7 ms·
New Apple security feature reboots iPhones after 3 days, researchers confirm
- ryandrake 2y agoWonder how they've determined it's a deliberate feature and not some memory leak or something that takes 72 hours to manifest.
- RockRobotRock 2y ago"inactivity reboot" is in the device logs. https://www.magnetforensics.com/blog/understanding-the-security-impacts-of-ios-18s-inactivity-reboot/ https://www.magnetforensics.com/blog/understanding-the-secur...
- saagarjha 2y ago> While Apple has a great set of documentation around their security features lol I wish
- astrea 2y agoA memory leak that causes a full-system reboot after exactly 72 hours?
- stavros 2y agoA very finely tuned memory leak.
- saagarjha 2y agoReverse engineering.
- gnabgib 2y agoPreviously (36 points, 6 days ago, 24 comments) https://news.ycombinator.com/item?id=42090636 https://news.ycombinator.com/item?id=42090636 Related Cops suspect iOS 18 iPhones are communicating to force reboots (234 points, 7 days ago, 288 comments) https://news.ycombinator.com/item?id=42081874 https://news.ycombinator.com/item?id=42081874
- xk_id 2y agoI just want to point and shame this top-voted comment [0] that dismissed with the characteristic self-assurance of the armchair specialist the very possibility of it; and all the users who upvoted it, purely because it sounded like a “rational opinion”; and all the users who impulsively downvoted my post which provided partial evidence to the contrary. [0] https://news.ycombinator.com/item?id=42083555 https://news.ycombinator.com/item?id=42083555
- LegionMammal978 2y agoThey are forcing reboots, but they aren't communicating with each other to force reboots, as the article was speculating, and as the commenter was arguing against. Instead, it's just a 72-hour clock. Also, they were calling the networking hypothesis "far fetched" and "pretty unlikely", not "impossible". I had also considered that hypothesis far-fetched, because it wouldn't just need the existence of local communication, it would also need a special protocol, trigger conditions, false-positive prevention, etc., all for that one feature.
- Etheryte 2y agoDon't be petty, it's not good for you. Besides, as is, their comment is still accurate and a great addition to the discussion.
- xk_id 2y agoThe vehement tone was unwarranted and encouraging an attitude of self-assured “common sense” is very problematic, when there are many agents, both commercial and political, who can use it to avoid suspicion about their closed source ecosystems.
- Etheryte 2y agoFrom the HN guidelines [0]: > Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. [0] https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- SoftTalker 2y agoIf this is true, then it's a trivial enhancement to make that a configurable setting. 72 hours could be the default, if your security needs are higher, you could turn that down to 12 hours, or even less.
- itake 2y agoI agree, but it sounds like apple is choosing 72 hours to give time for the cops, because cops are more coordinated than criminals?
- xethos 2y agoI wouldn't assume this is explicitely to help LEO, but more because this is (AFAIK) the first time this is being trialed by Apple. 72 hours is a touch long, IMO (and based on some comments, it's not just me), but when your update touches millions of devices, it's also best to test thoroughly and have the first iteration be too long rather than too short. It's easy to drop the 72 hours in a future update, or tie a shorter delay to (as I believe Apple calls it) Lockdown Mode - the more important thing might be to keep the "It just works" assumption most people (myself not included) seem to have vis-a-vis Apple products. Notably, I assume it will never be user-configurable directly. Possibly through Lockdown Mode ("If enabled then shorter delay"), but I wouldn't count on Apple adding an explicit setting.
- macintux 2y agoI’m betting it’ll be configurable via MDM.
- alwillis 2y agoI’m assuming the ability to configure this will be added to Apple Configurator at some point. Any savvy user can download it for free. I used it recently to create a profile for a friend I’m working with to configure their email account. If you’re the tech person for your friends and family, Apple Configurator is quite handy: https://support.apple.com/guide/apple-configurator-mac/intro-to-apple-configurator-cadf1802aed/mac https://support.apple.com/guide/apple-configurator-mac/intro...
- jsjohnst 2y agoWish this could be reduced lower. If I don’t unlock my phone in a day, something is up and extra paranoia is warranted.
- petesergeant 2y agoAnd for minimal hassle if you just hadn’t touched your phone. 12 hours would work great for me.
- aaomidi 2y agoI think you may be able to do something like this with a shortcut.
- rcMgD2BwE72F 2y ago18h is the default on GrapheneOS IIRC. Got my phone stolen abroad days ago with tones of sensitive data and that features was a big reassurance. I set it to 6h I believe.
- yonatan8070 2y agoI tried to do it using Tasker on my crDroid device, but it requires the phone to be rooted, which mine isn't since some apps detect it and throw a fit.
- astrea 2y agoAfter reading your comment, I was interested in whether or not I could achieve this through the built-in Shortcuts app. Unfortunately, "Restart" is not an available action. Edit: Actually, I was looking in the wrong place. It’s an option for the "Shut Down” action. Thanks, @jwond!
- noident 2y agoThis "novel" feature is already supported by GrapheneOS and set to trigger after 18 hours by default, with the option for the user to adjust it to their preference. There is no good reason to force the choice of 72 hours on everybody. That's a user-hostile design decision.
- faggotbreath 2y ago[dead]
- Twisell 2y agoIt's probably more of a tradeoff. This longer delay won't prompt hectic headlines about users angry about random reboot, it is long enought so federal agencies won't publicly react and plea Trump for their backdoor again, and it is a low profile update that won't necessarily be noticed beside tech circles thus "small fry" bad actors won't know how to correctly cover their back. A user hostile design would have been to never implement it in the first place. It's basically Apple's signature to choose generic default value and don't bother the user (for the better and sometimes the worse).
- mouse_ 2y agoI remember the first time I ever saw the camera flash used as a flashlight was a feature in Cyanogenmod 7. Wifi hotspot from your phone started as a Cydia app, when legitimate apps weren't particularly useful yet. Hacks have always brought the coolest features to phones, but OEMs have made them less accessible than ever :(
- casper14 2y agoHow is Graphene working for you?
- AzzyHN 2y agoNot OP, but very well!! The only things that don't work for me are Google Pay and Android Auto, which is a shame but I can live without both of those.
- fatcow 2y agoQuestion: is the apple reboot seriously displaying a dmesg log?
- wmf 2y agoI assume that's a Security Research Device. https://security.apple.com/research-device/ https://security.apple.com/research-device/
- duskwuff 2y agoIt is. You can see a SRD screen pop up briefly before the boot messages.
- Twisell 2y agoI guess not in final release, but security researchers used the developer beta, probably with some verbose mode enabled.
- BenFranklin100 2y agoIt annoys me to no end to listen to the Android/Google apologists claim that Apple does not care about security and privacy.
- xethos 2y agoPresumably because they disagree about what should be kept private from whom, and whether the user should be allowed to be in control of the security of the hardware. Apple will vouch for applications running on, for example, MacOS. They'll check the developer's account is still in good standing, and will prevent apps from launching without this check. Sometimes this (arguably) helps. Other times it hurts [0]. And while I disagree with the choices made, these are valid trade-offs. Apple will tie things like the hardware for FaceID, to a specific phone, and require it be re-paired by an Apple authorized technician. Sometimes this is bad - just look at any Right to Repair thread. Sometimes this is good - Evil Maid attacks don't occur often, but it's easy enough (from Apple's POV) to block them that it would almost be irresponsible not to. There is room for these discussions, but it's geared more towards how one views general-purpose computing devices, IMO, and can't really be answered in a flamewar-style "Apple is evil" type of environment. [0] https://www.theverge.com/2020/11/12/21563092/apple-mac-apps-load-slow-big-sur-downloads-outage-down-issues https://www.theverge.com/2020/11/12/21563092/apple-mac-apps-...
- Rinzler89 2y ago[flagged]
- hulitu 2y agoThey do care. Read carefully the TOS. /s
- arcticbull 2y agoPeriodic reboots are actually a PCI requirement for payment terminals heh, basically every point of sale on the market reboots every 24h.
- Gigachad 2y agoSeems like a good defence in depth strategy. These days most systems have a pretty good boot chain security, so after a reboot you know the system is in a valid state and any potential malicious changes have been flushed out.
- DaiPlusPlus 2y agoProbably also helps with other kinds of transient hardware faults (and cosmic-rays) that can cause bitflips. That said, on principle, there is no reason why ECC RAM should not be the standard (c.f. Linus Torvald’s ire at Intel using ECC as a market-segmentation ploy)
- close04 2y ago> reboots the phone if it’s not unlocked for 72 hours Scheduled reboots would help more with clearing malware or transient errors. But for now, for anyone periodically using the phone, which I bet is most users, the phone will never reboot automatically.
- derefr 2y agoNot never; phones also reboot when there are critical OS updates to apply — and that happens as long as the phone is both charging and locked at any time during a vendor-defined daily maintenance window (usually something like 2AM-4AM in the user's local time.) This happens even if the user just put the phone to sleep a moment ago. The only way to prevent it is to never leave your phone locked and charging at the same time.
- close04 2y ago
- philipov 2y ago> law enforcement officers and forensic experts were concerned that some iPhones were rebooting themselves under mysterious circumstances, which made it harder for them to get access to the devices and extract data. > iOS 18 comes with improved anti-theft measures. Three days w/o unlock, the iPhone will reboot, preventing thieves from getting your data. It's poetic, isn't it?
- starfezzy 2y agoI would be ok with 8 hours during daytime, and some smart functionality for sleepy time. After all it’s just a reboot. I can’t remember the last decade I didn’t unlock my phone during the daytime.
- justahuman74 2y agoI'd like to be able to specify much shorter times than 3 days, I could have my phone reboot every night while sleeping if possible
- aryan14 2y agoVery good suggestion, however I’m not sure if it’s healthy for a phone to reboot 365d/year?
- dcow 2y agoWhy not?
- readyplayernull 2y agoBecause it's healthy to take some days off
- MR4D 2y agoMaybe it should reboot every day for 5 days and then not reboot for 2 days. Of course, that would be week security. /ducks
- tlyleung 2y agoI get that a locked phone needs to have everything already in memory, but what technical hurdles are stopping Apple from making a locked phone as secure as a rebooted phone?
- Shank 2y agoIn the BFU state, notification previews, contact information for incoming calls, and other user-specific data is locked because it’s not decrypted. These things would also change the user experience dramatically, so that’s why Apple doesn’t do it.
- deleted 2y ago[deleted]
- ghostpepper 2y agoThere's a good discussion of how this is implemented cryptographically https://www.youtube.com/watch?v=BLGFriOKz6U https://www.youtube.com/watch?v=BLGFriOKz6U
- oarsinsync 2y ago> what technical hurdles are stopping Apple from making a locked phone as secure as a rebooted phone I think the hurdles are not technical, but based around user experience.
- latchkey 2y agowhat about my Apple Watch?
- Jiahang 2y agoSometimes when I turn off my iPhone for a while, it turns on by itself.
- hulitu 2y agoThis is a feature. For your security. Also Bluetooth is on when the phone is turned off, for FindMy and remote exploits. /s
- switch007 2y agoIt's quite clear Apple wants /their/ devices connected regularly and you don't have a choice. - iPhones powering themselves on - the various defaults on MacOS to connect while sleeping - the "bugs" in Sequoia on desktop (it refuses to sleep. Tries for a few seconds then turns on the display again, not even locked!) - the subtle removal of the pulsating light while sleeping to an always on light while sleeping (subtle nudging) Now with the low power consumption of apple silicon they will easily convince people there is no need to sleep I fully expect my powered off Mac to turn itself on if it doesn't already do that. I should check that actually...
- saagarjha 2y ago…are you somehow pressing the power button?
- dcow 2y agoWhy not just go all the way and separate the program instruction memory from the data memory, physically? I know there’s an approximation of this at the page level, but why even let the kernel modify its own memory in the first place? Memory unit that only loads signed pages. etc.
- pdpi 2y agoWhat you're asking for is a Harvard architecture computer (as opposed to a von Neumann architecture). There's tradeoffs involved. Two things to keep in mind are that JITs are damn useful pieces of tech, so losing them is a pretty damn heft price to pay for that separation, and interpreters will still treat your data memory as program instruction memory, which limits the benefit.
- dcow 2y agoI know. My question is rhetorical. In a world where the only way to secure a VN machine is to reboot it every X seconds, at what point is reboot frequency so high that you might as well accept slower interpreters if it means you don’t have to reboot all the time? Or you run the kernel under a hypervisor and control the page security that way. JIT becomes a heavily scrutinized process between the kernel and hypervisor. JITed code is only ever executed in a clean address space. Etc. All the things browsers and kernels do poorly today.
- astrange 2y agoWhat is this a response to? This already happens though - the kernel can't modify its own code pages. But there are plenty remaining attacks like overwriting function pointers or other data.
- dcow 2y agoIf you can’t modify kernel memory then how do you overwrite function pointers? (I understand how rop works.) At some level you have to get privileged execution and doing so would be incredibly difficult if you can’t trick the kernel at some point after whatever amount of ropping you’ve done.
- EVa5I7bHFq9mnYK 2y agoAuto restart has existed in Samsung phones since Android 5 Lollipop, 10 years ago. Glad technological progress eventually makes its way to Apple.
- future10se 2y agoIt doesn't do the same thing security-wise, though. It's more of a "performance manager" (i.e. the same reason you'd reboot an old Windows PC). BFU (Before First Unlock, as described in the article) on an Android is pretty similar to an iPhone (data still locked down, notifs don't come in, apps not running). Only after you unlock the first time can apps start running and notifs come in. This is also the state where it's more vulnerable to attackers (cops or criminals). I have both an iPhone and an Android (currently a Z Fold 5, so a recent model). My Fold 5 does this auto-reboot every week. When it does reboot, my usual background apps come up, and notifs work as usual. This means that Android (or perhaps more accurately, OneUI — Samsung's custom stuff on top of Android) is not doing a "full" reboot, and thus isn't providing the same security benefits as Apple is by putting the phone in a "BFU" or "cold" state.
- realusername 2y agoI just tried on my S23+ and no, I don't get any app notification, I need to enter the pin code for that.
- themaninthedark 2y agoMy S22 Ultra also does not display notifications after reboot until after login with pin.
- future10se 2y agoAre we talking about the same thing? If I reboot manually then I don't get notifications until I enter my pin. But if my phone does the auto-reboot I do get notifs as usual. This screen: https://i.imgur.com/jRS7Ffx.png https://i.imgur.com/jRS7Ffx.png If there is a setting somewhere I can toggle so I get a "full" reboot, I would appreciate someone pointing it out to me.
- alsetmusic 2y agoI think 404Media was first to confirm this (I could be wrong). It’s a subscriber article and I couldn’t find an archive link with the full story, but they do good work and I encourage people to support their work. https://www.404media.co/apple-quietly-introduced-iphone-reboot-code-which-is-locking-out-cops/ https://www.404media.co/apple-quietly-introduced-iphone-rebo...
- noyesno 2y agoThis seems to break SMS-forwarding between iDevices. Found out the hard way when some package delivery notifications only arrived once I unlocked my secondary iPhone and opened the Messaging-app.
- firen777 2y agoThe young me would sing praise to this feature unconditionally. The current me can only think how this feature affects countries with proper due process a lot more than countries with easy access to rubber hose decryption. That being said, the selfish me will adopt this feature either way.
- wiredbox 2y ago[dead]
- iszomer 2y agoAnd here I thought setting up a cronjob to reboot my home AIO router nightly was a good thing, back in the days when I was rocking a WRT54G running OpenWRT; just to clear any lingering socket connections from excessive bittorrent usage.
- deleted 2y ago[deleted]