Researchers Devise Malware That Runs When an iPhone is Powered Off
Engineers and security experts at Germany’s Technical University of Darmstadt created wireless malware and loaded it onto a Bluetooth chip to test its effect on an iPhone that had been powered off. Executing the Bluetooth chip inflicted the iPhone with the malware, proving the popular smartphone isn’t safe from attack just because it isn’t on.
This is possible thanks to what Apple calls “low-power mode,” or LPM, which keeps most of the phone’s wireless chips running even after the device has been powered off.
But LPM also provides a prime opportunity for bad actors who are motivated to exploit an otherwise good thing. The Bluetooth and ultra-wideband (UWB) chips in an iPhone are hard-wired to a near field communication (NFC) chip’s secure element, and the device’s power management unit keeps these elements powered on. This means the parts of LPM that are useful to users—AKA location-tracking, credit cards, and personal transit passes—remain open to attack at all times.
In a published last week, the researchers point out that this vulnerability has previously been a concern for journalists attempting to defend themselves against potential espionage. “Since LPM support is implemented in hardware, it cannot be removed by changing software components,” they write. “As a result, on modern iPhones, wireless chips can no longer be trusted to be turned off after shutdown.” This could provide an opening for attackers to disable an iPhone’s Find My network and steal the device, or use Express Mode to steal the user’s financial or physical assets.
It’s worth pointing out that the researchers used a jailbroken iPhone to conduct the experiment. This means that the average out-of-the-box iPhone user is unlikely to experience an attack like the one simulated here—but that doesn’t mean Apple’s constantly-running LPM features are impervious to manipulation. If Apple’s LPM-associated elements aren’t protected by firmware, they’re vulnerable, whether the iPhone they’re inside of is jailbroken or not.
The researchers say they alerted Apple to these vulnerabilities. Apple reportedly read the researchers’ paper but “had no feedback on the paper’s contents.”
Now Read: