Unfixable Security Flaw Affects Older iPhones, Cybersecurity Firm Warns
A vulnerability in the USB controller and firmware allows hackers to jailbreak devices before iOS loads, but requires physical access.
Cybersecurity experts at Paradigm Shift have identified a significant, unfixable security flaw impacting several older iPhone models and other Apple devices. The vulnerability, dubbed usbliter8, affects the device's USB controller and firmware, potentially allowing malicious actors to override the startup process and jailbreak the device before the operating system loads.
This exploit could enable hackers to run unauthorized software or extract sensitive information from compromised devices. According to Apple Insider, the flaw impacts iPhone models equipped with A12 and A13 chips, specifically the iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, second-generation iPhone SE, iPhone XR, iPhone XS, and iPhone XS Max.
In addition to these iPhone models, the vulnerability also extends to devices powered by S4 and S5 chips, which are found in certain iPad and Apple Watch models. This includes the eighth and ninth generation iPads, the third-generation iPad Air, the fifth-generation iPad Mini, the first and second-generation 11-inch iPad Pro, the third and fourth-generation 12.9-inch iPad Pro, the first-generation Apple Watch SE, and the Apple Watch Series 4 and 5.
A key detail of this vulnerability is that it cannot be exploited remotely; hackers require physical access to the device. However, this poses a risk for stolen or confiscated devices. Paradigm Shift noted in their findings that the flaw is rooted in the hardware design rather than a software bug, meaning Apple cannot issue a software update to fix it. The firm advises that migrating to newer hardware is the most effective mitigation strategy against this vulnerability.