptop. They do not own a desktop, and her dad was at our house on a business trip with his laptop in tow. Do not underestimate the utility of just outfitting houses that you/spouse spend a fair amount of time at with at least functional computers and such. I put MoCA and three access points in their house as a Christmas gift. It cost me $500 and about two hours of work, but I have never gotten another call about bad WiFi. I bought an AppleTV for their house just to have a Tailscale endpoint. I think they will eventually end up actually using it as an AppleTV, but until then, it’s my door into their network (and another private VPN service for me). My 2008-era spare laptop isn’t snappy, and it’s not in good shape. But it boots Windows and Linux, and in the absence of anything else it can at least SSH and web-browse, write a USB drive, etc.
- Aloha 2y ago
  You would be amazed how many normal people dont have a computer - they have an iPad and an iPhone (or android similars), and yeah - its like that now.
  - devilbunny 2y ago
    I would not, but quite a lot of HN readers might. I suppose that if you don’t know how to use the computer as anything more than a tablet with a keyboard and mouse, it probably makes little difference. Airport security used to go ape when they scanned my personal bag. Nowadays it seems they have largely accepted that yes, two people might need two laptops, two tablets, four phones (primary plus backup for each), two eInk readers, two cameras, at least two USB battery banks, and a giant bag of chargers and cables for everything, but at least I’m not caught flat-footed if things go south. It’s heavy, it’s not fun to carry, but it does the job. And neither of us works in tech.

brianpan 2y ago

As a former hardware engineer, if it can be restored wirelessly or otherwise, it's not a brick yet. Keep trying, you'll get there! ;)

trash_cat 2y ago
semi-brick
- DonHopkins 2y ago
  Brick Different!
fragmede 2y ago
Keep trying to de-dramaticize language, you'll get there! Seriously though, the last time I truely bricked something was because I overwrote the bootloader on a chip that had no other way to flash, and it was an all-in-one, so I couldn't solder to the chip and reprogram it directly. Now that was a brick. A board that I can still solder to a chip and bus pirate my way to victory, isn't a brick. Being able to do so wirelessly? psh. Edit: I'm remembering now, that hardware was an Apple keyboard. I wanted to flash the firmware so I could have capslock be left Ctrl in hardware, but I flashed the wrong thing and then could not flash an updated image to it.
- freedomben 2y ago
  > I wanted to flash the firmware so I could have capslock be left Ctrl in hardware You're a person after my own heart. If there is a God, you're doing his/her/their work. What was the hardware and firmware you were flashing?
  - HKH2 2y ago
    Why have three Ctrl keys? Why not use an empty modifier and have your own shortcut keys that you can guarantee no other program uses?

ChocolateGod 2y ago

> Apple's latest devices apparently come equipped with a dedicated recovery partition Didn't they always have this, minus the wireless functionality, isn't that the entire point of DFU/Recovery Mode?

mdaniel 2y ago
Well, pedantically DFU allows injecting someone else's recovery partition, usually from a computer over USB but probably from Apple's CDN if they have the equivalent of macOS's "Internet Recovery." What I'm guessing this change provides is that the iPhone itself carries a recovery partition, and based on the language allows pseudo-AirDrop-ing it to someone else

alliao 2y ago

this is the sort of functionality that only appears when the pain in the retail is felt by the corp. though can't say I think it's a good idea though.. feels like a free rein for state level adversaries...

bpye 2y ago
Presumably the signing requirements are the same as the normal USB DFU process?
wmf 2y ago
At smaller scale if a problem affects 1 out of 100,000 customers you just eat it. But at Apple's scale and profit margin they can afford to fix it.
- MBCook 2y ago
  This may be an outgrowth that just sort of fell out of their project to allow updating the software on iPhones in the box. they did that so people wouldn’t buy a new phone that had been sitting on the shelf for a few weeks or whatever and then immediately have to update the OS. By using a special device they designed they can power up and update the phone with the latest OS in the box so buyers are almost always up-to-date when it hits their hands. But the fact that they did all that probably means that they had everything they needed to do this. Or maybe that’s how they “update” the phone, they don’t update the OS like a user would they just reflash it completely.
grishka 2y ago
> though can't say I think it's a good idea though.. feels like a free rein for state level adversaries... All iOS devices have secure boot that (unfortunately) can't be disabled.
- fragmede 2y ago
  Most ;)

1-6 2y ago

Imagine the ramifications of this. I’m not a technician for any secret agents but I can see how this will make black hat attendees very excited.

tsujamin 2y ago
Yeah that they are confident enough in their chain of trust to allow this says a lot I think

supportengineer 2y ago

Not bricked if it can be fixed.

irobeth 2y ago

Locked iPhone owned by law enforcement target will accept remote firmware push from trusted device?

olliej 2y ago
It _sounds_ like this is just the standard restore path, only now it can be done wirelessly. Restore/DFU is an erase all content path - there are some cases where restore can avoid erasing the old data, but that path requires the device pin, and if you know the pin, then you definitionally don't need to jump through any hoops to unlock the device.
astrange 2y ago
iOS restore doesn't trust anything; that's why you need an internet connection to do it. This proxies the internet connection. https://support.apple.com/guide/security/secure-software-updates-secf683e0b36/web https://support.apple.com/guide/security/secure-software-upd...

heraldgeezer 2y ago

ooh sounds very exploitable! Would be interested in a deep dive. How "bricked" is recovery mode? Kernel borked? Like PSP pandora battery?

zamadatix 2y ago
This looks to be about enabling the "bricked" (as in not recoverable without external tools, in this case) iPhone to receive the recovery image over wireless connection as an alternative to receiving it over a wire. All of the same protections around needing to be a signed image, a device not on Apples stolen/banned list, and needing to be done from an iPhone already asking for recovery (i.e. it's not some state you push wireless TO the device, it's something it requests and other devices can accept helping with) stay in place regardless if the data is received over a wire or now wirelessly. At most the exploitability change here would be in removing the requirement to have another device connected via cable to execute some set of attacks that break the actual security steps.

gnabgib 2y ago

Source article iPhone 16 firmware can now be restored wirelessly from another iPhone https://9to5mac.com/2024/09/17/iphone-16-firmware-restored-wirelessly/ https://9to5mac.com/2024/09/17/iphone-16-firmware-restored-w...

spoonjim 2y ago

I've never heard of a "bricked" iPhone. I didn't think you could flash its firmware outside of official methods so how exactly would you brick it?

eqvinox 2y ago
You can always have something (e.g. overheat, battery failure, cosmic ray, …) go wrong during an "official method" and leave it in a bad state.

circularfoyers 2y ago

I still don't understand why Apple haven't changed their update model to A/B partitions, so if an update can't boot, it boots the previous partition. Android has been doing this for a while and Fedora Silverblue/IoT does the same thing, both of which I've found really useful in the past. If communicated well, it would elviate the update anxiety many people I know have with their iPhones.

wmf 2y ago
How much space should they reserve for iOS 24?
- BonoboIO 2y ago
  Sell the base 128GB model that will be too small pretty soon and sell the cloud storage. Win win.
yjftsjthsd-h 2y ago
> and Fedora Silverblue/IoT does the same thing, Silverblue uses ostree, which AIUI uses hard links in a single filesystem. This is probably better most of the time, because it means minimal storage overhead, though it means you can't change filesystems over an update and you don't resist filesystem corruption.
MBCook 2y ago
What percentage of iPhones actually require DFU after a bad iOS upgrade? I’ve had iPhones since the 3GS and never experienced it, neither have anyone I’ve known. I’m sure it happens, but I suspect it’s really rare.
dwaite 2y ago
It will not be able to reliably work with the A partition once B boots the first time - the update process even for many minor releases will trigger local and cloud data upgrades, and there are security reasons to not leave the option to leave older/unpatched versions runnable. I don't think I've had a software update fail since iOS 7 beta 1 - and that was an issue with updating local data on first boot, so any attempt to revert to the prior OS without a wipe would have been pointless.

milabogdanova 2y ago

[dead]

system2 2y ago

Funny nobody is asking why a flagship gets bricked in the first place. Also, the author probably doesn't understand the meaning of brick. Bricked means bricked. Dead beyond recovery without doing some extraordinary stuff.

FloatArtifact 2y ago

I get the feeling in the future Apple wants to kill the usb c port and lock down the iPhone a access with the proprietary wireless only protocol.

deleted 2y ago

[deleted]