Security Flaw Discovered in Millions of Older iPhones

Cybersecurity researchers have identified a significant security vulnerability, dubbed 'usbliter8,' that impacts seven popular iPhone models. The flaw affects devices powered by Apple's A12 and A13 Bionic chips, including the iPhone XS, iPhone XS Max, iPhone XR, iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, and iPhone SE (2nd generation).

The vulnerability resides within the BootROM, the initial code executed when an iPhone powers on. This hardware-level issue means it cannot be fully rectified through standard software updates. Experts warn that attackers could exploit this weakness to gain deep access to compromised devices, potentially bypassing security protections, stealing personal information, installing spyware, or controlling sensitive phone functions.

Paradigm Shift, the security firm that uncovered the flaw, described it as a hardware design oversight rather than a software bug. The vulnerability is exploited through the USB controller embedded in the chip. By sending a specific sequence of small data packets during startup, attackers can manipulate the controller to write data into protected memory sections.

Newer iPhone models are not affected due to design changes in their processors. Some older devices, such as those with the A11 chip, are also immune because their USB drivers reset a critical memory pointer after processing each data packet, which prevents the exploit from working.

While the vulnerability is concerning, the practical risk to most users is currently limited. Exploiting this flaw requires physical access to the device and specialized equipment, unlike remote cyberattacks. However, hardware-level vulnerabilities are particularly challenging to address as they are permanently embedded in the device's silicon.