Researchers Devise Malware That Runs When an iPhone is Powered Off

Engineers and security experts at Germany’s Technical University of Darmstadt created wireless malware and loaded it onto a Bluetooth chip to test its effect on an iPhone that had been powered off. Executing the Bluetooth chip inflicted the iPhone with the malware, proving the popular smartphone isn’t safe from attack just because it isn’t on.

This is possible thanks to what Apple calls “low-power mode,” or LPM, which keeps most of the phone’s wireless chips running even after the device has been powered off. In some cases, this is a godsend: it’s LPM that allows users to frantically locate their lost iPhone via the Find My network, even after the phone has died or been turned off. Users are also able to access their Express cards in LPM, allowing them to pass through transit terminals or pay for goods and services regardless of their phone’s battery level.

But LPM also provides a prime opportunity for bad actors who are motivated to exploit an otherwise good thing. The Bluetooth and ultra-wideband (UWB) chips in an iPhone are hard-wired to a near field communication (NFC) chip’s secure element, and the device’s power management unit keeps these elements powered on. This means the parts of LPM that are useful to users—AKA location-tracking, credit cards, and personal transit passes—remain open to attack at all times.

In a paper published last week, the researchers point out that this vulnerability has previously been a concern for journalists attempting to defend themselves against potential espionage. “Since LPM support is implemented in hardware, it cannot be removed by changing software components,” they write. “As a result, on modern iPhones, wireless chips can no longer be trusted to be turned off after shutdown.” This could provide an opening for attackers to disable an iPhone’s Find My network and steal the device, or use Express Mode to steal the user’s financial or physical assets.

It’s worth pointing out that the researchers used a jailbroken iPhone to conduct the experiment. This means that the average out-of-the-box iPhone user is unlikely to experience an attack like the one simulated here—but that doesn’t mean Apple’s constantly-running LPM features are impervious to manipulation. If Apple’s LPM-associated elements aren’t protected by firmware, they’re vulnerable, whether the iPhone they’re inside of is jailbroken or not.

The researchers say they alerted Apple to these vulnerabilities. Apple reportedly read the researchers’ paper but “had no feedback on the paper’s contents.”

Continue reading

Scientists Confirm the Presence of Water on the Moon

Scientists have confirmed the discovery of molecular water on the moon. Is there any of it in a form we can use? That's less clear.

Review: The Oculus Quest 2 Could Be the Tipping Point for VR Mass Adoption

The Oculus Quest 2 is now available, and it's an improvement over the original in every way that matters. And yet, it's $100 less expensive than the last release. Having spent some time with the Quest 2, I believe we might look back on it as the headset that finally made VR accessible to mainstream consumers.

SpaceX Launches ‘Better Than Nothing’ Starlink Beta

Those lucky few who have gotten invitations to try the service will have to pay a hefty up-front cost, and the speeds aren't amazing. Still, it's a new generation of satellite internet.

Samsung, Stanford Built a 10,000 PPI Display That Could Revolutionize VR, AR

Ask anyone who has spent more than a few minutes inside a VR headset, and they'll mention the screen door effect. This could eliminate it for good.