On Friday, Barcelona-based offensive cybersecurity firm Paradigm Shift published details and a proof of concept for “usbliter8”, an unpatchable Boot ROM vulnerability in Apple’s A12 and A13 chips that could allow hackers with physical access to jailbreak older iPhones. This disclosure provides crucial technical ammunition for security researchers, government contractors, and exploit developers aiming to bypass iOS restrictions, provided they can chain this exploit with additional software vulnerabilities.
While Apple has established a reputation for building incredibly secure mobile operating systems, this development serves as a stark reminder that no hardware is entirely impervious to sophisticated, targeted attacks.
Understanding the ‘usbliter8’ Exploit and Affected Devices
The newly disclosed flaw, dubbed “usbliter8”, specifically targets devices powered by Apple’s A12 and A13 Bionic processors. These chips, launched in 2018 and 2019, power widely used legacy models including the iPhone XS, iPhone XR, and the iPhone 11 series.
According to a blog post and proof of concept released by Paradigm Shift, exploiting this vulnerability requires direct physical access to the target device. Consequently, the average user is not at immediate risk of remote hacking, as a physical cable connection is mandatory to trigger the exploit.
The Boot ROM Vulnerability: Why This Flaw is Permanent
The critical nature of this security flaw lies in its location. The bug resides within the iPhone’s Boot ROM, which is the initial, immutable code that executes the moment an iOS device is powered on. Because the Boot ROM acts as the very first line of defence, compromising it allows attackers to bypass subsequent security checks.
var playerInstance_jwplayer_6a7a09a1a991b = jwplayer( “jwplayer_6a7a09a1a991b” );
playerInstance_jwplayer_6a7a09a1a991b.setup({
playlist: “https://cdn.jwplayer.com/v2/media/lv0GaEwB”,
});
As the Boot ROM is hardcoded directly into the silicon during manufacturing, it cannot be modified via software updates. Paradigm Shift highlighted this limitation, noting that “as these vulnerabilities reside in immutable code, affected users should be aware that migrating to newer hardware remains the most effective mitigation.” In short, Apple is entirely unable to patch this hardware flaw.
Implications for Digital Forensics and Jailbreaking
Government contractors and digital forensics firms, such as Cellebrite and Magnet Forensics, routinely utilise similar Boot ROM exploits to access data on seized devices. While “usbliter8” facilitates the initial entry, hackers must still chain it with other undisclosed software vulnerabilities to fully decrypt and extract user data.
The Declining Era of Public Jailbreaks
Although public iPhone jailbreaks were highly popular in the early days of iOS, they have largely vanished over the past decade. Today, researchers who discover high-value iOS vulnerabilities have strong financial incentives to keep them private, as reporting them to Apple or selling them to private brokers yields far greater financial rewards than releasing them to the public.
Paradigm Shift has not responded to inquiries regarding the broader implications of the usbliter8 release.