iPhones rank among the most secure smartphones for typical users. Yet Apple products remain vulnerable to notable security problems, as seen with recent issues like Coruna and DarkSword. Security experts at Paradigm Shift have now outlined a fresh exploit named usbliter8. It impacts certain older iPhones and focuses on a core hardware element in Apple’s boot sequence known as the BootROM.

The BootROM serves as the initial startup code that activates before iOS begins. It initiates the boot sequence and checks what loads next. Since it forms part of the chip hardware, fixing it proves far tougher than addressing a standard iOS flaw. Apple can resolve software bugs via updates, yet it cannot alter BootROM code on devices already released.

How does the exploit work?

Researchers explain that usbliter8 leverages a flaw in the iPhone USB hardware and how older Apple chips manage USB data at startup. In basic terms, an attacker might transmit crafted USB data during device startup or restore mode. This can disrupt the USB controller and lead to data writing in incorrect memory locations. The exploit can then alter the boot process and execute unauthorized code before iOS fully loads.

The threat carries a key restriction. It does not allow remote attacks via websites, messages, or apps. It needs direct USB access, so the iPhone must connect to a computer or USB device.

Which iPhones are affected?

The exploit impacts Apple devices with A12 and A13 chips plus S4 and S5 smartwatch chips. Affected iPhones include the XR, XS, XS Max, 11, 11 Pro, 11 Pro Max, and second-generation SE. For watches, the list covers Series 4, Series 5, and the first SE model. Researchers note the exploit proves harder to carry out on A13 devices.

As a hardware issue, no standard software update can fully eliminate the risk. A solid practice involves avoiding connections of older iPhones or watches to unknown computers, public USB ports, or untrusted accessories. Owners of affected models who prioritize security may find the greatest assurance by upgrading to newer devices.