Security researchers at Paradigm Shift have disclosed a serious vulnerability they call usbliter8 in several older Apple devices. Unlike ordinary software bugs that can be fixed with an iOS update, this is a hardware flaw in the processor chips, so it cannot be patched in software and will remain present in affected devices.
The researchers said they informed Apple in advance and worked with the company before publishing their findings. Devices exposed to the flaw include the iPhone XR, iPhone XS, iPhone 11 and older iPhone SE models, as well as the iPad Air 3, iPad mini 5 and 9th-generation iPad. The issue also affects Apple Watch Series 4 and 5, and the HomePod mini.
Exploiting the flaw requires an attacker to physically possess the device and connect it to a computer with a USB cable. In that scenario, some of Apple’s protections can be bypassed and code can run before the operating system loads. The researchers stressed, however, that the flaw does not let an attacker reach the processor’s protected security area.
As a result, the lock code, Face ID, Touch ID and personal data stored on a locked device remain encrypted and protected. Users who want to avoid the risk entirely would need to move to a newer device that does not use the vulnerable hardware component. The researchers noted that similar hardware vulnerabilities in the past were mainly used to build jailbreak tools for older iPhones.
