Researchers Devise Malware That Runs When an iPhone is Powered Off
Engineers and security experts at Germany’s Technical University of Darmstadt created wireless malware and loaded it onto a Bluetooth chip to test its effect on an iPhone that had been powered off. Executing the Bluetooth chip inflicted the iPhone with the malware, proving the popular smartphone isn’t safe from attack just because it isn’t on.
This is possible thanks to what Apple calls “low-power mode,” or LPM, which keeps most of the phone’s wireless chips running even after the device has been powered off. In some cases, this is a godsend: it’s LPM that allows users to frantically locate their lost iPhone via the Find My network, even after the phone has died or been turned off. Users are also able to access their Express cards in LPM, allowing them to pass through transit terminals or pay for goods and services regardless of their phone’s battery level.
But LPM also provides a prime opportunity for bad actors who are motivated to exploit an otherwise good thing. The Bluetooth and ultra-wideband (UWB) chips in an iPhone are hard-wired to a near field communication (NFC) chip’s secure element, and the device’s power management unit keeps these elements powered on. This means the parts of LPM that are useful to users—AKA location-tracking, credit cards, and personal transit passes—remain open to attack at all times.
In a paper published last week, the researchers point out that this vulnerability has previously been a concern for journalists attempting to defend themselves against potential espionage. “Since LPM support is implemented in hardware, it cannot be removed by changing software components,” they write. “As a result, on modern iPhones, wireless chips can no longer be trusted to be turned off after shutdown.” This could provide an opening for attackers to disable an iPhone’s Find My network and steal the device, or use Express Mode to steal the user’s financial or physical assets.
It’s worth pointing out that the researchers used a jailbroken iPhone to conduct the experiment. This means that the average out-of-the-box iPhone user is unlikely to experience an attack like the one simulated here—but that doesn’t mean Apple’s constantly-running LPM features are impervious to manipulation. If Apple’s LPM-associated elements aren’t protected by firmware, they’re vulnerable, whether the iPhone they’re inside of is jailbroken or not.
The researchers say they alerted Apple to these vulnerabilities. Apple reportedly read the researchers’ paper but “had no feedback on the paper’s contents.”
Continue reading
Musk: Tesla Was a Month From Bankruptcy During Model 3 Ramp-Up
The Model 3 almost spelled doom for Tesla, but the same vehicle also probably saved it.
Scientists Develop Nasal Spray That Can Disable Coronavirus
In a newly released study, the concoction was effective at deactivating the novel coronavirus before it could infect cells.
Asteroid Bennu Might Be Hollow and Doomed to Crumble
A new analysis from the University of Colorado Boulder’s OSIRIS-REx team suggests the Bennu is much less stable than expected. In fact, it could completely go to pieces in the coming eons.
Apple: ‘It’s Up to Microsoft’ to Get Windows Running on New ARM Macs
According to Apple, the question of supporting Windows on the M1 is entirely in Microsoft's court.